[java-idp-plugin-oidc-op-oidfed] 02/02: Support trust_anchor_hints in the entity configuration
Codeberg
noreply at shibboleth.net
Fri Nov 28 07:24:32 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/d71c9f1f45c01ba0be1c904eae34b7de24ef7042
commit d71c9f1f45c01ba0be1c904eae34b7de24ef7042
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Nov 28 09:14:00 2025 +0200
Support trust_anchor_hints in the entity configuration
- The default function (DefaultTrustAnchorHintsLookupStrategy) fetches the trusted anchor IDs from 'shibboleth.oidfed.LocalTrustAnchorsMetadataCache'
- May be overrided via property 'idp.oidfed.entity-configuration.trustAnchoHintsLookup'
- The function is expected to be Function<ProfileRequestContext,List<String>>
---
.../profile/impl/BuildEntityConfiguration.java | 32 ++++++++
.../DefaultTrustAnchorHintsLookupStrategy.java | 89 ++++++++++++++++++++++
.../entity-configuration-beans.xml | 7 +-
.../flow/oidfed/EntityConfigurationFlowTest.java | 2 +
4 files changed, 129 insertions(+), 1 deletion(-)
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java
index 2e1d935..f453ba7 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java
@@ -39,8 +39,10 @@ import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction;
import net.shibboleth.oidc.security.CredentialConversionUtil;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -69,6 +71,9 @@ public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction
/** Strategy used to locate authority hints. */
@Nonnull private Function<ProfileRequestContext,List<String>> authorityHintsLookupStrategy;
+ /** Strategy used to locate trust_anchor_hints. */
+ @NonnullAfterInit private Function<ProfileRequestContext,List<String>> trustAnchorHintsLookupStrategy;
+
/** Metadata to publish. */
@NonnullBeforeExec private Map<String,Map<String,Object>> metadata;
@@ -116,6 +121,29 @@ public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction
authorityHintsLookupStrategy = Constraint.isNotNull(strategy, "Authority hints lookup strategy cannot be null");
}
+ /**
+ * Set the strategy used to locate trust anchor hints.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setTrustAnchorHintsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
+ checkSetterPreconditions();
+
+ trustAnchorHintsLookupStrategy =
+ Constraint.isNotNull(strategy, "Trust anchor hints lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (trustAnchorHintsLookupStrategy == null) {
+ throw new ComponentInitializationException("Trust anchor hints lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -173,6 +201,10 @@ public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction
if (authorityHints != null && !authorityHints.isEmpty()) {
builder.claim("authority_hints", authorityHints);
}
+ final List<String> trustAnchorHints = trustAnchorHintsLookupStrategy.apply(profileRequestContext);
+ if (trustAnchorHints != null && !trustAnchorHints.isEmpty()) {
+ builder.claim("trust_anchor_hints", trustAnchorHints);
+ }
return true;
}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java
new file mode 100644
index 0000000..b9090e9
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.LocalKeyContainer;
+import net.shibboleth.oidc.metadata.cache.MetadataCache;
+import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.resolver.CriteriaSet;
+
+/**
+ * Default strategy to fetch value for the trust_amchor_hints -claim. The value is fetched from the configurable
+ * {@link MetadataCache} containing trusted trust anchors.
+ */
+public class DefaultTrustAnchorHintsLookupStrategy extends AbstractIdentifiableInitializableComponent
+ implements Function<ProfileRequestContext,List<String>> {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(DefaultTrustAnchorHintsLookupStrategy.class);
+
+ /** Cache containing trusted trust anchors. */
+ @NonnullAfterInit private MetadataCache<Map<String, LocalKeyContainer>> trustAnchorsCache;
+
+ /**
+ * Set the cache containing trusted trust anchors.
+ *
+ * @param cache trust anchors cache
+ */
+ public void setTrustAnchorsCache(
+ @Nonnull final MetadataCache<Map<String, LocalKeyContainer>> cache) {
+ checkSetterPreconditions();
+ trustAnchorsCache = Constraint.isNotNull(cache, "Trust Anchors cache cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (trustAnchorsCache == null) {
+ throw new ComponentInitializationException("Trust Anchors cache cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override @Nullable
+ public List<String> apply(@Nullable final ProfileRequestContext profileRequestContext) {
+ checkComponentActive();
+ final List<Map<String, LocalKeyContainer>> keyContainers;
+ try {
+ keyContainers = trustAnchorsCache.get(new CriteriaSet());
+ } catch (final MetadataCacheException e) {
+ log.warn("Could not resolve any trust anchors", e);
+ return null;
+ }
+ if (keyContainers == null || keyContainers.isEmpty()) {
+ log.debug("No keycontainers returned from the trust anchor cache");
+ return null;
+ }
+ return keyContainers.get(0).keySet().stream().filter(Objects::nonNull).toList();
+ }
+}
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
index 035729a..9eb731d 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
@@ -97,7 +97,12 @@
<bean id="BuildEntityStatement"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.BuildEntityConfiguration" scope="prototype"
p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"
- p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}" />
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}"
+ p:trustAnchorHintsLookupStrategy-ref="#{'%{idp.oidfed.entity-configuration.trustAnchoHintsLookup:DefaultTrustAnchorHintsLookupStrategy}'.trim()}"/>
+
+ <bean id="DefaultTrustAnchorHintsLookupStrategy"
+ class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustAnchorHintsLookupStrategy"
+ p:trustAnchorsCache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache"/>
<bean id="SignEntityStatement" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
scope="prototype" c:executionDirection="OUTBOUND ">
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
index 0d718bc..12d6846 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
@@ -106,6 +106,8 @@ public class EntityConfigurationFlowTest extends AbstractFederationFlowTest {
Assert.assertEquals(entityMetadata.getContacts(), List.of("contact at example.org"));
Assert.assertEquals(entityStatement.getClaimsSet().getAuthorityHints(),
List.of(new EntityID("https://anchor1.example.org"), new EntityID("https://anchor2.example.org")));
+ final List<String> trustAnchorHints = entityStatement.getClaimsSet().getStringListClaim("trust_anchor_hints");
+ Assert.assertEquals(trustAnchorHints, List.of(anchorId));
}
protected boolean containsAll(Collection<? extends Algorithm> algs, Collection<String> strings) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list