[java-idp-plugin-oidc-config] 02/02: JCOMOIDC-161 - Facilitate extending the credential resolvers for RP/OP metadata

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-config.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-config/commit/98c55995e21f4f4cc0994a83f9f3f9089a9dc182

commit 98c55995e21f4f4cc0994a83f9f3f9089a9dc182
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Apr 6 10:25:35 2026 +0300

    JCOMOIDC-161 - Facilitate extending the credential resolvers for RP/OP metadata
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-161
    
    - Define new global bean 'shibboleth.oidc.JWKSetDecoratorManager' that autowires all beans that implement JWKSetDecorator interface
    - Wire the manager bean into default ClientInformationCredentialResolvers and ProviderMetadataCredentialResolvers
---
 .../META-INF/net.shibboleth.idp/postconfig.xml      |  4 ++++
 .../idp/service/relying-party/postconfig.xml        | 21 ++++++++++++++-------
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index e9692a5..20aa148 100644
--- a/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -25,6 +25,10 @@
         p:httpClient="#{getObject('shibboleth.oidc.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
         p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.NonBrowser.HttpClientSecurityParameters')}" />
 
+    <!-- Manager for auto-wired JWKSetDecorators -->
+    <bean id="shibboleth.oidc.JWKSetDecoratorManager"
+        class="net.shibboleth.oidc.security.credential.JWKSetDecoratorManager" />
+
     <bean class="net.shibboleth.idp.spring.DeprecatedPropertyBean">
         <property name="deprecatedProperties">
             <map>
diff --git a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index cf138d0..bcb0885 100644
--- a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -712,12 +712,14 @@
                 <bean id="ClientInformationCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
                     c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" 
-                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"
+                    c:jwkSetDecoratorManager-ref="shibboleth.oidc.JWKSetDecoratorManager"/>
                 <!--  Used by the RP -->
                 <bean id="OIDCProviderMetadataCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
                     c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
-                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}" />
+                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"
+                    c:jwkSetDecoratorManager-ref="shibboleth.oidc.JWKSetDecoratorManager"/>
                 <bean id="ClientSecretCriterionCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
             </list>
@@ -732,7 +734,8 @@
                 <bean id="ClientInformationCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
                     c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" 
-                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"
+                    c:jwkSetDecoratorManager-ref="shibboleth.oidc.JWKSetDecoratorManager"/>
                 <!--  Used by the RP -->
                 <bean id="ClientSecretCriterionCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
@@ -764,7 +767,8 @@
                 <bean id="ClientInformationCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
                     c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" 
-                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"
+                    c:jwkSetDecoratorManager-ref="shibboleth.oidc.JWKSetDecoratorManager"/>
                 <!--  Used by the RP -->
                 <bean id="CriterionCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
@@ -780,7 +784,8 @@
                 <bean id="ClientInformationCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
                     c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" 
-                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"
+                    c:jwkSetDecoratorManager-ref="shibboleth.oidc.JWKSetDecoratorManager"/>
                 <!--  Used by the RP -->
                 <bean id="CriterionCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
@@ -811,12 +816,14 @@
                 <bean id="ClientInformationCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientInformationCredentialResolver"
                     c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" 
-                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"
+                    c:jwkSetDecoratorManager-ref="shibboleth.oidc.JWKSetDecoratorManager"/>
                 <!--  Used by the RP -->
                 <bean id="OIDCProviderMetadataCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
                     c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache" 
-                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"/>
+                    c:keyFetchInterval="%{idp.oidc.provider.keyfetch.interval:PT30M}"
+                    c:jwkSetDecoratorManager-ref="shibboleth.oidc.JWKSetDecoratorManager"/>
                 <bean id="CriterionCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
             </list>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.