[java-idp-plugin-oidc-op-oidfed] 01/02: Use 'trust_mark_type' instead of 'trust_mark_id'.
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Oct 9 10:36:42 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-op-oidfed.git;a=commit;h=5cd06c186ea48770572f320bd529580fa674148e
commit 5cd06c186ea48770572f320bd529580fa674148e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Oct 9 09:53:47 2025 +0300
Use 'trust_mark_type' instead of 'trust_mark_id'.
The spec draft #43 renamed the claim.
---
.../metadata/DefaultTrustChainTrustMarksParsingStrategy.java | 10 +++++-----
.../op/oidfed/profile/impl/BuildResolveEntityResponse.java | 2 +-
.../oidc/op/oidfed/profile/impl/CallResolveEntityApi.java | 2 +-
.../plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java | 2 +-
.../main/resources/META-INF/net.shibboleth.idp/postconfig.xml | 2 +-
.../idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java | 2 +-
6 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustMarksParsingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustMarksParsingStrategy.java
index 5ee6654..5f98e06 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustMarksParsingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/DefaultTrustChainTrustMarksParsingStrategy.java
@@ -68,7 +68,7 @@ public class DefaultTrustChainTrustMarksParsingStrategy
.stream()
.filter(Map.class::isInstance)
.map(Map.class::cast)
- .map(map -> parseTrustMark(map.get("trust_mark"), map.get("trust_mark_id")))
+ .map(map -> parseTrustMark(map.get("trust_mark"), map.get("trust_mark_type")))
.filter(Objects::nonNull)
.toList();
result.put(statement.getEntityID().getValue(), trustMarks);
@@ -93,14 +93,14 @@ public class DefaultTrustChainTrustMarksParsingStrategy
final SignedJWT jwt = SignedJWT.parse((String) trustMark);
final JWTClaimsSet trustMarkClaims = jwt.getJWTClaimsSet();
if (StringSupport.trimOrNull(trustMarkClaims.getIssuer()) == null) {
- log.error("Trust Mark {} is missing mandatory issuer", trustMarkClaims.getStringClaim("trust_mark_id"));
+ log.error("Trust Mark {} is missing mandatory issuer", trustMarkClaims.getStringClaim("trust_mark_type"));
return null;
}
- if (id.equals(trustMarkClaims.getStringClaim("trust_mark_id"))) {
+ if (id.equals(trustMarkClaims.getStringClaim("trust_mark_type"))) {
return jwt;
}
- log.error("The id {} is not matching with the trust_mark_id-claim {}", id,
- trustMarkClaims.getStringClaim("trust_mark_id"));
+ log.error("The id {} is not matching with the trust_mark_type-claim {}", id,
+ trustMarkClaims.getStringClaim("trust_mark_type"));
} catch (final ParseException e) {
log.error("Could not parse id-claim from the trust mark", e);
}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
index a17184a..a3d4aa3 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
@@ -200,7 +200,7 @@ public class BuildResolveEntityResponse extends AbstractBuildEntityStatementActi
*/
@Nullable private String getTrustMarkId(@Nullable final SignedJWT trustMark) {
try {
- return trustMark == null ? null : trustMark.getJWTClaimsSet().getStringClaim("trust_mark_id");
+ return trustMark == null ? null : trustMark.getJWTClaimsSet().getStringClaim("trust_mark_type");
} catch (final ParseException e) {
log.error("{} Could not parse the TrustMark JWT contents", getLogPrefix(), e);
}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
index 132fe9a..9533db0 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
@@ -441,7 +441,7 @@ public class CallResolveEntityApi extends AbstractProfileAction {
.collect(Collectors.toMap(entry -> entry.getKey(), entry -> entry.getValue().stream()
.map(jwt -> {
try {
- return jwt.getJWTClaimsSet().getStringClaim("trust_mark_id");
+ return jwt.getJWTClaimsSet().getStringClaim("trust_mark_type");
} catch (final ParseException e1) {
return null;
}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java
index 5f2da39..5c7500a 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java
@@ -544,7 +544,7 @@ public class ResolveTrustMarks extends AbstractProfileAction {
*/
@Nullable private String getTrustMarkId(@Nullable final SignedJWT trustMark) {
try {
- return trustMark == null ? null : trustMark.getJWTClaimsSet().getStringClaim("trust_mark_id");
+ return trustMark == null ? null : trustMark.getJWTClaimsSet().getStringClaim("trust_mark_type");
} catch (final ParseException e) {
log.error("{} Could not parse the TrustMark JWT contents", getLogPrefix(), e);
}
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index cb15816..7291558 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -415,7 +415,7 @@
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
p:requiredClaims="sub" />
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="trust_mark_id" />
+ p:requiredClaims="trust_mark_type" />
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
</util:list>
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java
index a76a63e..2c3dddc 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java
@@ -95,7 +95,7 @@ public class TrustChainTestUtil {
final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder()
.subject(sub)
.issuer(iss)
- .claim("id", id)
+ .claim("trust_mark_type", id)
.issueTime(new Date())
.expirationTime(exp == null ? null : Date.from(exp));
return signedJwt(algorithm, jwk, "trust-mark+jwt", builder.build());
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list