[java-idp-plugin-oidc-op-oidfed] 02/02: Fix module plugin and module configuration
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Sep 11 05:36:54 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-op-oidfed.git;a=commit;h=1adbdc909a40f3cf85806a2d866d871ef9183be1
commit 1adbdc909a40f3cf85806a2d866d871ef9183be1
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Sep 11 08:34:47 2025 +0300
Fix module plugin and module configuration
- Fixed module dependency to idp.oidc.OP.7
- Delete wrong configuration folder which was included accidentally
- Include skeletons for trust anchor and entity configuration metadata configurations
---
.../src/main/assembly/assembly-tgz.xml | 2 +-
.../op/oidfed/conf/attributes/oidc-claim-rules.xml | 428 ---------------------
.../oidc/op/oidfed/conf/authn/oidc-credentials.xml | 68 ----
.../authn/oidc-rp-client-secret-credential.xml | 20 -
.../oidc/op/oidfed/conf/authn/oidc-rp-config.xml | 14 -
.../authn/oidc-rp-providermetadata-resolvers.xml | 34 --
.../oidc/op/oidfed/conf/authn/oidc-rp.properties | 82 ----
.../authn/providermetadata-resolver-system.xml | 87 -----
.../oidfed-entity-configuration-metadata.json | 7 +
.../oidfed/conf/oidfed/oidfed-trust-anchors.json | 1 +
.../idp/plugin/oidc/op/oidfed/module.properties | 8 +-
.../idp/plugin/oidc/op/oidfed/plugin.properties | 2 +-
12 files changed, 16 insertions(+), 737 deletions(-)
diff --git a/idp-oidfed-op-dist/src/main/assembly/assembly-tgz.xml b/idp-oidfed-op-dist/src/main/assembly/assembly-tgz.xml
index b9e0086..5551cdd 100644
--- a/idp-oidfed-op-dist/src/main/assembly/assembly-tgz.xml
+++ b/idp-oidfed-op-dist/src/main/assembly/assembly-tgz.xml
@@ -15,7 +15,7 @@
<!-- The plugin property file -->
<fileSet>
- <directory>../idp-oidfed-op-impl/target/classes/net/shibboleth/idp/plugin/oidfed/op/</directory>
+ <directory>../idp-oidfed-op-impl/target/classes/net/shibboleth/idp/plugin/oidc/op/oidfed/</directory>
<outputDirectory>bootstrap</outputDirectory>
<includes>
<include>plugin.properties</include>
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/attributes/oidc-claim-rules.xml b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/attributes/oidc-claim-rules.xml
deleted file mode 100644
index 9de853b..0000000
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/attributes/oidc-claim-rules.xml
+++ /dev/null
@@ -1,428 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!-- https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims -->
-
- <bean parent="shibboleth.TranscodingRuleLoader">
- <constructor-arg>
- <list>
-
- <!-- Typical inetOrgPerson attributes that map to standard claims. -->
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">displayName</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">name</prop>
- <prop key="displayName.en">Display name</prop>
- <prop key="displayName.de">Anzeigename</prop>
- <prop key="displayName.fr">Nom</prop>
- <prop key="displayName.it">Nome</prop>
- <prop key="displayName.ja">表示名</prop>
- <prop key="description.en">The name that should appear in white-pages-like applications for this person.</prop>
- <prop key="description.de">Anzeigename</prop>
- <prop key="description.fr">Nom complet d'affichage</prop>
- <prop key="description.it">Nome</prop>
- <prop key="description.ja">アプリケーションでの表示に用いられる英字氏名</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">givenName</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">given_name</prop>
- <prop key="displayName.en">Given name</prop>
- <prop key="displayName.de">Vorname</prop>
- <prop key="displayName.fr">Prénom</prop>
- <prop key="displayName.it">Nome</prop>
- <prop key="displayName.ja">名</prop>
- <prop key="description.en">Given name of a person</prop>
- <prop key="description.de">Vorname</prop>
- <prop key="description.fr">Prénom de l'utilisateur</prop>
- <prop key="description.it">Nome</prop>
- <prop key="description.ja">氏名(名)の英語表記</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">homePhone</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">phone_number</prop>
- <prop key="displayName.en">Private phone number</prop>
- <prop key="displayName.de">Telefon Privat</prop>
- <prop key="displayName.fr">Teléphone personnel</prop>
- <prop key="displayName.it">Numero di telefono privato</prop>
- <prop key="displayName.ja">自宅電話番号</prop>
- <prop key="description.en">Private phone number</prop>
- <prop key="description.de">Private Telefonnummer</prop>
- <prop key="description.fr">Numéro de téléphone de domicile de la personne</prop>
- <prop key="description.it">Numero di telefono privato</prop>
- <prop key="description.ja">自宅の電話番号</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">mail</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">email</prop>
- <prop key="displayName.en">E-mail</prop>
- <prop key="displayName.de">E-Mail</prop>
- <prop key="displayName.fr">Email</prop>
- <prop key="displayName.it">E-mail</prop>
- <prop key="displayName.ja">メールアドレス</prop>
- <prop key="description.en">E-Mail: Preferred address for e-mail to be sent to this person</prop>
- <prop key="description.de">E-Mail-Adresse</prop>
- <prop key="description.de-ch">E-Mail Adresse</prop>
- <prop key="description.fr">Adresse de courrier électronique</prop>
- <prop key="description.it">E-Mail: l'indirizzo e-mail preferito dall'utente</prop>
- <prop key="description.ja">メールアドレス</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">preferredLanguage</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">locale</prop>
- <prop key="displayName.en">Preferred Language</prop>
- <prop key="displayName.de">Bevorzugte Sprache</prop>
- <prop key="displayName.fr">Langue préférée</prop>
- <prop key="displayName.it">Lingua preferita</prop>
- <prop key="displayName.ja">希望言語</prop>
- <prop key="description.en">Preferred language: Users preferred language (see RFC1766)</prop>
- <prop key="description.de">Bevorzugte Sprache (siehe RFC1766)</prop>
- <prop key="description.fr">Exemple: fr, de, it, en, ... (voir RFC1766)</prop>
- <prop key="description.it">Lingua preferita: la lingua preferita dall'utente (cfr. RFC1766)</prop>
- <prop key="description.ja">利用者が希望する言語(RFC1766 を参照)</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">sn</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">family_name</prop>
- <prop key="displayName.en">Surname</prop>
- <prop key="displayName.de">Nachname</prop>
- <prop key="displayName.fr">Nom de famille</prop>
- <prop key="displayName.it">Cognome</prop>
- <prop key="displayName.ja">姓</prop>
- <prop key="description.en">Surname or family name</prop>
- <prop key="description.de">Familienname</prop>
- <prop key="description.fr">Nom de famille de l'utilisateur.</prop>
- <prop key="description.it">Cognome dell'utilizzatore</prop>
- <prop key="description.ja">氏名(姓)の英語表記</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">telephoneNumber</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">phone_number</prop>
- <prop key="displayName.en">Business phone number</prop>
- <prop key="displayName.de">Telefon Geschäft</prop>
- <prop key="displayName.fr">Teléphone professionnel</prop>
- <prop key="displayName.it">Numero di telefono dell'ufficio</prop>
- <prop key="displayName.ja">所属機関内電話番号</prop>
- <prop key="description.en">Business phone number: Office or campus phone number</prop>
- <prop key="description.de">Telefonnummer am Arbeitsplatz</prop>
- <prop key="description.fr">Teléphone de l'institut, de l'université</prop>
- <prop key="description.it">Numero di telefono dell'ufficio</prop>
- <prop key="description.ja">所属機関での利用者の電話番号</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">uid</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">preferred_username</prop>
- <prop key="displayName.en">User ID</prop>
- <prop key="displayName.de">Benutzer-ID</prop>
- <prop key="displayName.fr">ID utilisateur</prop>
- <prop key="displayName.it">ID dell'utente</prop>
- <prop key="displayName.ja">ユーザID</prop>
- <prop key="description.en">A unique identifier for a person, mainly used for user identification within the user's home organization.</prop>
- <prop key="description.de">Eine eindeutige Nummer für eine Person, welche hauptsächlich zur Identifikation innerhalb der Organisation benutzt wird.</prop>
- <prop key="description.fr">Identifiant de connexion d'une personnes sur les systèmes informatiques.</prop>
- <prop key="description.it">Identificativo unico della persona, usato per l'identificazione dell'utente all'interno della organizzazione di appartenenza.</prop>
- <prop key="description.ja">所属機関内で一意の利用者識別子</prop>
- </props>
- </property>
- </bean>
-
- <!-- eduPerson attributes that map to standard claims. -->
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonNickname</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">nickname</prop>
- <prop key="displayName.en">Nickname</prop>
- <prop key="displayName.de">Kurzname</prop>
- <prop key="displayName.de-ch">Übername</prop>
- <prop key="displayName.fr">Surnom</prop>
- <prop key="displayName.it">Diminutivo</prop>
- <prop key="displayName.ja">ニックネーム</prop>
- <prop key="description.en">Person's nickname, or the informal name by which they are accustomed to be hailed.</prop>
- <prop key="description.de">Kurzname einer Person, oder üblicher Rufname zur Begrüßung.</prop>
- <prop key="description.de-ch">Übername einer Person, oder üblicher Rufname zur Begrüssung.</prop>
- <prop key="description.fr">Nom personnalisable pour un usage informel.</prop>
- <prop key="description.it">Diminutivo della persona, o soprannome.</prop>
- <prop key="description.ja">利用者のニックネームもしくは通称</prop>
- </props>
- </property>
- </bean>
-
- <!-- A subset of the major eduPerson attributes that have no standard claim mapping. -->
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonAssurance</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">eduPersonAssurance</prop>
- <prop key="displayName.en">Assurance level</prop>
- <prop key="displayName.de">Vertrauensgrad</prop>
- <prop key="displayName.fr">Niveau de confiance</prop>
- <prop key="displayName.it">Livello di sicurezza</prop>
- <prop key="displayName.ja">保証レベル</prop>
- <prop key="description.en">Set of URIs that assert compliance with specific standards for identity assurance.</prop>
- <prop key="description.de">URIs die eine gewisse Zusicherung für spezifische Standards des Vertrauens beinhalten</prop>
- <prop key="description.fr">Un ensemble d'URI qui attestent la conformité selon un standard pour les niveaux d'assurance d'identités</prop>
- <prop key="description.it">Un insieme di URI che asseriscono l'osservanza dei livelli di sicurezza richiesti</prop>
- <prop key="description.ja">IDの保証レベルに関して特定の基準に準拠していることを示すURI</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonEntitlement</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">eduPersonEntitlement</prop>
- <prop key="displayName.en">Entitlement</prop>
- <prop key="displayName.de">Berechtigung</prop>
- <prop key="displayName.fr">Entitlement</prop>
- <prop key="displayName.it">Prerogativa</prop>
- <prop key="displayName.ja">資格情報</prop>
- <prop key="description.en">Member of: URI (either URL or URN) that indicates a set of rights to specific resources based on an agreement across the releavant community</prop>
- <prop key="description.de">Zeichenkette, die Rechte für spezifische Ressourcen beschreibt</prop>
- <prop key="description.fr">Membre de: URI (soit une URL ou une URN) décrivant un droit spécific d'accès.</prop>
- <prop key="description.it">Membro delle seguenti URI (sia URL o URN) che rappresentano diritti specifici d'accesso validi in tutta la communità</prop>
- <prop key="description.ja">特定のアプリケーションもしくはコミュニティ内の複数リソースへのアクセス権限を持つことを示すURI(URLもしくはURN)</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonPrincipalName</prop>
- <prop key="transcoder">OIDCScopedStringTranscoder</prop>
- <prop key="oidc.name">eduPersonPrincipalName</prop>
- <prop key="displayName.en">Principal name</prop>
- <prop key="displayName.de">Persönliche ID</prop>
- <prop key="displayName.fr">Principal Name</prop>
- <prop key="displayName.it">Principal Name</prop>
- <prop key="displayName.ja">プリンシパルID</prop>
- <prop key="description.en">A unique identifier for a person, mainly for inter-institutional user identification.</prop>
- <prop key="description.de">Eindeutige Benutzeridentifikation</prop>
- <prop key="description.de-ch">Eindeutige Benützeridentifikation</prop>
- <prop key="description.fr">L'identifiant unique de l'utilisateur</prop>
- <prop key="description.it">Un ID personale che identifica chiaramente l'utente in seno alla sua organizzazione</prop>
- <prop key="description.ja">フェデレーション内で一意かつ永続的な利用者識別子</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">eduPersonScopedAffiliation</prop>
- <prop key="transcoder">OIDCScopedStringTranscoder</prop>
- <prop key="oidc.name">eduPersonScopedAffiliation</prop>
- <prop key="displayName.en">Scoped affiliation</prop>
- <prop key="displayName.de">Zugehörigkeit</prop>
- <prop key="displayName.fr">Affiliation</prop>
- <prop key="displayName.it">Tipo di membro</prop>
- <prop key="displayName.ja">スコープ付き職位</prop>
- <prop key="description.en">Specifies the person's affiliation within a particular security domain</prop>
- <prop key="description.de">Art der Zugehörigkeit zur Heimatorganisation</prop>
- <prop key="description.de-ch">Art der Zugehörigkeit zur Heimorganisation</prop>
- <prop key="description.fr">Type d'affiliation dans l'organisation</prop>
- <prop key="description.it">Tipo di membro: Tipo di lavoro svolto per l'organizzazione</prop>
- <prop key="description.ja">セキュリティドメインのスコープが付いた所属機関における職位</prop>
- </props>
- </property>
- </bean>
-
- <!-- The remainder are standard OIDC claims, which we map based on the actual claim name. -->
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">address</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.asObject">true</prop>
- <prop key="oidc.name">address</prop>
- <prop key="displayName.en">Postal address</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">birthdate</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">birthdate</prop>
- <prop key="displayName.en">Date of birth</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">email_verified</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">email_verified</prop>
- <prop key="oidc.asBoolean">true</prop>
- <prop key="displayName.en">E-mail verification status</prop>
- <prop key="description.en">Indicates whether e-mail address has been verified by the issuer</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">gender</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">gender</prop>
- <prop key="displayName.en">Gender</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">middle_name</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">middle_name</prop>
- <prop key="displayName.en">Middle name</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">phone_number_verified</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">phone_number_verified</prop>
- <prop key="oidc.asBoolean">true</prop>
- <prop key="displayName.en">Phone number verification status</prop>
- <prop key="description.en">Indicates whether phone number has been verified by the issuer</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">picture</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">picture</prop>
- <prop key="displayName.en">Picture</prop>
- <prop key="description.en">URL of personal photo</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">profile</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">profile</prop>
- <prop key="displayName.en">Profile page</prop>
- <prop key="description.en">URL of personal profile page</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">website</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">website</prop>
- <prop key="displayName.en">Web site</prop>
- <prop key="description.en">URL to personal web site</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">updated_at</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">updated_at</prop>
- <prop key="oidc.asInteger">true</prop>
- <prop key="displayName.en">Last update of information</prop>
- </props>
- </property>
- </bean>
-
- <bean parent="shibboleth.TranscodingProperties">
- <property name="properties">
- <props merge="true">
- <prop key="id">zoneinfo</prop>
- <prop key="transcoder">OIDCStringTranscoder</prop>
- <prop key="oidc.name">zoneinfo</prop>
- <prop key="displayName.en">Time zone</prop>
- </props>
- </property>
- </bean>
-
- </list>
- </constructor-arg>
- </bean>
-
-</beans>
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-credentials.xml b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-credentials.xml
deleted file mode 100644
index a8e186b..0000000
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-credentials.xml
+++ /dev/null
@@ -1,68 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- This file contains default OIDC signing credentials. This file should be imported into credentials.xml.
- -->
-
- <bean id="shibboleth.oidc.DefaultRSSigningCredential" parent="shibboleth.oidc.JWKCredential"
- p:resource="%{idp.signing.oidc.rs.key:#{null}}" p:failIfResourceIsNull="false" />
-
- <bean id="shibboleth.oidc.DefaultESSigningCredential" parent="shibboleth.oidc.JWKCredential"
- p:resource="%{idp.signing.oidc.es.key:#{null}}" p:failIfResourceIsNull="false" />
-
- <bean id="shibboleth.oidc.DefaultRSAEncryptionCredential" parent="shibboleth.oidc.JWKCredential"
- p:resource="%{idp.signing.oidc.rsa.enc.key:#{null}}" p:failIfResourceIsNull="false" />
-
- <!--
- Lists ALL of your OP's response signing credentials for the default security configuration.
- If you define additional signing credentials make sure to include them within this list.
- -->
- <util:list id="shibboleth.oidc.SigningCredentials">
- <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
- <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
- </util:list>
-
- <!--
- Lists ALL of your OP's request decryption credentials for the default security configuration.
- If you define additional decryption credentials make sure to include them within this list.
- -->
- <util:list id="shibboleth.oidc.EncryptionCredentials">
- <ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
- </util:list>
-
- <!--
- If you need to publish a key set different from shibboleth.oidc.EncryptionCredentials, define
- a list bean named "shibboleth.oidc.EncryptionCredentialsToPublish".
- -->
-
- <!-- Example of two active encryption credentials, but only publishing the second before removing from use. -->
- <!--
- <util:list id="shibboleth.oidc.EncryptionCredentialsToPublish">
- <ref bean="shibboleth.oidc.OnlyNewDefaultRSAEncryptionCredential" />
- </util:list>
- -->
-
- <!--
- If you need to publish a key set different from shibboleth.oidc.SigningCredentials, define
- a list bean named "shibboleth.oidc.SigningCredentialsToPublish".
- -->
-
- <!-- Example of publishing two signing credentials, before active use. -->
- <!--
- <util:list id="shibboleth.oidc.SigningCredentialsToPublish">
- <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
- <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
- <ref bean="shibboleth.oidc.UpcomingDefaultRSSigningCredential" />
- </util:list>
- -->
-
-</beans>
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp-client-secret-credential.xml b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp-client-secret-credential.xml
deleted file mode 100644
index 51558fd..0000000
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp-client-secret-credential.xml
+++ /dev/null
@@ -1,20 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- This file contains the default credential based on the client_secret, which will be the only used credential in
- most cases for the RP-Proxy. This file should be imported into credentials.xml.
- -->
-
- <bean id="shibboleth.authn.oidc.rp.DefaultCredential" parent="shibboleth.oidc.ClientSecretCredential"
- p:secret="%{idp.authn.oidc.rp.client.clientSecret:#{null}}"/>
-
-</beans>
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp-config.xml b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp-config.xml
deleted file mode 100644
index 6608675..0000000
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp-config.xml
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy" default-lazy-init="true">
-
-
-
-</beans>
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp-providermetadata-resolvers.xml b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp-providermetadata-resolvers.xml
deleted file mode 100644
index 7d10e4f..0000000
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp-providermetadata-resolvers.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <!--
- The default metadata provider fetches OpenID Provider configuration metadata from the issuers well-known
- location.
- -->
- <util:list id="shibboleth.authn.oidc.rp.ProviderMetadataResolvers">
- <ref bean="ProviderHTTPResolver" />
- </util:list>
-
- <bean id="ProviderHTTPResolver" parent="shibboleth.authn.oidc.rp.OIDCProviderMetadataResolver">
- <constructor-arg>
- <bean parent="shibboleth.authn.oidc.rp.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="ProviderHTTPDynamicResolver"
- parent="shibboleth.authn.oidc.rp.BaseProviderDynamicCacheBuilderSpec"
- p:minCacheDuration="PT30M"
- p:maxCacheDuration="PT8H"
- p:cleanupTaskInterval="PT30M"/>
- </constructor-arg>
- </bean>
- </constructor-arg>
- </bean>
-
-</beans>
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp.properties
deleted file mode 100644
index d3dae91..0000000
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/oidc-rp.properties
+++ /dev/null
@@ -1,82 +0,0 @@
-idp.authn.oidc.rp.provider.proxyIssuer=https://issuer.com
-## If discovery is required, these default properties will not be set, you must manage per OP using overrides
-idp.authn.oidc.rp.client.clientId = client_id
-idp.authn.oidc.rp.client.clientSecret= client_secret
-idp.authn.oidc.rp.client.redirecturl.allowedOrigins = https://localhost:8443
-
-## If true and the token was retrieved using TLS with server validation, JWS signature checking will be skipped.
-#idp.authn.oidc.rp.client.idtoken.tlsServerValidationOnly = false
-
-## Should a further lookup to the UserInfo endpoint be made, to retrieve additional claims about the end-user
-#idp.authn.oidc.rp.client.userinfo.enabled = true
-#idp.authn.oidc.rp.client.userinfo.httpRequestMethod = GET
-
-## The HTTP method use to send the authorization request
-#idp.authn.oidc.rp.httpRequestMethod = GET
-## Override the default response_mode for the given response_type
-#idp.authn.oidc.rp.client.responseMode = query
-## Client authentication method.
-#idp.authn.oidc.rp.client.authenticationMethod = client_secret_basic
-#idp.authn.oidc.rp.client.authenticationMethod.jwt.expiryOffset = PT30S
-## Comma seperated list of additional scopes e.g. profile or email. The openid scope is added by default
-#idp.authn.oidc.rp.client.scopes =
-
-#idp.authn.oidc.rp.addDefaultPrincipals = false
-#idp.authn.oidc.rp.supportedPrincipals = \
-# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
-# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
-# saml1/urn:oasis:names:tc:SAML:1.0:am:password
-
-## IDToken JWT verification properties
-#idp.authn.oidc.rp.client.idtoken.jwt.verifier.clockSkew = PT60S
-#idp.authn.oidc.rp.client.idtoken.jwt.verifier.authnLifetime = PT60S
-## General JWT verification properties
-#idp.authn.oidc.rp.client.jwt.verifier.clockSkew = PT1M
-
-## Should validation be skipped if the at_hash is not present in the id_token response. Defaults to 'true' as
-## access token at_hash validation is optional in the Authorization Code Flow.
-#idp.authn.oidc.rp.client.tokenresponse.allowMissingAtHash = true
-
-## External controller path. Should not need changing.
-#idp.authn.oidc.rp.externalAuthnPath = /Authn/OIDC/RP
-
-## Bean ID of list of subject c14n flow beans used
-#idp.authn.oidc.rp.c14n.postLoginFlows = shibboleth.authn.oidc.rp.c14n.PostLoginSubjectCanonicalizationFlows
-
-## Inbuilt C14N options for converting a Subject Identifier into a principal name
-idp.authn.oidc.rp.c14n.subjectidentifier.lowercase = false
-idp.authn.oidc.rp.c14n.subjectidentifier.uppercase = false
-idp.authn.oidc.rp.c14n.subjectidentifier.trim = true
-idp.authn.oidc.rp.c14n.subjectidentifier.disabled = false
-
-## Properties to control discovery. Note, there is currently no default discovery implementation
-#idp.authn.oidc.rp.provider.discoveryRequired=false
-#idp.authn.oidc.rp.discoveryURL=http://opdisco.com
-
-### Properties below are common to both RP and OP (if installed).
-
-## The OP's keyset document fetch interval i.e. how long should keys from the OP be cached.
-#idp.oidc.provider.keyfetch.interval = PT30M
-
-## Enable PKCE for the authorization code flow
-#idp.oidc.forcePKCE = false
-#idp.oidc.allowPKCEPlain = false
-
-## Whether to use a request object to send authentication parameters, and if it should be encrypted and or signed.
-#idp.oidc.requestobject.used= false
-#idp.oidc.requestobject.encrypted = false
-#idp.oidc.requestobject.signed = true
-
-## Signing and encryption/decryption keys for request objects, id tokens, and userinfo response
-#idp.signing.oidc.rs.key = %{idp.home}/credentials/idp-signing-rs.jwk
-#idp.signing.oidc.es.key = %{idp.home}/credentials/idp-signing-es.jwk
-#idp.signing.oidc.rsa.enc.key = %{idp.home}/credentials/idp-encryption-rsa.jwk
-
-## Properties to control the authentication flow
-#idp.authn.oidc.rp.order = 1000
-#idp.authn.oidc.rp.nonBrowserSupported = false
-#idp.authn.oidc.rp.passiveAuthenticationSupported = true
-#idp.authn.oidc.rp.forcedAuthenticationSupported = true
-
-
-
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/providermetadata-resolver-system.xml b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/providermetadata-resolver-system.xml
deleted file mode 100644
index 96e7c81..0000000
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/authn/providermetadata-resolver-system.xml
+++ /dev/null
@@ -1,87 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy" default-lazy-init="true">
-
- <!-- Loaded by the postconfig.xml file as global beans -->
-
- <bean id="shibboleth.authn.oidc.rp.ProviderMetadataProvider" lazy-init="false"
- class="net.shibboleth.oidc.metadata.ProviderMetadataProviderContainer"
- p:embeddedResolver-ref="shibboleth.authn.oidc.rp.ChainingProviderMetadataResolver">
- </bean>
-
- <bean id="shibboleth.authn.oidc.rp.ChainingProviderMetadataResolver"
- class="net.shibboleth.oidc.metadata.impl.ChainingProviderMetadataResolver" p:id="InternalEmbeddedChainResolver"
- p:resolvers="#{getObject('shibboleth.authn.oidc.rp.ProviderMetadataResolvers')}" />
-
- <!-- abstract beans for the user space config to extend -->
- <bean id="shibboleth.authn.oidc.rp.OIDCProviderMetadataResolver" abstract="true"
- class="net.shibboleth.oidc.metadata.impl.OIDCProviderMetadataResolver" />
-
- <bean id="shibboleth.authn.oidc.rp.DefaultHTTPProviderConfigurationMetadataFetchingStrategy"
- class="net.shibboleth.oidc.metadata.impl.HTTPProviderConfigurationFetchingStrategy"
- c:client-ref="shibboleth.InternalHttpClient"
- c:handler-ref="shibboleth.authn.oidc.rp.DefaultHTTProviderConfigurationMetadataResponseHandler"
- p:wellKnownLocationCompositionStrategy="#{getObject('shibboleth.authn.oidc.rp.WellKnownLocationCompositionStrategy')}"/>
-
-
- <bean id="shibboleth.authn.oidc.rp.DefaultHTTProviderConfigurationMetadataResponseHandler"
- class="net.shibboleth.oidc.metadata.impl.HTTPProviderConfigurationFetchingStrategy.OIDCProviderMetadataResponseHandler" />
-
- <!-- Cache builder specifications -->
- <bean id="cacheFactory" class="net.shibboleth.oidc.metadata.cache.impl.MetadataCacheBuilder$Builder"/>
-
- <bean id="shibboleth.authn.oidc.rp.CacheBuilder" factory-bean="cacheFactory" factory-method="build"
- abstract="true"/>
-
-
- <bean class="net.shibboleth.oidc.metadata.cache.impl.BatchMetadataCacheBuilderSpec"
- id="shibboleth.authn.oidc.rp.BaseProviderBatchCacheBuilderSpec" abstract="true"
- p:parsingStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataParsingStrategy"
- p:criteriaToIdentifierStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy"
- p:sourceMetadataExpiryStrategy-ref="shibboleth.authn.oidc.rp.DefaultODICProviderSourceMetadataExpirationTimeStrategy"
- p:identifierExtractionStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataIdentifierExtractionStrategy"/>
-
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- id="shibboleth.authn.oidc.rp.BaseProviderDynamicCacheBuilderSpec" abstract="true"
- p:fetchStrategy-ref="shibboleth.authn.oidc.rp.DefaultHTTPProviderConfigurationMetadataFetchingStrategy"
- p:criteriaToIdentifierStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy"
- p:metadataExpirationTimeStrategy-ref="shibboleth.authn.oidc.rp.DefaultODICProviderMetadataExpirationTimeStrategy"
- p:identifierExtractionStrategy-ref="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataIdentifierExtractionStrategy"
- />
-
-
- <!-- Common parents for cache strategy implementations -->
-
- <bean id="shibboleth.authn.oidc.rp.ProviderConfigurationMetadataFileLoadingStrategy"
- class="net.shibboleth.oidc.metadata.cache.impl.DefaultFileLoadingStrategy" abstract="true"/>
-
- <!-- Common implementation strategies for cache implementations -->
-
- <bean id="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataParsingStrategy" scope="prototype"
- class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataParsingStrategy" />
-
- <bean id="shibboleth.authn.oidc.rp.DefaultMapParsingStrategy" scope="prototype"
- class="net.shibboleth.oidc.metadata.cache.impl.DefaultJSONMapParsingStrategy" />
-
- <bean id="shibboleth.authn.oidc.rp.DefaultODICProviderMetadataExpirationTimeStrategy" scope="prototype"
- class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataExpirationTimeStrategy"/>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultODICProviderSourceMetadataExpirationTimeStrategy" scope="prototype"
- class="net.shibboleth.oidc.metadata.cache.impl.DefaultSourceMetadataExpirationTimeStrategy"
- c:duration="PT10M" />
-
- <bean id="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataIdentifierExtractionStrategy" scope="prototype"
- class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataIdentifierExtractionStrategy" />
-
- <bean id="shibboleth.authn.oidc.rp.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy" scope="prototype"
- class="net.shibboleth.oidc.metadata.cache.impl.DefaultOIDCProviderMetadataCriteriaToIdentifierStrategy" />
-
-
-</beans>
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-entity-configuration-metadata.json b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-entity-configuration-metadata.json
new file mode 100644
index 0000000..f412263
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-entity-configuration-metadata.json
@@ -0,0 +1,7 @@
+{
+ "federation_entity": {
+ "organization_name" : "Example organization",
+ "organization_uri" : "https://org.example.org",
+ "contacts" : [ "contact at example.org" ]
+ }
+}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-trust-anchors.json b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-trust-anchors.json
new file mode 100644
index 0000000..9e26dfe
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-trust-anchors.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/module.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/module.properties
index bafb5e0..c81d1ee 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/module.properties
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/module.properties
@@ -8,6 +8,10 @@ idp.oidc.OP.oidfed.name = OpenID Federation plugin for OP
idp.oidc.OP.oidfed.desc = OpenID Federation support for OP
idp.oidc.OP.oidfed.url = /OIDFED
-idp.oidc.OP.oidfed.1.src = /net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
-idp.oidc.OP.oidfed.1.dest = conf/authn/oidc-rp.properties
+idp.oidc.OP.oidfed.1.src = /net/shibboleth/idp/plugin/oidfed/conf/oidfed/oidfed-trust-anchors.json
+idp.oidc.OP.oidfed.1.dest = conf/oidfed/oidfed-trust-anchors.json
idp.oidc.OP.oidfed.1.replace = false
+
+idp.oidc.OP.oidfed.2.src = /net/shibboleth/idp/plugin/oidfed/conf/oidfed/oidfed-entity-configuration-metadata.json
+idp.oidc.OP.oidfed.2.dest = conf/oidfed/oidfed-entity-configuration-metadata.json
+idp.oidc.OP.oidfed.2.replace = false
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/plugin.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/plugin.properties
index 4d9c6a4..0ea88d7 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/plugin.properties
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/plugin.properties
@@ -3,4 +3,4 @@ plugin.id = net.shibboleth.idp.plugin.oidc.op.oidfed
plugin.version = 1.0.0
#plugin.license = licence.txt
-plugin.modules.required = idp.oidc.OP.6
+plugin.modules.required = idp.oidc.OP.7
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list