[java-plugin-shibd-oidc] branch main updated: JSHIBDOIDC-6 - Add back PKCE support

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/78d61eadcab7fdd2f9ec6a17d55b6613351ec223

The following commit(s) were added to refs/heads/main by this push:
     new 78d61ea  JSHIBDOIDC-6 - Add back PKCE support
78d61ea is described below

commit 78d61eadcab7fdd2f9ec6a17d55b6613351ec223
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Apr 16 17:31:31 2026 +0100

    JSHIBDOIDC-6 - Add back PKCE support
    
     - Inject PKCE lookup into token request encoder
    
    https://shibboleth.atlassian.net/browse/JSHIBDOIDC-6
---
 .../net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml |  6 +++++-
 ...egy.java => PKCECodeVerifierFromStateLookupStrategy.java} | 12 ++++++------
 .../profile/impl/RedirectUriFromStateLookupStrategy.java     |  3 ++-
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
index 3b89cb7..df8e5f9 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
@@ -205,7 +205,11 @@
         <property name="redirectUriLookupStrategy">
              <bean class="net.shibboleth.sp.oidc.profile.impl.RedirectUriFromStateLookupStrategy" scope="prototype" 
              c:authenticationRequestLookupStrategy-ref="shibboleth.ChildLookup.AuthenticationRequestStateDataFromInbound"/>   
-        </property>   
+        </property>
+        <property name="pkceCodeVerifierLookupStrategy">
+             <bean class="net.shibboleth.sp.oidc.profile.impl.PKCECodeVerifierFromStateLookupStrategy" scope="prototype" 
+             c:authenticationRequestLookupStrategy-ref="shibboleth.ChildLookup.AuthenticationRequestStateDataFromInbound"/>   
+        </property>  
     </bean>
     
     <bean id="ValidateOAuthAccessTokenResponse" scope="prototype"
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RedirectUriFromStateLookupStrategy.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PKCECodeVerifierFromStateLookupStrategy.java
similarity index 82%
copy from sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RedirectUriFromStateLookupStrategy.java
copy to sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PKCECodeVerifierFromStateLookupStrategy.java
index a344abc..bc873bb 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RedirectUriFromStateLookupStrategy.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PKCECodeVerifierFromStateLookupStrategy.java
@@ -14,7 +14,6 @@
 
 package net.shibboleth.sp.oidc.profile.impl;
 
-import java.net.URI;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
@@ -34,19 +33,20 @@ import net.shibboleth.sp.oidc.profile.AuthenticationRequestStateData;
  * {@link AuthnRequestStateDataContext} associated with a {@link ProfileRequestContext}.
  */
 @ThreadSafe
-public class RedirectUriFromStateLookupStrategy implements Function<ProfileRequestContext, URI> {
+public class PKCECodeVerifierFromStateLookupStrategy implements Function<ProfileRequestContext, String> {
     
     /** 
      * Strategy used to locate the {@link AuthnRequestStateDataContext}.
      */
-    @Nonnull private final Function<ProfileRequestContext, AuthnRequestStateDataContext> authenticationRequestLookupStrategy;
+    @Nonnull 
+    private final Function<ProfileRequestContext, AuthnRequestStateDataContext> authenticationRequestLookupStrategy;
 
     /**
      * Constructor.
      *
      * @param strategy strategy to find the authentication request state context
      */
-    public RedirectUriFromStateLookupStrategy(@ParameterName(name = "authenticationRequestLookupStrategy")
+    public PKCECodeVerifierFromStateLookupStrategy(@ParameterName(name = "authenticationRequestLookupStrategy")
             @Nonnull final Function<ProfileRequestContext, AuthnRequestStateDataContext> strategy) {
         authenticationRequestLookupStrategy = Constraint.isNotNull(strategy,
                 "authenticationRequestLookupStrategy can not be null");
@@ -54,7 +54,7 @@ public class RedirectUriFromStateLookupStrategy implements Function<ProfileReque
     
 
     @Override
-    @Nullable public URI apply(final ProfileRequestContext prc) {
+    @Nullable public String apply(final ProfileRequestContext prc) {
         
         final AuthnRequestStateDataContext authnRequestCtx = authenticationRequestLookupStrategy.apply(prc);
         
@@ -65,7 +65,7 @@ public class RedirectUriFromStateLookupStrategy implements Function<ProfileReque
         if (authnRequest == null) {
             return null;
         }
-        return authnRequest.getRedirectUri();
+        return authnRequest.getPkceCodeVerifier();
     }
 
 }
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RedirectUriFromStateLookupStrategy.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RedirectUriFromStateLookupStrategy.java
index a344abc..e6b0060 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RedirectUriFromStateLookupStrategy.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RedirectUriFromStateLookupStrategy.java
@@ -39,7 +39,8 @@ public class RedirectUriFromStateLookupStrategy implements Function<ProfileReque
     /** 
      * Strategy used to locate the {@link AuthnRequestStateDataContext}.
      */
-    @Nonnull private final Function<ProfileRequestContext, AuthnRequestStateDataContext> authenticationRequestLookupStrategy;
+    @Nonnull 
+    private final Function<ProfileRequestContext, AuthnRequestStateDataContext> authenticationRequestLookupStrategy;
 
     /**
      * Constructor.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.