[java-plugin-shibd-oidc] branch main updated: Directly add 'sub' to the set of IdPAttributes
Codeberg
noreply at shibboleth.net
Fri Nov 28 13:59:38 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/8443fecfd5b91bb7be5a870b7fe062ce8d31e276
The following commit(s) were added to refs/heads/main by this push:
new 8443fec Directly add 'sub' to the set of IdPAttributes
8443fec is described below
commit 8443fecfd5b91bb7be5a870b7fe062ce8d31e276
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Nov 28 13:59:26 2025 +0000
Directly add 'sub' to the set of IdPAttributes
- No transcoding etc.
---
.../sp/oidc/flows/OIDCTokenConsumerFlowTest.java | 15 ++++++++-------
.../net/shibboleth/idp/module/conf/attribute-filter.xml | 2 +-
.../net/shibboleth/idp/module/conf/attribute-resolver.xml | 2 +-
.../sp/oidc/profile/impl/ExtractOIDCClaims.java | 10 +++++++++-
4 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
index 6821e33..57e0f90 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
@@ -147,7 +147,6 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
*
* @throws IOException
*/
- @SuppressWarnings({ "unchecked", "rawtypes" })
@Test
public void testSuccess_SignedIDToken_PlainUserInfo() throws Exception {
@@ -170,7 +169,8 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
final DDF output = assertOutputMessageSuccess(result);
assert output != null;
System.out.println("testSuccess output: " + output.toString());
- validateOutputMessage(result, CollectionSupport.singleton("mail"), TestConstants.RESOURCE_URL);
+ validateOutputMessage(result, CollectionSupport.setOf("sub","mail","displayName","eduPersonScopedAffiliation"),
+ TestConstants.RESOURCE_URL);
}
/**
@@ -178,7 +178,6 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
*
* @throws IOException
*/
- @SuppressWarnings({ "unchecked", "rawtypes" })
@Test
public void testSuccess_SignedEncryptedIDToken_PlainUserInfo() throws Exception {
@@ -201,7 +200,8 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
final DDF output = assertOutputMessageSuccess(result);
assert output != null;
System.out.println("testSuccess output: " + output.toString());
- validateOutputMessage(result, CollectionSupport.setOf("mail","displayName","eduPersonScopedAffiliation"), TestConstants.RESOURCE_URL);
+ validateOutputMessage(result, CollectionSupport.setOf("sub","mail","displayName","eduPersonScopedAffiliation"),
+ TestConstants.RESOURCE_URL);
}
/**
@@ -230,7 +230,8 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
final DDF output = assertOutputMessageSuccess(result);
assert output != null;
System.out.println("testSuccess output: " + output.toString());
- validateOutputMessage(result, CollectionSupport.singleton("mail"), TestConstants.RESOURCE_URL);
+ validateOutputMessage(result, CollectionSupport.setOf("sub","mail","displayName","eduPersonScopedAffiliation"),
+ TestConstants.RESOURCE_URL);
}
/**
@@ -269,7 +270,7 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
@Nonnull final Instant expiry, @Nonnull final Instant issuedAt) throws JOSEException, ParseException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
- .subject("fake-user")
+ .subject("jdoe")
.issuer("https://op.example.org")
.audience("mock-client-id")
.expirationTime(Date.from(expiry))
@@ -296,7 +297,7 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
@Nonnull final Instant expiry, @Nonnull final Instant issuedAt) throws JOSEException, ParseException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
- .subject("fake-user")
+ .subject("jdoe")
.issuer("https://op.example.org")
.audience("mock-client-id")
.expirationTime(Date.from(expiry))
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml
index 815e656..1342d8c 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml
@@ -19,7 +19,7 @@
<!-- Release home org signifier to everybody. -->
<AttributeFilterPolicy id="alwaysRelease">
<PolicyRequirementRule xsi:type="Issuer" value="https://op.example.org" />
-
+ <AttributeRule attributeID="sub" permitAny="true" />
<AttributeRule attributeID="mail" permitAny="true" />
<AttributeRule attributeID="displayName" permitAny="true" />
<AttributeRule attributeID="eduPersonScopedAffiliation">
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml
index 74f6bba..a3dd5ec 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-resolver.xml
@@ -21,7 +21,7 @@ list of possible components and their options.
-<!-- <AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped" scope="%{idp.scope}">
+<!-- TODO think about PrincipalName lookup <AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped" scope="%{idp.scope}">
<InputAttributeDefinition ref="uid" />
</AttributeDefinition>
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ExtractOIDCClaims.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ExtractOIDCClaims.java
index 2d69040..ff33cab 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ExtractOIDCClaims.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ExtractOIDCClaims.java
@@ -40,6 +40,7 @@ import net.minidev.json.JSONObject;
import net.shibboleth.idp.attribute.AttributeDecodingException;
import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.IdPAttributeSupport;
+import net.shibboleth.idp.attribute.StringAttributeValue;
import net.shibboleth.idp.attribute.context.AttributeContext;
import net.shibboleth.idp.attribute.filter.AttributeFilter;
import net.shibboleth.idp.attribute.filter.AttributeFilterException;
@@ -61,6 +62,7 @@ import net.shibboleth.saml.profile.context.navigate.SAMLMetadataContextLookupFun
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.service.ServiceException;
@@ -323,7 +325,13 @@ public class ExtractOIDCClaims extends AbstractApplicationAction {
final Multimap<String,IdPAttribute> mapped = HashMultimap.create();
assert mapped != null;
- final String subject = unprocessedIdTokenClaims.getSubject();
+ // Add the subject string to its own 'sub' attribute
+ final String subject = unprocessedIdTokenClaims.getSubject();
+ if (subject != null) {
+ final IdPAttribute subjectAttribute = new IdPAttribute("sub");
+ subjectAttribute.setValues(CollectionSupport.listOf(new StringAttributeValue(subject)));
+ mapped.put(subjectAttribute.getId(), subjectAttribute);
+ }
try (final ServiceableComponent<AttributeTranscoderRegistry> component =
ensureApplication().getAttributeTranscoderRegistry().getServiceableComponent()) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list