[java-plugin-shibd-oidc] branch main updated: Updates to synchronise the plugin with upstream SP changes
Phil Smart
philip.smart at jisc.ac.uk
Fri Sep 12 15:09:05 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-oidc.git;a=commit;h=246112fabf6bb7867fd449ce01a310f1aa44e231
The following commit(s) were added to refs/heads/main by this push:
new 246112f Updates to synchronise the plugin with upstream SP changes
246112f is described below
commit 246112fabf6bb7867fd449ce01a310f1aa44e231
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Sep 12 16:09:02 2025 +0100
Updates to synchronise the plugin with upstream SP changes
---
sp-oidc-api/pom.xml | 6 ++
.../idp/flows/sp/initiator/oidc/oidc-beans.xml | 19 +++-
.../sp/oidc/flows/OIDCAuthenticationFlowTest.java | 6 +-
...DCEnvironmentApplicationContextInitializer.java | 3 +-
.../net/shibboleth/idp/module/conf/sp/agents.xml | 50 ++++------
.../idp/module/conf/sp/oidc-test-agents.xml | 74 ++++-----------
.../shibboleth/idp/module/conf/sp/sp.properties | 37 ++++++--
.../impl/DefaultRedirectUriCreationFunction.java | 102 +--------------------
8 files changed, 92 insertions(+), 205 deletions(-)
diff --git a/sp-oidc-api/pom.xml b/sp-oidc-api/pom.xml
index 3a0d4d8..af71cd6 100644
--- a/sp-oidc-api/pom.xml
+++ b/sp-oidc-api/pom.xml
@@ -27,6 +27,12 @@
<groupId>${shibd.groupId}</groupId>
<artifactId>sp-server-api</artifactId>
<scope>provided</scope>
+ </dependency>
+
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-authn-api</artifactId>
+ <scope>provided</scope>
</dependency>
<dependency>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml
index 60891e9..84b3c6d 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/oidc/oidc-beans.xml
@@ -9,12 +9,21 @@
<!-- Some of these are common beans -->
+
+ <!--
+ SP-sided WebFlowInboundMessageHandlerAdaptor that populates thread-local remoted servlet request/resoonse objects.
+ Allowing injection of RemotedHttpServletRequest/Response Suppliers.
+ -->
<bean id="WebFlowInboundMessageHandlerAdaptor"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype" abstract="true"
+ class="net.shibboleth.sp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype" abstract="true"
c:executionDirection="INBOUND" />
+ <!--
+ SP-sided WebFlowOutboundMessageHandlerAdaptor that populates thread-local remoted servlet request/resoonse objects.
+ Allowing injection of RemotedHttpServletRequest/Response Suppliers.
+ -->
<bean id="WebFlowOutboundMessageHandlerAdaptor"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype" abstract="true"
+ class="net.shibboleth.sp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype" abstract="true"
c:executionDirection="OUTBOUND" />
<util:constant id="shiibboleth.sp.oidc.ProfileId"
@@ -96,12 +105,12 @@
class="net.shibboleth.sp.oidc.messaging.impl.AddRequestedClaimsHandler"
p:requestedClaimsHook="#{getObject('shibboleth.authn.oidc.rp.RequestedClaimsHook')}" />
<bean id="AddPCKECodeVerifierAndChallenge" scope="prototype"
- class="net.shibboleth.sp.oidc.messaging.impl.AddPCKECodeVerifierAndChallenge"/>
+ class="net.shibboleth.sp.oidc.messaging.impl.AddPCKECodeVerifierAndChallenge"/>
<bean id="AddRedirectURI" scope="prototype"
class="net.shibboleth.sp.oidc.messaging.impl.AddRedirectURIHandler"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
+ p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
p:redirectUriCreationStrategy="#{getObject('shibboleth.authn.oidc.rp.RedirectUriCreationStrategy') ?:
- getObject('DefaultRedirectUriCreationStrategy')}" />
+ getObject('DefaultRedirectUriCreationStrategy')}" />
<bean id="AddAuthenticationContextClassReferences" scope="prototype"
class="net.shibboleth.sp.oidc.messaging.impl.AddAuthenticationContextClassReferencesHandler"/>
<bean id="AddForceAuthentication" scope="prototype"
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCAuthenticationFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCAuthenticationFlowTest.java
index 6b69dc0..cb77560 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCAuthenticationFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCAuthenticationFlowTest.java
@@ -83,10 +83,10 @@ public class OIDCAuthenticationFlowTest extends AbstractSPFlowTest {
setDefaultAuth();
final DDF input = new DDF(null).structure();
- input.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
+ input.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(SPConstants.TARGET).unsafe_string(RESOURCE_URL);
- setApplicationRequest(APPLICATION_ID, input);
+ input.addmember(SPConstants.TARGET).unsafe_string(RESOURCE_URL);
+ setApplicationRequest("test-oidc-application", input);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertFlowExecutionResult(result, FLOW_ID);
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java
index 0c5c9fc..c539d66 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/TestSPOIDCEnvironmentApplicationContextInitializer.java
@@ -44,7 +44,8 @@ public class TestSPOIDCEnvironmentApplicationContextInitializer
mock.setProperty("idp.home", "classpath:/net/shibboleth/idp/module");
mock.setProperty("idp.webflows", "classpath*:/flows");
mock.setProperty("sp.service.agents.resources", "test.sp.oidc.AgentResolverResources");
- mock.setProperty("sp.stateToken.Manager","shibboleth.CookieStateTokenManager");
+ mock.setProperty("sp.stateToken.Manager","shibboleth.sp.CookieStateTokenManager");
+ mock.setProperty("sp.agent.authn.method", "basic");
//mock.setProperty("idp.service.logging.resource", "/logback-webauthn-flow-test.xml");
mock.setProperty("idp.additionalProperties",
"/conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/admin/admin.properties, /conf/authn/authn.properties, /conf/c14n/subject-c14n.properties, /credentials/secrets.properties, /conf/sp/sp.properties, /conf/sp/oidc.properties, /conf/sp/oidc-test.properties");
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index a2a46f2..5ea1f24 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -29,56 +29,42 @@
<!-- ============ Agents and their Applications ============ -->
- <bean id="sp.example.org" parent="shibboleth.Agent" p:sharedSecrets="foo">
- <property name="applications">
- <set>
- <bean p:id="default" parent="shibboleth.Application"
- p:issuer="https://sp.example.org"
- p:authenticatingAuthority="urn:mace:incommon:osu.edu" />
- </set>
- </property>
- </bean>
+ <bean p:id="localhost" parent="shibboleth.sp.Agent" p:sharedSecrets="foo" />
<!-- ============ Profile defaults ============ -->
<!-- Used for all applications by default to provide a baseline for profile settings. -->
- <util:list id="shibboleth.DefaultProfileConfigurations">
+ <util:list id="shibboleth.sp.DefaultProfileConfigurations">
<!-- Your profiles here. -->
- <!-- <bean parent="OIDC.SSO" p:checkAddress="false" p:checkInResponseTo="false" /> -->
- <bean parent="OIDC.SSO"/>
+ <bean parent="OIDC.SSO" />
</util:list>
- <!-- ============ RelyingParty defaults ============ -->
-
- <!--
- These beans are wired into *all* applications across all agents by default. You can create
- customized alternatives in whatever combination you require to plug into specific application
- beans.
- -->
-
<!--
Unverified RP configuration, defaults to no support for any profiles.
- "Unverified" typically means the SP has no metadata, or equivalent way of assuring the identity and
- legitimacy of an IdP system. To run an "open" SP, you can enable profiles here.
+ "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the identity and
+ legitimacy of an authenticating system. Some profiles may simply be designed to operate this way.
-->
- <bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
- <property name="profileConfigurations">
- <list>
- <!-- Your profiles here. -->
- </list>
- </property>
- </bean>
-
- <!-- Container for any overrides you want to add, again used for all applications by default. -->
+ <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
+ <!-- Your profiles here. -->
+ </util:list>
- <util:list id="shibboleth.RelyingPartyOverrides">
+ <!-- ============ RelyingParty Overrides ============ -->
+ <!--
+ These overrides are wired into *all* Applications across all Agents by default. You can create
+ customized alternatives in whatever combination you require to plug into specific Application
+ beans.
+ -->
+
+ <util:list id="shibboleth.sp.RelyingPartyOverrides">
+ <!-- Your RelyingParty overrides here. -->
</util:list>
+
<import resource="oidc-credentials.xml" />
</beans>
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
index e0d1b85..cbbd2dd 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
@@ -18,45 +18,13 @@
<import resource="oidc-credentials.xml" />
- <bean id="testsp.example.org" parent="shibboleth.Agent" p:sharedSecrets="foo">
+ <bean id="testsp.example.org" parent="shibboleth.sp.Agent" p:sharedSecrets="foo"
+ p:issuer="https://testsp.example.org">
<property name="applications">
<set>
- <bean p:id="default" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://op.example.org"
+ <bean p:id="test-oidc-application" parent="shibboleth.sp.Application"
p:profileConfigurations-ref="test.ProfileConfigurations"
p:metadataResolver-ref="shibboleth.ProviderMetadataResolverService"/>
-
-<!-- <bean p:id="feature-blocking" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://idp.example.org"
- p:profileConfigurations-ref="test.featureBlockingProfileConfigurations" />
-
- <bean p:id="response-binding" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://idp.example.org"
- p:profileConfigurations-ref="test.responseBindingProfileConfigurations" />
-
- <bean p:id="no-metadata" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://unknown.example.org"
- p:profileConfigurations-ref="test.ProfileConfigurations" />
-
- <bean p:id="no-profile" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://idp.example.org"
- p:profileConfigurations-ref="test.NoProfileConfigurations" />
-
- <bean p:id="no-endpoint" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://noendpoint.example.org"
- p:profileConfigurations-ref="test.ProfileConfigurations" />
-
- <bean p:id="no-initiators" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://idp.example.org"
- p:profileConfigurations-ref="test.ProfileConfigurations"
- p:sessionInitiators="#{{}}" /> -->
</set>
</property>
</bean>
@@ -111,38 +79,32 @@
<!-- Used for all applications by default to provide a baseline for profile settings. -->
- <util:list id="shibboleth.DefaultProfileConfigurations">
+ <util:list id="shibboleth.sp.DefaultProfileConfigurations">
<!-- Your profiles here. -->
<ref bean="OIDC.SSO" />
</util:list>
- <!-- ============ RelyingParty defaults ============ -->
-
- <!--
- These beans are wired into *all* applications across all agents by default. You can create
- customized alternatives in whatever combination you require to plug into specific application
- beans.
- -->
-
<!--
Unverified RP configuration, defaults to no support for any profiles.
- "Unverified" typically means the SP has no metadata, or equivalent way of assuring the identity and
- legitimacy of an IdP system. To run an "open" SP, you can enable profiles here.
+ "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the identity and
+ legitimacy of an authenticating system. Some profiles may simply be designed to operate this way.
-->
- <bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
- <property name="profileConfigurations">
- <list>
- <!-- Your profiles here. -->
- </list>
- </property>
- </bean>
-
- <!-- Container for any overrides you want to add, again used for all applications by default. -->
+ <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
+ <!-- Your profiles here. -->
+ </util:list>
- <util:list id="shibboleth.RelyingPartyOverrides">
+ <!-- ============ RelyingParty Overrides ============ -->
+ <!--
+ These overrides are wired into *all* Applications across all Agents by default. You can create
+ customized alternatives in whatever combination you require to plug into specific Application
+ beans.
+ -->
+
+ <util:list id="shibboleth.sp.RelyingPartyOverrides">
+ <!-- Your RelyingParty overrides here. -->
</util:list>
</beans>
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index 4bd9eda..ad27fe8 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -1,11 +1,19 @@
+# Default issuer/entityID/client_id/etc.
+sp.issuer = https://sp.example.org
+
+# Default authentication authority (IdP, OP, etc.) to use if any
+sp.defaultAuthority = https://op.example.org
+
# Controls configuration of service to resolve SP agents and applications
# Uncomment and define to override service resources
-#sp.service.agents.resources = shibboleth.AgentResolverResources
+#sp.service.agents.resources = shibboleth.sp.AgentResolverResources
#sp.service.agents.failFast = false
sp.service.agents.checkInterval = PT5M
-# Set to empty value to skip shared secret authentication
-#sp.agent.authn.method = basic
+# Default agent IP address filter
+#sp.agent.authn.allowedAddressRanges = 127.0.0.1/32, ::1/128
+# Set to basic for shared secret authentication
+#sp.agent.authn.method =
# Set false to globally disable cookie-based authentication by agents
#sp.agent.authn.cached = true
#sp.agent.authn.cacheDuration = PT1H
@@ -19,17 +27,28 @@ sp.service.agents.checkInterval = PT5M
sp.application.sessionInitiators = oidc
sp.application.tokenConsumers = saml2/artifact, saml2/post, saml2/post-simplesign
-
-# General SP cookie properties (maxAge only applies to persistent cookies)
+# General SP cookie properties
#sp.cookie.secure = true
#sp.cookie.httpOnly = true
#sp.cookie.domain =
-#sp.cookie.path =
-#sp.cookie.maxAge = 31536000
+#sp.cookie.path = /
+#sp.cookie.maxAge = -1
+#sp.cookie.sameSite = None
+#sp.cookie.sameSiteCondition = shibboleth.Conditions.TRUE
+# Controls how many cookies for a given use case are allowed before purging
+#sp.cookie.limit = 10
# Default state token management (SAML RelayState, etc.)
-# Set to shibboleth.CookieStateTokenManager to switch to cookie-based mechanism
-#sp.stateToken.Manager = shibboleth.StorageStateTokenManager
+# Set to shibboleth.sp.CookieStateTokenManager to switch to cookie-based mechanism
+#sp.stateToken.Manager = shibboleth.sp.StorageStateTokenManager
# Controls storage back-end for storage-based state tokens
#sp.stateToken.StorageService = shibboleth.StorageService
+# Cookie prefix when using cookie-backed state
+#sp.stateToken.cookiePrefix = __Host-shibsp_state_
+
+# Request/response correlation control
+#sp.correlation.cookiePrefix = __Host-_shibsp_req_
+# Uncomment/set to define a default IdP discovery service URL or Function
+#sp.discoveryURL = https://test.shibboleth.net/shibboleth-ds/index.html
+#sp.discoveryURLFunction =
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/DefaultRedirectUriCreationFunction.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/DefaultRedirectUriCreationFunction.java
index 0af2c35..d3c85ed 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/DefaultRedirectUriCreationFunction.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/DefaultRedirectUriCreationFunction.java
@@ -24,7 +24,6 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.apache.hc.core5.net.URIBuilder;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
@@ -139,109 +138,14 @@ public class DefaultRedirectUriCreationFunction extends AbstractIdentifiableInit
@Override
@Nullable public URI apply(@Nullable final HttpServletRequest request, @Nullable final ProfileRequestContext prc) {
- final OAuth2ClientContext context = oauth2ClientContextLookupStrategy.apply(prc);
- if (context == null) {
- log.warn("Could not locate the OAuth2 Client Context, can not compute redirect_uri");
- return null;
- }
- if (request == null) {
- log.warn("HttpServletRequest was unavailable, can not compute redirect_uri");
- return null;
- }
- if (context.getRedirectUriOverride() != null) {
- return context.getRedirectUriOverride();
- }
-
- // Should be caught upstream, but dbl check.
- if (allowedOrigins.isEmpty()) {
- log.warn("Can not compute redirect_uri if allowed origins is empty");
- return null;
- }
-
-
+ //TODO from the agent context, but maybe still use allowedOrigins concept? not sure relevant if not comming from
+ //user input, depends where the Agent gets it from.
try {
- final String scheme = request.getScheme();
- assert scheme != null;
- final String serverName = request.getServerName();
- assert serverName != null;
-
- final URI redirectUri = buildURIIgnoreDefaultPorts(scheme,
- serverName,
- request.getServerPort(),
- request.getContextPath()+request.getServletPath()+callbackServletPath);
-
- final String origin = buildOrigin(redirectUri);
- if (!allowedOrigins.contains(origin)) {
- log.warn("The 'origin' of the computed redirect_uri ('{}') is not allowed. If permissible, add it "
- + "to the allowed origins property.",origin);
- return null;
- }
- return redirectUri;
+ return new URI(String.format("%s://%s/%s", "http","localhost","callback"));
} catch (final URISyntaxException e) {
- log.warn("Unable to create redirect_uri for OIDC authentication request", e);
return null;
}
}
- /**
- * Builds the 'origin' (see RFC 6454) from given URI. Omits default or unknown ports.
- *
- * @param uri the URI to build the origin from
- * @return the origin
- * @throws URISyntaxException if there is an error getting information from the URI.
- */
- @Nonnull private String buildOrigin(@Nonnull final URI uri) throws URISyntaxException {
- if (uri.getPort() == -1) {
- //is the default port (or is not defined), do not include
- final String uriAsString = new URI(String.format("%s://%s", uri.getScheme(),uri.getHost())).toString();
- assert uriAsString != null;
- return uriAsString;
- } else {
- final String uriAsString =
- new URI(String.format("%s://%s:%s", uri.getScheme(),uri.getHost(),uri.getPort())).toString();
- assert uriAsString != null;
- return uriAsString;
- }
-
- }
-
- /**
- * Build a {@link URI} from the given parameters. If the scheme is either
- * 'http' or 'https' with their respective default port, the port is set to -1.
- *
- * @param scheme the scheme
- * @param host the hostname
- * @param port the port
- * @param path the path
- *
- * @return a fully built URI from the given parameters.
- *
- * @throws URISyntaxException if the URI can not be constructed.
- */
- @Nonnull private final URI buildURIIgnoreDefaultPorts(@Nonnull final String scheme,
- @Nonnull final String host, final int port,
- @Nonnull final String path) throws URISyntaxException {
-
- int usedPort = port;
- if ("http".equalsIgnoreCase(scheme)) {
- // ignore port iff using the default http port
- if (port == 80) {
- usedPort = -1;
- }
- } else if ("https".equalsIgnoreCase(scheme)) {
- // ignore port iff using the default https port
- if (port == 443) {
- usedPort = -1;
- }
- }
- final URI builtUri = new URIBuilder()
- .setScheme(scheme)
- .setHost(host)
- .setPort(usedPort)
- .setPath(path)
- .build();
- assert builtUri != null;
- return builtUri;
- }
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list