[java-idp-plugin-oidc-op-oidfed] 02/02: Fix JWT type-header for the resolve entity response.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-op-oidfed.git;a=commit;h=0ce593b73b2e83ecef02324f18bdc55b75621b79

commit 0ce593b73b2e83ecef02324f18bdc55b75621b79
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 26 17:16:10 2025 +0300

    Fix JWT type-header for the resolve entity response.
    
    Also fixed bean identifiers to refer to ResolveResponse instead of EntityStatement.
---
 .../oidfed/resolve-entity/resolve-entity-beans.xml | 22 +++++++++++-----------
 .../oidfed/resolve-entity/resolve-entity-flow.xml  |  6 +++---
 .../profile/flow/oidfed/ResolveEntityFlowTest.java |  3 +++
 3 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
index 8b85ea4..ee74c7e 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
@@ -141,10 +141,10 @@
         </property>
     </bean>
 
-    <bean id="PopulateEntityStatementSignatureSigningParameters"
+    <bean id="PopulateResolveResponseSignatureSigningParameters"
         class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters" scope="prototype"
         c:strategy-ref="shibboleth.MessageContextLookup.Outbound"
-        p:securityParametersContextLookupStrategy-ref="EntityStatementSecurityParametersContextLookupStrategy">
+        p:securityParametersContextLookupStrategy-ref="ResolveResponseSecurityParametersContextLookupStrategy">
         <property name="configurationLookupStrategy">
             <bean lazy-init="true"
                 class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction" />
@@ -159,18 +159,18 @@
         </property>
     </bean>
 
-    <bean id="EntityStatementSecurityParametersContextLookupStrategy" parent="shibboleth.Functions.Compose"
+    <bean id="ResolveResponseSecurityParametersContextLookupStrategy" parent="shibboleth.Functions.Compose"
             c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
             c:f-ref="shibboleth.ChildLookup.RelyingParty" />
 
-    <bean id="EntityStatementSecurityParametersCreationViaMessageContextStrategy" parent="shibboleth.Functions.Compose">
-        <constructor-arg name="g" ref="EntityStatementSecurityParametersContextLookupStrategy" />
+    <bean id="ResolveResponseSecurityParametersCreationViaMessageContextStrategy" parent="shibboleth.Functions.Compose">
+        <constructor-arg name="g" ref="ResolveResponseSecurityParametersContextLookupStrategy" />
         <constructor-arg name="f">
             <bean parent="shibboleth.Functions.Expression" c:expression="#input.getParent()" />
         </constructor-arg>
     </bean>
 
-    <bean id="BuildEntityStatement"
+    <bean id="BuildResolveResponse"
         class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.BuildResolveEntityResponse" scope="prototype"
         p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"
         p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}">
@@ -180,13 +180,13 @@
         </property>    
     </bean>
 
-    <bean id="SignEntityStatement" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+    <bean id="SignResolveResponse" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
             scope="prototype" c:executionDirection="OUTBOUND ">
         <constructor-arg name="messageHandler">
-            <bean id="SignEntityStatementHandler"
-                class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="Entity Statement"
-                p:securityParametersLookupStrategy-ref="EntityStatementSecurityParametersCreationViaMessageContextStrategy"
-                p:typeHeader="entity-statement+jwt">
+            <bean id="SignResolveResponseHandler"
+                class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="Resolve Response"
+                p:securityParametersLookupStrategy-ref="ResolveResponseSecurityParametersCreationViaMessageContextStrategy"
+                p:typeHeader="resolve-response+jwt">
                 <property name="claimsToSignLookupStrategy">
                      <bean
                         class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.JWTClaimsSetFromEntityStatementLookupFunction" />
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-flow.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-flow.xml
index f80f880..81639af 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-flow.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-flow.xml
@@ -64,9 +64,9 @@
 
 
     <action-state id="BuildResponse">
-        <evaluate expression="PopulateEntityStatementSignatureSigningParameters" />
-        <evaluate expression="BuildEntityStatement" />
-        <evaluate expression="SignEntityStatement" />
+        <evaluate expression="PopulateResolveResponseSignatureSigningParameters" />
+        <evaluate expression="BuildResolveResponse" />
+        <evaluate expression="SignResolveResponse" />
         <evaluate expression="'proceed'" />
         
         <transition on="proceed" to="BuildResponseMessage" />
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/ResolveEntityFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/ResolveEntityFlowTest.java
index 93f2cb0..00551b5 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/ResolveEntityFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/ResolveEntityFlowTest.java
@@ -21,6 +21,7 @@ import org.springframework.webflow.executor.FlowExecutionResult;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
+import com.nimbusds.jose.JOSEObjectType;
 import com.nimbusds.jwt.SignedJWT;
 import com.nimbusds.oauth2.sdk.Response;
 
@@ -75,6 +76,7 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
         final ResolveEntityResponse parsedResponse =
                 parseSuccessResponse(result, ResolveEntityResponse.class);
         final SignedJWT response = parsedResponse.getJWT();
+        Assert.assertEquals(response.getHeader().getType(), new JOSEObjectType("resolve-response+jwt"));
         Assert.assertEquals(response.getJWTClaimsSet().getSubject(), clientId);
         Assert.assertNotNull(response.getJWTClaimsSet().getClaim("metadata"));
     }
@@ -99,6 +101,7 @@ public class ResolveEntityFlowTest extends AbstractFederationFlowTest {
         final ResolveEntityResponse parsedResponse =
                 parseSuccessResponse(result, ResolveEntityResponse.class);
         final SignedJWT response = parsedResponse.getJWT();
+        Assert.assertEquals(response.getHeader().getType(), new JOSEObjectType("resolve-response+jwt"));
         Assert.assertEquals(response.getJWTClaimsSet().getSubject(), entityId);
         Assert.assertNotNull(response.getJWTClaimsSet().getClaim("metadata"));
     }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.