[java-plugin-shibd-oidc] branch main updated: Fix property namespaces
Codeberg
noreply at shibboleth.net
Fri Nov 28 10:02:58 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/4194b0eb8baf88c1d96656275a5be237f8c12fb4
The following commit(s) were added to refs/heads/main by this push:
new 4194b0e Fix property namespaces
4194b0e is described below
commit 4194b0eb8baf88c1d96656275a5be237f8c12fb4
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Nov 28 10:02:47 2025 +0000
Fix property namespaces
- Move idp. to sp.oidc
---
.../net/shibboleth/sp/service/agent/postconfig.xml | 107 ++++++++-------------
1 file changed, 41 insertions(+), 66 deletions(-)
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index 27924fd..82b002b 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -34,7 +34,7 @@
<!-- Singleton JWK cache -->
<bean id="shibboleth.oidc.RemoteJwkSetCache"
class="net.shibboleth.oidc.jwk.RemoteJwkSetCache"
- p:storage-ref="#{'%{idp.oidc.jwk.StorageService:shibboleth.StorageService}'.trim()}"
+ p:storage-ref="#{'%{sp.oidc.jwk.StorageService:shibboleth.StorageService}'.trim()}"
p:httpClient="#{getObject('%{sp.oidc.HttpClient:}') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('%{sp.oidc.httpClientSecurityParameters:}')}" />
@@ -63,79 +63,54 @@
p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
<bean id="AbstractOIDCProfile" abstract="true"
- p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+ p:securityConfiguration-ref="%{sp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
<bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
p:issuer="#{getObject('shibboleth.oidc.issuer')}"
- p:tokenEndpointAuthMethods="%{idp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
+ p:tokenEndpointAuthMethods="%{sp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator="#{getObject('DefaultJWTClaimsValidator')}"
- p:encryptionOptional="%{idp.oidc.encryptionOptional:true}"
- p:forcePKCE="%{idp.oidc.forcePKCE:false}"
- p:allowPKCEPlain="%{idp.oidc.allowPKCEPlain:false}"
- p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
- p:accessTokenType="%{idp.oauth2.accessToken.type:}"
- p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
- p:refreshTokenType="%{idp.oauth2.refreshToken.type:}"
- p:refreshTokenTimeout="%{idp.oidc.refreshToken.defaultTimeout:PT2H}"
- p:refreshTokenChainLifetime="%{idp.oidc.refreshToken.defaultChainLifetime:PT2H}"
- p:alwaysIncludedAttributes="%{idp.oidc.alwaysIncludedAttributes:}"
- p:tokenEndpointAuthMethod="%{idp.authn.oidc.rp.client.authenticationMethod:client_secret_basic}"
- p:useTargetedEndpointAsJWTAudience="%{idp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:true}"
- p:requireSingleJWTAudience="%{idp.oauth2.jwtAuth.requireSingleJWTAudience:false}"
+ p:encryptionOptional="%{sp.oidc.encryptionOptional:true}"
+ p:forcePKCE="%{sp.oidc.forcePKCE:false}"
+ p:allowPKCEPlain="%{sp.oidc.allowPKCEPlain:false}"
+ p:iDTokenLifetime="%{sp.oidc.idToken.defaultLifetime:PT1H}"
+ p:accessTokenType="%{sp.oauth2.accessToken.type:}"
+ p:accessTokenLifetime="%{sp.oidc.accessToken.defaultLifetime:PT10M}"
+ p:refreshTokenType="%{sp.oauth2.refreshToken.type:}"
+ p:refreshTokenTimeout="%{sp.oidc.refreshToken.defaultTimeout:PT2H}"
+ p:refreshTokenChainLifetime="%{sp.oidc.refreshToken.defaultChainLifetime:PT2H}"
+ p:alwaysIncludedAttributes="%{sp.oidc.alwaysIncludedAttributes:}"
+ p:tokenEndpointAuthMethod="%{sp.oidc..authenticationMethod:client_secret_basic}"
+ p:useTargetedEndpointAsJWTAudience="%{sp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:true}"
+ p:requireSingleJWTAudience="%{sp.oauth2.jwtAuth.requireSingleJWTAudience:false}"
p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}"
p:dpopProofClaimsValidator="#{getObject('DefaultDPoPProofClaimsValidator')}"
p:dpopProofSignatureValidationConfiguration="#{getObject('DPoPSignatureValidationConfiguration')}"
p:dpopProofNonceGenerator="#{getObject('DefaultOAuth2DPoPNonceGenerator')}"
- p:strictScopeValidation="%{idp.oidc.strictScopeValidation:false}"/>
+ p:strictScopeValidation="%{sp.oidc.strictScopeValidation:false}"/>
<bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration"
- p:authorizeCodeLifetime="%{idp.oidc.authorizeCode.defaultLifetime:PT5M}"
- p:encodeConsentInTokens="%{idp.oidc.encodeConsentInTokens:false}"
- p:encodedAttributes="%{idp.oidc.encodedAttributes:%{idp.oidc.embeddedAttributes:}}"
- p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}"
- p:httpRequestMethod="%{idp.authn.oidc.rp.httpRequestMethod:GET}"
- p:retrieveUserInfoEndpointClaims="%{idp.authn.oidc.rp.client.userinfo.enabled:true}"
- p:redirectUriOverride="%{idp.authn.oidc.rp.client.redirectURI:#{null}}"
- p:encryptRequestObject="%{idp.oidc.requestobject.encrypted:false}"
- p:signRequestObject="%{idp.oidc.requestobject.signed:true}"
- p:useRequestObject="%{idp.oidc.requestobject.used:false}"
- p:responseMode="%{idp.authn.oidc.rp.client.responseMode:#{null}}"
- p:tlsServerValidationSufficient="%{idp.authn.oidc.rp.client.idtoken.tlsServerValidationOnly:false}"
- p:userInfoHttpRequestMethod="%{idp.authn.oidc.rp.client.userinfo.httpRequestMethod:GET}"
- p:scopes="%{idp.authn.oidc.rp.client.scopes:#{null}}"
- p:responseModes="%{idp.oauth2.responseModes:}"
- p:requireAuthenticationRequestPredicate-ref="%{idp.oauth2.requireAuthenticationRequestPredicate:shibboleth.Conditions.TRUE}">
- <property name="forceAuthnPredicate">
- <bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
- </property>
- <property name="defaultAuthenticationMethodsLookupStrategy">
- <bean
- class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction"
- p:mappings="#{getObject('shibboleth.oidc.PrincipalProxyRequestMappings')}" />
- </property>
- <property name="authenticationContextClassReferenceTranslationStrategyLookupStrategy">
- <bean
- class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
- <constructor-arg>
- <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
- c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
- </constructor-arg>
- </bean>
- </property>
- <property name="authenticationMethodsReferencesTranslationStrategyLookupStrategy">
- <bean
- class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction$LookupFunctionWrapper">
- <constructor-arg>
- <bean class="net.shibboleth.oidc.profile.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassResponseLookupFunction"
- c:mappings="#{getObject('shibboleth.oidc.PrincipalProxyResponseMappings')}"/>
- </constructor-arg>
- </bean>
- </property>
+ p:authorizeCodeLifetime="%{sp.oidc.authorizeCode.defaultLifetime:PT5M}"
+ p:encodeConsentInTokens="%{sp.oidc.encodeConsentInTokens:false}"
+ p:encodedAttributes="%{sp.oidc.encodedAttributes:%{sp.oidc.embeddedAttributes:}}"
+ p:deniedUserInfoAttributes="%{sp.oidc.deniedUserInfoAttributes:}"
+ p:resolveAttributes="%{sp.oidc.resolveAttributes:true}"
+ p:httpRequestMethod="%{sp.oidc.httpRequestMethod:GET}"
+ p:retrieveUserInfoEndpointClaims="%{sp.oidc.userinfo.enabled:true}"
+ p:redirectUriOverride="%{sp.oidc.redirectURI:#{null}}"
+ p:encryptRequestObject="%{sp.oidc.requestobject.encrypted:false}"
+ p:signRequestObject="%{sp.oidc.requestobject.signed:true}"
+ p:useRequestObject="%{sp.oidc.requestobject.used:false}"
+ p:responseMode="%{sp.oidc.responseMode:#{null}}"
+ p:tlsServerValidationSufficient="%{sp.oidc.idtoken.tlsServerValidationOnly:false}"
+ p:userInfoHttpRequestMethod="%{sp.oidc.userinfo.httpRequestMethod:GET}"
+ p:scopes="%{sp.oidc.scopes:#{null}}"
+ p:responseModes="%{sp.oauth2.responseModes:}"
+ p:requireAuthenticationRequestPredicate-ref="%{sp.oauth2.requireAuthenticationRequestPredicate:shibboleth.Conditions.TRUE}">
</bean>
<bean id="shibboleth.oidc.DefaultSecurityConfiguration"
- class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration" c:clockSkew="%{idp.policy.clockSkew:PT1M}">
+ class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration" c:clockSkew="%{sp.policy.clockSkew:PT1M}">
<constructor-arg name="idGenerator">
<bean
class="net.shibboleth.shared.security.IdentifierGenerationStrategy" factory-method="getInstance">
@@ -146,16 +121,16 @@
</bean>
</constructor-arg>
<property name="jwtSignatureSigningConfiguration">
- <ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
+ <ref bean="#{'%{sp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
</property>
<property name="jwtEncryptionConfiguration">
- <ref bean="#{'%{idp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
+ <ref bean="#{'%{sp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
</property>
<property name="jwtDecryptionConfiguration">
- <ref bean="#{'%{idp.oidc.decryption.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
+ <ref bean="#{'%{sp.oidc.decryption.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
</property>
<property name="jwtSignatureValidationConfiguration">
- <ref bean="#{'%{idp.oidc.validation.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
+ <ref bean="#{'%{sp.oidc.validation.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
</property>
</bean>
@@ -259,7 +234,7 @@
<bean id="OIDCProviderMetadataCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}" />
+ c:keyFetchInterval="%{sp.oidc.provider.keyfetch.interval:PT30M}" />
<bean id="ClientSecretCriterionCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
</list>
@@ -338,7 +313,7 @@
<bean id="OIDCProviderMetadataCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
- c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+ c:keyFetchInterval="%{sp.oidc.provider.keyfetch.interval:PT30M}"/>
<bean id="CriterionCredentialResolver"
class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
</list>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list