[java-idp-oidc] 02/02: JOIDC-235 - AdministrativeLogoutConfiguration for OIDC

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=b27b4bc781c6cd9d2ff78cfd7d6aaf17211c7732

commit b27b4bc781c6cd9d2ff78cfd7d6aaf17211c7732
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Jun 18 15:26:25 2025 +0300

    JOIDC-235 - AdministrativeLogoutConfiguration for OIDC
    
    https://shibboleth.atlassian.net/browse/JOIDC-235
    
    - Improved the 'shibboleth.oauth2.revocationCondition.AttributeTokenRevocationCondition' bean
      - Changed the resolution label (i.e. resolutionPhase within attribute configurations) into 'tokenRevocation'
      - Primarily exploit the user principal ('prncpl') from the claims set, subject if it's null
      - Improved testing
---
 .../op/profile/logic/AttributeTokenRevocationCondition.java  |  2 +-
 .../resources/META-INF/net.shibboleth.idp/postconfig.xml     |  2 +-
 .../net/shibboleth/idp/module/conf/attribute-resolver.xml    | 12 ++++++++----
 .../test/resources/net/shibboleth/idp/module/conf/global.xml |  7 ++-----
 4 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeTokenRevocationCondition.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeTokenRevocationCondition.java
index b0986eea..71d5e01b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeTokenRevocationCondition.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeTokenRevocationCondition.java
@@ -225,7 +225,7 @@ public class AttributeTokenRevocationCondition extends AbstractInitializableComp
 
         resolutionContext
             .setPrincipal(principal)
-            .setResolutionLabel("Token revocation");
+            .setResolutionLabel("tokenRevocation");
         assert attributeId != null;
         resolutionContext.setRequestedIdPAttributeNames(CollectionSupport.singletonList(attributeId));
 
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index af2e2b82..67a79380 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -889,7 +889,7 @@
         p:attributeResolver-ref="shibboleth.AttributeResolverService"
         p:attributeId="#{'%{idp.oauth2.revocationCondition.attributeId:revocation}'.trim()}">
         <property name="principalNameLookupStrategy">
-            <bean parent="shibboleth.BiFunctions.Expression" c:expression="#input2.getSubject()" />
+            <bean parent="shibboleth.BiFunctions.Expression" c:expression="#input2.getStringClaim(T(net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet).KEY_USER_PRINCIPAL) != null ? #input2.getStringClaim(T(net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet).KEY_USER_PRINCIPAL) : #input2.getSubject()" />
         </property>
     </bean>
 
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml
index 2ee49ded..103d186f 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml
@@ -76,13 +76,17 @@
         <AttributeEncoder xsi:type="oidc:OIDCString" name="sub" />
     </AttributeDefinition>
 
-    <AttributeDefinition id="customRevocation" xsi:type="DateTime" epochInSeconds="false">
-        <InputAttributeDefinition ref="currentTimePlusHour"/>
+    <AttributeDefinition id="customRevocation" xsi:type="DateTime" epochInSeconds="false" resolutionPhases="tokenRevocation">
+        <InputAttributeDefinition ref="revocationTime"/>
     </AttributeDefinition>
 
-    <AttributeDefinition id="currentTimePlusHour" xsi:type="ScriptedAttribute" dependencyOnly="true">
+    <AttributeDefinition id="revocationTime" xsi:type="ScriptedAttribute" dependencyOnly="true"
+        resolutionPhases="tokenRevocation" customObjectRef="shibboleth.RelyingPartyIdLookup.Simple">
+        <InputAttributeDefinition ref="uid" />
         <Script><![CDATA[
-            currentTimePlusHour.addValue((new Date().getTime() + 3600000).toString());
+            if (custom.apply(profileContext).equals('mockClientIdActivateRevocationCondition')) {
+                revocationTime.addValue((new Date().getTime() + 3600000).toString());
+            }
             ]]>
         </Script>
     </AttributeDefinition>
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml
index 26c6ba84..31b04345 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/global.xml
@@ -13,12 +13,9 @@
        default-destroy-method="destroy">
 
     <bean id="CustomTokenRevocationCondition" parent="shibboleth.BiConditions.Expression"
-        c:expression="'mockClientIdActivateRevocationCondition'.equals(#custom.get('rp').apply(#input1)) and #custom.get('condition').test(#input1, #input2)">
+        c:expression="#custom.test(#input1, #input2)">
         <property name="customObject">
-            <util:map value-type="java.lang.Object">
-                <entry key="rp"><ref bean="shibboleth.RelyingPartyIdLookup.Simple"/></entry>
-                <entry key="condition"><ref bean="shibboleth.oauth2.revocationCondition.AttributeTokenRevocationCondition"/></entry>
-            </util:map>
+            <ref bean="shibboleth.oauth2.revocationCondition.AttributeTokenRevocationCondition"/>
         </property>
     </bean>
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.