[java-idp-oidc] branch dev/JOIDC-222 updated (ca56d2ca -> f9d3dc53)
Henri Mikkonen
henri.mikkonen at iki.fi
Tue Jun 24 08:52:36 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a change to branch dev/JOIDC-222
in repository java-idp-oidc.
discard ca56d2ca JOIDC-222 - Support for OpenID Federation
discard 2ac7c421 JOIDC-222 - Support for OpenID Federation
discard 1a7cbca0 Fix expression in nimbus-jose-jwt Javadoc link
discard a035117c JOIDC-222 - Support for OpenID Federation
discard 15292e6b JOIDC-222 - Support for OpenID Federation
discard a721e204 JOIDC-222 - Support for OpenID Federation
discard de489850 JOIDC-222 - Support for OpenID Federation
discard d08bb131 JOIDC-240 - RP metadata unnecessarily requires a value for response_types
discard e5e9a153 JOIDC-222 - Support for OpenID Federation
discard f6016660 JOIDC-222 - Support for OpenID Federation
discard f03f8ef2 JOIDC-222 - Support for OpenID Federation
discard e8a6e6d4 JOIDC-222 - Support for OpenID Federation
discard aa0cde0e JOIDC-222 - Support for OpenID Federation
discard 469ff3a8 JOIDC-222 - Support for OpenID Federation
discard f0324c3d JOIDC-222 - Support for OpenID Federation
discard 60c1fcb0 JOIDC-222 - Support for OpenID Federation
discard 2c23bee0 JOIDC-222 - Support for OpenID Federation
discard 12f632be JOIDC-222 - Support for OpenID Federation
discard 029aee73 JOIDC-222 - Support for OpenID Federation
discard 9967df14 JOIDC-222 - Support for OpenID Federation
discard d6e5a65b JOIDC-222 - Support for OpenID Federation
discard 457614ca JOIDC-222 - Support for OpenID Federation
discard 822bb80a JOIDC-222 - Support for OpenID Federation
discard ff56d215 Adapt token flow test into the current flow containing 'UnwrapGrant' action.
discard 721a9475 JOIDC-222 - Support for OpenID Federation
discard 4b2f71a7 JOIDC-222 - Support for OpenID Federation
discard b4606b80 JOIDC-222 - Support for OpenID Federation
discard 78243f10 JOIDC-222 - Support for OpenID Federation
discard 2383cefc JOIDC-222 - Support for OpenID Federation
discard f7cfa17d JOIDC-222 - Support for OpenID Federation
discard 9df87708 JOIDC-222 - Support for OpenID Federation
discard ed4aacd0 JOIDC-222 - Support for OpenID Federation
discard 5671e165 Bump version to 4.3.0-SNAPSHOT
discard f87d1def Bump version after release
discard 2d36efd1 Update files to be tagged for release
discard 11bfd420 Bump module ID to idp.oidc.OP.5
discard cffb52e6 Add missing limitInitialAccessTokenToSelf to OAUTH2.Token.MDDriven.
discard 60224868 Replaced requireDpopProofPredicate in the MDDriven configuration
discard e51f297a Add missing MDDriven profile configuration option wirings
discard bbe9996e JOIDC-225 - Relocate and improve lookup functions for request message contents
discard 23d9cd17 JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
discard ea3a2a7a JOIDC-178 - Allow redirection URI validation via custom function
discard ad710e91 JOIDC-224 - Openid-scope with client credentials grant may cause wrong error
discard 08ec1b4a JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
discard 3b42409e JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
discard f7e666e1 JavaDoc fix.
discard 43f57f1f JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
discard 3bcf1c5b Refer to the classes already existing in java-oidc-common
discard 9753e891 JOIDC-225 - Relocate and improve lookup functions for request message contents
discard 3383c0a5 JOIDC-232 - Protocol trace log only display first parameter value
discard c4c79ece JOIDC-230 - Add flag to block additional audiences from initial access token
discard 7fa5f211 JOIDC-231 - Multiple resource parameters cause MessageDecodingException
discard d89331e1 JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
discard 31844651 JOIDC-229 - Provide method for strict scope validation
discard 0c3a5928 JOIDC-225 - Relocate and improve lookup functions for request message contents
discard a488423e JOIDC-225 - Relocate and improve lookup functions for request message contents
discard 084375f7 JOIDC-228 - Exclude end-session flow from the IdP response header filter coverage
discard d7ad6e62 JOIDC-227 - OIDC RP-init Logout vm Uncaught runtime exception
discard 515e3a0f JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
discard 1a182248 JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
discard a0f93bc0 JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
discard 94b8da36 Clarify intro comment about registry service.
discard 4a7b2843 Fix log message.
discard 0b16b237 Updated the scope of authorization/authentication request parameter lookup beans.
discard 8a570f39 Fixed a log message to start with the log prefix.
discard 9d84c995 JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
discard bb0adf92 JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
discard 62e69dbf JOIDC-222 - Support for OpenID Federation
add 7b49ee7e JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
add 13921e1e JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
add 93e7da70 Fixed a log message to start with the log prefix.
add 56b3d6a5 Updated the scope of authorization/authentication request parameter lookup beans.
add 97bf9574 Fix log message.
add d18d00ad Clarify intro comment about registry service.
add 54c7acb9 JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
add 7fcb59ee JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
add 33ea46ad JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
add d079559e JOIDC-227 - OIDC RP-init Logout vm Uncaught runtime exception
add ebe31071 JOIDC-228 - Exclude end-session flow from the IdP response header filter coverage
add 5cfce8fb JOIDC-225 - Relocate and improve lookup functions for request message contents
add 25e8019e JOIDC-225 - Relocate and improve lookup functions for request message contents
add cb56b984 JOIDC-229 - Provide method for strict scope validation
add caa7f58c JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
add 6eda016b JOIDC-231 - Multiple resource parameters cause MessageDecodingException
add fb4dcc49 JOIDC-230 - Add flag to block additional audiences from initial access token
add 15703fc3 JOIDC-232 - Protocol trace log only display first parameter value
add 5a49bdbf JOIDC-225 - Relocate and improve lookup functions for request message contents
add 6518e6a0 Refer to the classes already existing in java-oidc-common
add 575241a0 JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
add 9185e74e JavaDoc fix.
add e2ec0660 JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
add e54a7e0d JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
add fb9ca7dd JOIDC-224 - Openid-scope with client credentials grant may cause wrong error
add 871bd594 JOIDC-178 - Allow redirection URI validation via custom function
add 2598960f JOIDC-201 - Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
add b3baf618 JOIDC-225 - Relocate and improve lookup functions for request message contents
add 451fffb4 Add missing MDDriven profile configuration option wirings
add ec08b466 Replaced requireDpopProofPredicate in the MDDriven configuration
add ac42c06c Add missing limitInitialAccessTokenToSelf to OAUTH2.Token.MDDriven.
add f4dba2c7 Bump module ID to idp.oidc.OP.5
add ba8c3fab Update files to be tagged for release
add 82989255 Bump version after release
add 5122bcbc JOIDC-237 - IllegalStateException in view-state CallFrontChannelLogoutUriView
add e46c86a9 Update files to be tagged for release
add b8a5d727 Bump version after release
add 0064cb4a JOIDC-240 - RP metadata unnecessarily requires a value for response_types
add 17f5d638 Fix expression in nimbus-jose-jwt Javadoc link
add fbd4b0e1 Bump version to 4.3.0-SNAPSHOT and dependency to oidc-common/config
add 655d48e7 JOIDC-241 - Inherit OIDC.SSO.MDDriven and its abstract beans from oidc-config
add 40c5e883 JOIDC-242 - Require issuer value as JWT authentication audience by default
add 219ae1e5 JOIDC-244 - Support client authentication JWT header type validation
add 39810c52 JOIDC-243 - Wire audit extractor for destination URL
add 843ee7ac JOIDC-236 - Audit logging for OAuth2Client login flow
add fb0f776b Add a TODO for new 5.2 feature, per JOIDC-245.
add 77db8da9 JOIDC-246 - Support disallowedFeatures to block essential acr requests
add bd4c9792 JOIDC-235 - AdministrativeLogoutConfiguration for OIDC
add 628d05df JOIDC-235 - AdministrativeLogoutConfiguration for OIDC
add 585ae9dc JOIDC-246 - Support disallowedFeatures property for blocking essential acr requests
add 004a29a9 JOIDC-243 - Wire audit extractor for destination URL
add 3960d946 Update reference to the feature flag for disallowing essential ACR claim requests
add 0a4aaa4a Switched PROFILE_ID reference for the OIDC.SSO profile
add e6b7abb2 JOIDC-242 - Support new profile configuration options for JWT authentication audience
add a82c42ce JOIDCCONF-10 - Update config to next major version
add a2284922 JOIDC-249 - Introspection endpoint does not display username for JWT access tokens
add b27b4bc7 JOIDC-235 - AdministrativeLogoutConfiguration for OIDC
add 52716e94 JOIDC-235 - AdministrativeLogoutConfiguration for OIDC
add 01667df2 JOIDC-235 - AdministrativeLogoutConfiguration for OIDC
add 34d7d652 Fixed version in the json-smart Javadoc link.
add 0e511672 Update files to be tagged for release
add 842a3b55 Bump version after release
new 0ceda8ca JOIDC-222 - Support for OpenID Federation
new 23d231d2 JOIDC-222 - Support for OpenID Federation
new 43a3f09e JOIDC-222 - Support for OpenID Federation
new bee9bb40 JOIDC-222 - Support for OpenID Federation
new fe061002 JOIDC-222 - Support for OpenID Federation
new ff8c0579 JOIDC-222 - Support for OpenID Federation
new 40178d7c JOIDC-222 - Support for OpenID Federation
new 6a439a26 JOIDC-222 - Support for OpenID Federation
new e2c96709 JOIDC-222 - Support for OpenID Federation
new 78bd3563 Adapt token flow test into the current flow containing 'UnwrapGrant' action.
new d2280eec JOIDC-222 - Support for OpenID Federation
new a99989fb JOIDC-222 - Support for OpenID Federation
new f7156a42 JOIDC-222 - Support for OpenID Federation
new a613edef JOIDC-222 - Support for OpenID Federation
new a18f9f49 JOIDC-222 - Support for OpenID Federation
new 8efc94a1 JOIDC-222 - Support for OpenID Federation
new 6ae754dc JOIDC-222 - Support for OpenID Federation
new 3f37b9a4 JOIDC-222 - Support for OpenID Federation
new 57bb9790 JOIDC-222 - Support for OpenID Federation
new a9e842b3 JOIDC-222 - Support for OpenID Federation
new b1be1d1a JOIDC-222 - Support for OpenID Federation
new f9fd2148 JOIDC-222 - Support for OpenID Federation
new 910cbcb5 JOIDC-222 - Support for OpenID Federation
new d94d66cf JOIDC-222 - Support for OpenID Federation
new c5a73593 JOIDC-222 - Support for OpenID Federation
new cda60b8b JOIDC-222 - Support for OpenID Federation
new 7041daf7 JOIDC-222 - Support for OpenID Federation
new 13f6fc49 JOIDC-222 - Support for OpenID Federation
new b13a2059 JOIDC-222 - Support for OpenID Federation
new 58274973 JOIDC-222 - Support for OpenID Federation
new f9d3dc53 JOIDC-222 - Support for OpenID Federation
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (ca56d2ca)
\
N -- N -- N refs/heads/dev/JOIDC-222 (f9d3dc53)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 31 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
idp-oidc-extension-api/pom.xml | 2 +-
idp-oidc-extension-distribution/pom.xml | 2 +-
idp-oidc-extension-impl/pom.xml | 2 +-
...ava => ValidatedRedirectUriAuditExtractor.java} | 26 +-
...thenticationJWTPayloadClaimsAuditExtractor.java | 99 ++++++
...tAuthenticationJWTTypeHeaderAuditExtractor.java | 75 +++++
.../oidc/op/authn/audit/impl}/package-info.java | 6 +-
.../oidc/op/authn/impl/JWTCredentialValidator.java | 36 ++-
.../profile/impl/AbstractProcessTokenAction.java | 5 +-
.../profile/impl/ProcessRequestedAuthnContext.java | 56 +++-
.../plugin/oidc/op/profile/impl/ValidateGrant.java | 28 +-
.../logic/AttributeTokenRevocationCondition.java | 277 ++++++++++++++++
.../impl/TokenRevocationConditionValidator.java | 57 ++++
.../META-INF/net.shibboleth.idp/postconfig.xml | 15 +
.../authn/OAuth2Client/OAuth2Client-beans.xml | 72 ++++-
.../oidc/oidc-logout-propagation-flow.xml | 2 +-
.../idp/flows/oidc/authorize/authorize-beans.xml | 100 +++++-
.../idp/flows/oidc/token/token-beans.xml | 5 +-
.../idp/service/relying-party/postconfig.xml | 350 ++-------------------
.../idp/plugin/oidc/op/conf/oidc.properties | 5 +
.../idp/plugin/oidc/op/module.properties | 154 ++++-----
.../idp/plugin/oidc/op/plugin.properties | 4 +-
.../op/authn/impl/JWTCredentialValidatorTest.java | 90 +++++-
.../op/profile/flow/AbstractOidcApiFlowTest.java | 13 +
.../AbstractOidcClientAuthenticationFlowTest.java | 69 +++-
.../oidc/op/profile/flow/AbstractOidcFlowTest.java | 12 +-
.../oidc/op/profile/flow/AuthorizeFlowTest.java | 94 +++++-
.../op/profile/flow/IntrospectionFlowTest.java | 86 ++++-
.../op/profile/flow/PushedAuthorizeFlowTest.java | 3 +
.../oidc/op/profile/flow/RevocationFlowTest.java | 3 +
.../plugin/oidc/op/profile/flow/TokenFlowTest.java | 25 ++
.../plugin/oidc/op/profile/flow/UserInfoTest.java | 25 ++
.../AttributeTokenRevocationConditionTest.java | 167 ++++++++++
.../idp/module/conf/attribute-resolver.xml | 15 +
.../net/shibboleth/idp/module/conf/global.xml | 7 +
.../net/shibboleth/idp/module/conf/oidc.properties | 12 +
.../shibboleth/idp/module/conf/relying-party.xml | 40 +++
pom.xml | 8 +-
38 files changed, 1583 insertions(+), 464 deletions(-)
copy idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/{SubjectValueAuditExtractor.java => ValidatedRedirectUriAuditExtractor.java} (77%)
create mode 100644 idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTPayloadClaimsAuditExtractor.java
create mode 100644 idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTTypeHeaderAuditExtractor.java
copy {idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin => idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl}/package-info.java (81%)
create mode 100644 idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeTokenRevocationCondition.java
create mode 100644 idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/jwt/claims/impl/TokenRevocationConditionValidator.java
create mode 100644 idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeTokenRevocationConditionTest.java
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list