[java-idp-plugin-oidc-op-oidfed] branch dev/CACHE-REFACTOR updated: Initial support for client authentication to federation endpoints
Codeberg
noreply at shibboleth.net
Wed Apr 29 17:32:41 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/CACHE-REFACTOR
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/4b54ef6315fafd54f34bf61bf0dd1479dbef5eeb
The following commit(s) were added to refs/heads/dev/CACHE-REFACTOR by this push:
new 4b54ef6 Initial support for client authentication to federation endpoints
4b54ef6 is described below
commit 4b54ef6315fafd54f34bf61bf0dd1479dbef5eeb
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Apr 29 20:32:15 2026 +0300
Initial support for client authentication to federation endpoints
- fetch, resolve entity, trust mark, trust mark status
- client authentication is implemented by decorating HTTP request (to possibly add headers) and POST parameters via 'BiConsumer<HttpRequest,List<NameValuePair>'
- API requests always use POST if they contain client authentication
- private_key_jwt is used if it exists from the 'federation_*_endpoint_auth_methods' claim in the federation entity metadata
- security configuration is fetched via OIDFED.Configuration unverified relying party configuration bean
- Initial testing for the fetch endpoints, other tests TODO
---
...FederationEndpointResponseFetchingStrategy.java | 35 +++
...icationSecurityConfigurationLookupFunction.java | 117 ++++++++
.../DefaultClientAuthenticationLookupFunction.java | 113 ++++++++
...tPrivateKeyJwtClientAuthenticationFunction.java | 315 +++++++++++++++++++++
...FederationEndpointEntityStatementCriterion.java | 78 +++++
...ultResolveEntityTrustChainFetchingStrategy.java | 33 ++-
...efaultSubordinateStatementFetchingStrategy.java | 52 +++-
.../DefaultTrustMarkFetchingStrategy.java | 33 ++-
.../DefaultTrustMarkStatusFetchingStrategy.java | 6 +
.../metadata/util/EntityStatementHelper.java | 39 ---
.../oidfed/profile/impl/CallResolveEntityApi.java | 13 +-
...TrustMarkFromMetadataCacheFetchingFunction.java | 37 ++-
...ticationSignatureSigningParametersResolver.java | 117 ++++++++
.../META-INF/net.shibboleth.idp/postconfig.xml | 58 ++++
.../SubordinateStatementMetadataCacheTest.java | 47 +++
15 files changed, 1024 insertions(+), 69 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java
index 2c11ff5..79734a8 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java
@@ -18,6 +18,9 @@ import java.io.IOException;
import java.net.URISyntaxException;
import java.time.Duration;
import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+import java.util.function.BiConsumer;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -27,6 +30,8 @@ import org.apache.hc.client5.http.classic.HttpClient;
import org.apache.hc.client5.http.protocol.HttpClientContext;
import org.apache.hc.core5.http.ClassicHttpRequest;
import org.apache.hc.core5.http.ClassicHttpResponse;
+import org.apache.hc.core5.http.HttpRequest;
+import org.apache.hc.core5.http.NameValuePair;
import org.apache.hc.core5.http.ProtocolException;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.HttpClientSecuritySupport;
@@ -75,6 +80,10 @@ public abstract class
/** Strategy to fetch lifetime for containers whose contents could not be fetched. */
@NonnullAfterInit private Function<CriteriaSet, Duration> criteriaToExceptionContainerLifetimeStrategy;
+ /** Strategy to fetch client authentication decorator for HTTP request and its parameters. */
+ @Nullable protected
+ Function<CriteriaSet, BiConsumer<HttpRequest,List<NameValuePair>>> clientAuthenticationLookupStrategy;
+
/**
* Set the {@link HttpClient} to use.
*
@@ -156,6 +165,18 @@ public abstract class
Constraint.isNotNull(strategy, "Criteria to exception container lifetime strategy cannot be null");
}
+ /**
+ * Set the strategy to fetch client authentication decorator for HTTP request and its parameters.
+ *
+ * @param strategy client authentication strategy
+ */
+ public void setClientAuthenticationLookupStrategy(
+ @Nullable final Function<CriteriaSet, BiConsumer<HttpRequest, List<NameValuePair>>> strategy) {
+ checkSetterPreconditions();
+
+ clientAuthenticationLookupStrategy = strategy;
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -235,6 +256,20 @@ public abstract class
}
}
+ /**
+ * Get the client authentication decorator by using the configured lookup strategy.
+ *
+ * @param criteria the criteria passed to the lookup strategy
+ * @return the client authentication decorator, or null if none was resolved
+ */
+ @Nullable protected BiConsumer<HttpRequest, List<NameValuePair>> getClientAuthentication(
+ @Nonnull final CriteriaSet criteria) {
+ log.trace("Criteria set passed for client authentication lookup: {}", criteria);
+ return Optional.ofNullable(clientAuthenticationLookupStrategy)
+ .map(strategy -> strategy.apply(criteria))
+ .orElse(null);
+ }
+
/**
* Build the {@link HttpClientContext} instance to be used with {@link #httpClient}.
*
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultAuthenticationSecurityConfigurationLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultAuthenticationSecurityConfigurationLookupFunction.java
new file mode 100644
index 0000000..09fb56f
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultAuthenticationSecurityConfigurationLookupFunction.java
@@ -0,0 +1,117 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationEntityConfigurationProfileConfiguration;
+import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
+import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.resolver.CriteriaSet;
+import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.service.ReloadableService;
+import net.shibboleth.shared.service.ServiceableComponent;
+
+/**
+ * Default lookup function for resolving the security configuration via {@link RelyingPartyConfigurationResolver} and
+ * a configurable unverified profile configuration. The {@link OIDFederationEntityConfigurationProfileConfiguration}
+ * profile is used by default.
+ */
+public class DefaultAuthenticationSecurityConfigurationLookupFunction extends AbstractIdentifiableInitializableComponent
+ implements Function<CriteriaSet, JSONSecurityConfiguration> {
+
+ /** Class logger. */
+ @Nonnull
+ private Logger log = LoggerFactory.getLogger(DefaultAuthenticationSecurityConfigurationLookupFunction.class);
+
+ /** Resolver used to look up relying party configurations. */
+ @NonnullAfterInit private ReloadableService<RelyingPartyConfigurationResolver> rpConfigResolver;
+
+ /** Profile configuration identifier, must be unverified relying party. */
+ @Nonnull @NotEmpty private String profileId;
+
+ /**
+ * Constructor.
+ */
+ public DefaultAuthenticationSecurityConfigurationLookupFunction() {
+ profileId = OIDFederationEntityConfigurationProfileConfiguration.PROFILE_ID;
+ }
+
+ /**
+ * Set the relying party config resolver to use.
+ *
+ * @param resolver the resolver to use
+ */
+ public void setRelyingPartyConfigurationResolver(
+ @Nonnull final ReloadableService<RelyingPartyConfigurationResolver> resolver) {
+ checkSetterPreconditions();
+ rpConfigResolver = Constraint.isNotNull(resolver, "Relying party configuration resolver cannot be null");
+ }
+
+ /**
+ * Set the unverified profile configuration identifier.
+ *
+ * @param id the identifier to use
+ */
+ public void setUnverifiedProfileConfigurationId(@Nonnull @NotEmpty final String id) {
+ checkSetterPreconditions();
+ profileId = Constraint.isNotEmpty(id, "Unverified profile configuration ID cannot be empty");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (rpConfigResolver == null) {
+ throw new ComponentInitializationException("RelyingPartyConfigurationResolver cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override @Nullable
+ public JSONSecurityConfiguration apply(@Nullable final CriteriaSet criteria) {
+ checkComponentActive();
+ try (final ServiceableComponent<RelyingPartyConfigurationResolver> resolver =
+ rpConfigResolver.getServiceableComponent()) {
+ final RelyingPartyConfiguration config = resolver.getComponent().resolveSingle(criteria);
+ if (config != null) {
+ final ProfileConfiguration profileConfig = config.getProfileConfiguration(null, profileId);
+ if (profileConfig != null && profileConfig.getSecurityConfiguration(null)
+ instanceof JSONSecurityConfiguration jsonSecurityConfig) {
+ return jsonSecurityConfig;
+ }
+ log.error("Could not resolve JSON security configuration via profile configuration {}", profileId);
+ }
+ log.error("Could not resolve relying party configuration");
+ } catch (final ResolverException e) {
+ log.error("Error trying to resolve relying party configuration", e);
+ }
+ return null;
+ }
+}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultClientAuthenticationLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultClientAuthenticationLookupFunction.java
new file mode 100644
index 0000000..71b487a
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultClientAuthenticationLookupFunction.java
@@ -0,0 +1,113 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+
+import java.util.List;
+import java.util.function.BiConsumer;
+import java.util.function.BiFunction;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.apache.hc.core5.http.HttpRequest;
+import org.apache.hc.core5.http.NameValuePair;
+import org.slf4j.Logger;
+
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.resolver.CriteriaSet;
+
+/**
+ * Default client authentication lookup strategy implementation that exploits a static list of supported authentication
+ * functions.
+ */
+public class DefaultClientAuthenticationLookupFunction extends AbstractIdentifiableInitializableComponent
+ implements Function<CriteriaSet,BiConsumer<HttpRequest,List<NameValuePair>>> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultClientAuthenticationLookupFunction.class);
+
+ /** Lookup strategy for supported authentication methods. */
+ @NonnullAfterInit private Function<CriteriaSet,List<String>> supportedAuthenticationMethodsLookupStrategy;
+
+ /** Lookup strategy for the list of supported client authentication decorators. */
+ @NonnullAfterInit
+ private List<BiFunction<CriteriaSet,List<String>,BiConsumer<HttpRequest,List<NameValuePair>>>>
+ clientAuthenticationDecoratorsLookupStrategy;
+
+ /**
+ * Set the lookup strategy for supported authentication methods.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setSupportedAuthenticationMethodsLookupStrategy(
+ @Nonnull final Function<CriteriaSet,List<String>> strategy) {
+ checkSetterPreconditions();
+ supportedAuthenticationMethodsLookupStrategy =
+ Constraint.isNotNull(strategy, "Supported authentication methods lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the lookup strategy for the list of supported client authentication decorators.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setClientAuthenticationDecoratorsLookupStrategy(@Nonnull final
+ List<BiFunction<CriteriaSet,List<String>,BiConsumer<HttpRequest,List<NameValuePair>>>> strategy) {
+ checkSetterPreconditions();
+ clientAuthenticationDecoratorsLookupStrategy =
+ Constraint.isNotNull(strategy, "Client authentication decorators lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+ if (supportedAuthenticationMethodsLookupStrategy == null) {
+ throw new ComponentInitializationException(
+ "Supported authentication methods lookup strategy cannot be null");
+ }
+ if (clientAuthenticationDecoratorsLookupStrategy == null) {
+ throw new ComponentInitializationException(
+ "Client authentication decorators lookup strategy cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public BiConsumer<HttpRequest,List<NameValuePair>> apply(@Nullable final CriteriaSet criteria) {
+ final List<String> supportedMethods = supportedAuthenticationMethodsLookupStrategy.apply(criteria);
+ if (supportedMethods == null) {
+ log.debug("Could not resolve list of supported methods, no client authentication used");
+ return null;
+ }
+ if (supportedMethods.isEmpty()) {
+ log.warn("Unexpected value for the list of supported methods: empty array");
+ return null;
+ }
+ for (final BiFunction<CriteriaSet,List<String>,BiConsumer<HttpRequest,List<NameValuePair>>> function :
+ clientAuthenticationDecoratorsLookupStrategy) {
+ final BiConsumer<HttpRequest,List<NameValuePair>> consumer = function.apply(criteria, supportedMethods);
+ if (consumer != null) {
+ log.debug("Returning client authentication decorator {}", consumer);
+ return consumer;
+ }
+ }
+ log.debug("None of the supported methods returned any client authentication details");
+ return null;
+ }
+}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultPrivateKeyJwtClientAuthenticationFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultPrivateKeyJwtClientAuthenticationFunction.java
new file mode 100644
index 0000000..0919c87
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultPrivateKeyJwtClientAuthenticationFunction.java
@@ -0,0 +1,315 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+
+import java.text.ParseException;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Date;
+import java.util.List;
+import java.util.function.BiConsumer;
+import java.util.function.BiFunction;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.apache.hc.core5.http.HttpRequest;
+import org.apache.hc.core5.http.NameValuePair;
+import org.apache.hc.core5.http.message.BasicNameValuePair;
+import org.opensaml.messaging.encoder.AbstractMessageEncoder;
+import org.slf4j.Logger;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.SignedJWT;
+
+import net.shibboleth.idp.plugin.oidc.op.encoding.impl.ResponseUtil;
+import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
+import net.shibboleth.oidc.security.impl.JWSTokenSigner;
+import net.shibboleth.oidc.security.jose.SignatureException;
+import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
+import net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver;
+import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.resolver.CriteriaSet;
+import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
+
+/**
+ * Default implementation for function providing private_key_jwt authentication.
+ */
+public class DefaultPrivateKeyJwtClientAuthenticationFunction extends AbstractIdentifiableInitializableComponent
+ implements BiFunction<CriteriaSet,List<String>,BiConsumer<HttpRequest,List<NameValuePair>>> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultPrivateKeyJwtClientAuthenticationFunction.class);
+
+ /** Used to log protocol messages. */
+ @Nonnull private Logger protocolMessageLog =
+ LoggerFactory.getLogger(AbstractMessageEncoder.BASE_PROTOCOL_MESSAGE_LOGGER_CATEGORY + ".OAUTH2");
+
+ /** Strategy used to lookup the security configuration used for signing the JWT used in authentication */
+ @NonnullAfterInit private Function<CriteriaSet,JSONSecurityConfiguration> securityConfigurationLookupStrategy;
+
+ /** Strategy used to lookup the type header value for the JWT. */
+ @NonnullAfterInit private Function<CriteriaSet,String> typeHeaderLookupStrategy;
+
+ /** Strategy to find the audience value from the criteria set.*/
+ @NonnullAfterInit private Function<CriteriaSet,String> audienceLookupStrategy;
+
+ /** Strategy to find the issuer/subject value from the criteria set.*/
+ @NonnullAfterInit private Function<CriteriaSet,String> issuerLookupStrategy;
+
+ /** Strategy used to locate the {@link IdentifierGenerationStrategy} to use. */
+ @Nonnull private Function<CriteriaSet,IdentifierGenerationStrategy> idGeneratorLookupStrategy;
+
+ /** Resolver for signing parameters. */
+ @NonnullAfterInit private SignatureSigningParametersResolver resolver;
+
+ /** The offset to add to the 'exp' claim time for JWT client authentication methods. Default is 30 seconds.*/
+ @Nonnull private Duration jwtBearerExpiryOffset;
+
+ /** Object mapper used for pretty-printing JWT contents. */
+ @NonnullAfterInit private ObjectMapper objectMapper;
+
+ public DefaultPrivateKeyJwtClientAuthenticationFunction() {
+ idGeneratorLookupStrategy = FunctionSupport.constant(new SecureRandomIdentifierGenerationStrategy());
+ final Duration thirtySecs = Duration.ofSeconds(30);
+ assert thirtySecs != null;
+ jwtBearerExpiryOffset = thirtySecs;
+ }
+
+ public void setSecurityConfigurationLookupStrategy(
+ @Nonnull final Function<CriteriaSet,JSONSecurityConfiguration> strategy) {
+ checkSetterPreconditions();
+ securityConfigurationLookupStrategy =
+ Constraint.isNotNull(strategy, "The security configuration lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the strategy used to lookup the type header value for the JWT.
+ *
+ * @param strategy What to set.
+ */
+ public void setTypeHeaderLookupStrategy(@Nonnull final Function<CriteriaSet,String> strategy) {
+ checkSetterPreconditions();
+ typeHeaderLookupStrategy = Constraint.isNotNull(strategy, "The type header lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the audience lookup strategy.
+ *
+ * @param strategy the strategy.
+ */
+ public void setAudienceLookupStrategy(
+ @Nonnull final Function<CriteriaSet, String> strategy) {
+ checkSetterPreconditions();
+ audienceLookupStrategy = Constraint.isNotNull(strategy, "Audience lookup strategy can not be null");
+ }
+
+ /**
+ * Set the issuer/subject lookup strategy.
+ *
+ * @param strategy the strategy.
+ */
+ public void setIssuerLookupStrategy(
+ @Nonnull final Function<CriteriaSet, String> strategy) {
+ checkSetterPreconditions();
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy can not be null");
+ }
+
+ /**
+ * Set the object mapper used for pretty-printing JWT contents.
+ *
+ * @param mapper What to set.
+ */
+ public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
+ checkSetterPreconditions();
+ objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
+ }
+
+ /**
+ * Set the strategy used to locate the {@link IdentifierGenerationStrategy} to use.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIdentifierGeneratorLookupStrategy(
+ @Nonnull final Function<CriteriaSet,IdentifierGenerationStrategy> strategy) {
+ checkSetterPreconditions();
+
+ idGeneratorLookupStrategy =
+ Constraint.isNotNull(strategy, "Identifier generation strategy cannot be null");
+ }
+
+ /**
+ * Set the resolver to use for the signing parameters.
+ *
+ * @param newResolver resolver to use
+ */
+ public void setSignatureSigningParametersResolver(
+ @Nonnull final SignatureSigningParametersResolver newResolver) {
+ checkSetterPreconditions();
+
+ resolver = Constraint.isNotNull(newResolver, "SignatureSigningParametersResolver cannot be null");
+ }
+
+ /**
+ * Set the JWT expiry time offset for client authentications.
+ *
+ * @param expiry the JWT 'exp' claim offset
+ */
+ public void setJwtBearerExpiryOffset(@Nonnull final Duration expiry) {
+ checkSetterPreconditions();
+
+ jwtBearerExpiryOffset = Constraint.isNotNull(expiry, "jwtBearerExpiryOffset can not be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (securityConfigurationLookupStrategy == null) {
+ throw new ComponentInitializationException("The security configuration lookup strategy cannot be null");
+ }
+ if (typeHeaderLookupStrategy == null) {
+ throw new ComponentInitializationException("The type header lookup strategy cannot be null");
+ }
+ if (audienceLookupStrategy == null) {
+ throw new ComponentInitializationException("The audience lookup strategy cannot be null)");
+ }
+ if (issuerLookupStrategy == null) {
+ throw new ComponentInitializationException("The issuer lookup strategy cannot be null)");
+ }
+ if (objectMapper == null) {
+ throw new ComponentInitializationException("Object mapper cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override @Nullable
+ public BiConsumer<HttpRequest,List<NameValuePair>> apply(@Nullable final CriteriaSet criteria,
+ @Nullable final List<String> methods) {
+ checkComponentActive();
+ if (methods == null || !methods.contains("private_key_jwt")) {
+ log.debug("No supported client authentication methods in {}, nothing to do", methods);
+ return null;
+ }
+ final JSONSecurityConfiguration securityConfiguration = securityConfigurationLookupStrategy.apply(criteria);
+ if (securityConfiguration == null || securityConfiguration.getJwtSignatureSigningConfiguration() == null) {
+ log.error("Could not resolve signature signing configuration");
+ return null;
+ }
+
+ final SignatureSigningParameters signingParameters;
+ try {
+ final CriteriaSet resolverCriteria = criteria == null ? new CriteriaSet() : criteria;
+ resolverCriteria.add(new SignatureSigningConfigurationCriterion(
+ securityConfiguration.getJwtSignatureSigningConfiguration()));
+ signingParameters = resolver.resolveSingle(resolverCriteria);
+ if (signingParameters == null) {
+ log.error("Failed to resolve signature signing parameters");
+ return null;
+ }
+ log.debug("Signature signing parameters successfully resolved");
+ } catch (final ResolverException e) {
+ log.error("Error resolving signature signing parameters", e);
+ return null;
+ }
+
+ final String typeHeader = typeHeaderLookupStrategy.apply(criteria);
+ final String audience = audienceLookupStrategy.apply(criteria);
+ if (StringSupport.trimOrNull(audience) == null) {
+ log.warn("Could not resolve audience for the JWT");
+ return null;
+ }
+ final String issuer = issuerLookupStrategy.apply(criteria);
+ if (StringSupport.trimOrNull(issuer) == null) {
+ log.warn("Could not resolve issuer/subject for the JWT");
+ return null;
+ }
+ final IdentifierGenerationStrategy idGenerator = idGeneratorLookupStrategy.apply(criteria);
+ if (idGenerator == null) {
+ log.error("Could not resolve identifier generator for JWT");
+ return null;
+ }
+ assert issuer != null; assert audience != null;
+ final SignedJWT jwt = constructJWT(idGenerator.generateIdentifier(), issuer, audience, signingParameters,
+ typeHeader);
+ if (jwt == null) {
+ return null;
+ }
+ return new BiConsumer<HttpRequest,List<NameValuePair>>() {
+
+ /** {@inheritDoc} */
+ @Override
+ public void accept(@Nullable final HttpRequest httpRequest,
+ @Nullable final List<NameValuePair> parameters) {
+ if (httpRequest == null || parameters == null) {
+ return;
+ }
+ parameters.add(new BasicNameValuePair(
+ "client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"));
+ parameters.add(new BasicNameValuePair("client_assertion", jwt.serialize()));
+ }
+
+ };
+ }
+
+ /**
+ * Construct a {@link SignedJWT} with the given input claims and signing parameters.
+ * @param issuer The issuer for the JWT
+ * @param audience The audience for the JWT
+ * @param signingParameters The signing parameters
+ * @param typeHeader The type header value for the JWT
+ * @return A signed JWT, or null
+ */
+ @Nullable protected SignedJWT constructJWT(@Nonnull @NotEmpty final String jti,
+ @Nonnull @NotEmpty final String issuer, @Nonnull @NotEmpty final String audience,
+ @Nonnull final SignatureSigningParameters signingParameters, @Nullable final String typeHeader) {
+ final JWTClaimsSet jwtClaims = new JWTClaimsSet.Builder()
+ .subject(issuer)
+ .issuer(issuer)
+ .audience(audience)
+ .issueTime(Date.from(Instant.now()))
+ .expirationTime(Date.from(Instant.now().plus(jwtBearerExpiryOffset)))
+ .jwtID(jti)
+ .build();
+ assert jwtClaims != null;
+ final JWSTokenSigner signer = new JWSTokenSigner(signingParameters);
+ try {
+ assert objectMapper != null;
+ protocolMessageLog.trace("JWT client authentication payload contents:\n{}",
+ ResponseUtil.getJwtProtocolMessage(jwtClaims, objectMapper));
+ } catch (final ParseException e) {
+ log.error("Could not construct the protocol message of the JWT contents", e);
+ }
+ try {
+ return signer.sign(jwtClaims, typeHeader);
+ } catch (final SignatureException e) {
+ log.error("Could not sign the JWT", e);
+ }
+ return null;
+ }
+}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/FederationEndpointEntityStatementCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/FederationEndpointEntityStatementCriterion.java
new file mode 100644
index 0000000..848fb9a
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/FederationEndpointEntityStatementCriterion.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
+
+import java.util.Objects;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.resolver.Criterion;
+
+/**
+ * A {@link Criterion} representing an entity statement of an entity offering federation API endpoints.
+ */
+public class FederationEndpointEntityStatementCriterion implements Criterion {
+
+ /** The entity statement value. */
+ @Nonnull final EntityStatement<?> value;
+
+ /**
+ * Constructor.
+ *
+ * @param statement the entity statement value, must not be null
+ */
+ public FederationEndpointEntityStatementCriterion(@Nonnull final EntityStatement<?> statement) {
+ value = Constraint.isNotNull(statement, "Entity statement cannot be null");
+ }
+
+ /**
+ * Get the entity statement value.
+ *
+ * @return the entity statement value
+ */
+ @Nonnull public EntityStatement<?> getValue() {
+ return value;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String toString() {
+ return "FederationEndpointEntityStatementCriterion [value=" + value.getJwt().serialize() + "]";
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int hashCode() {
+ return Objects.hash(value);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean equals(final Object obj) {
+ if (this == obj) {
+ return true;
+ }
+ if (obj == null) {
+ return false;
+ }
+ if (getClass() != obj.getClass()) {
+ return false;
+ }
+ final FederationEndpointEntityStatementCriterion other = (FederationEndpointEntityStatementCriterion) obj;
+ return value.getJwt().serialize().equals(other.value.getJwt().serialize());
+ }
+}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java
index 2208eeb..cbd106b 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java
@@ -17,16 +17,23 @@ package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver;
import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
+import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.util.ArrayList;
import java.util.List;
+import java.util.function.BiConsumer;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.apache.hc.client5.http.classic.methods.HttpGet;
+import org.apache.hc.client5.http.classic.methods.HttpPost;
+import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
import org.apache.hc.core5.http.ClassicHttpRequest;
import org.apache.hc.core5.http.ClassicHttpResponse;
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.HttpRequest;
import org.apache.hc.core5.http.NameValuePair;
import org.apache.hc.core5.http.ProtocolException;
import org.apache.hc.core5.http.io.entity.EntityUtils;
@@ -82,18 +89,30 @@ public class DefaultResolveEntityTrustChainFetchingStrategy
/** {@inheritDoc} */
@Nullable protected ClassicHttpRequest initializeHttpRequest(@Nonnull final CriteriaSet criteria,
@Nonnull ResolveEntityCacheContainerIdentifier identifier) {
- final HttpGet httpRequest = new HttpGet(identifier.getEndpoint());
+
final List<NameValuePair> nvps = new ArrayList<>();
nvps.add(new BasicNameValuePair("sub", identifier.getSubject()));
identifier.getTrustAnchors().forEach(anchor -> nvps.add(new BasicNameValuePair("trust_anchor", anchor)));
identifier.getEntityTypes().forEach(type -> nvps.add(new BasicNameValuePair("entity_type", type)));
- try {
- final URI uri = new URIBuilder(httpRequest.getUri()).addParameters(nvps).build();
- httpRequest.setUri(uri);
- } catch (final URISyntaxException e) {
- log.error("Could not create URI with the given parameters {}", identifier, e);
+
+ final BiConsumer<HttpRequest,List<NameValuePair>> clientAuthentication = getClientAuthentication(criteria);
+ if (clientAuthentication == null) {
+ final HttpGet httpRequest = new HttpGet(identifier.getEndpoint());
+ try {
+ final URI uri = new URIBuilder(httpRequest.getUri()).addParameters(nvps).build();
+ httpRequest.setUri(uri);
+ } catch (final URISyntaxException e) {
+ log.error("Could not create URI with the given parameters {}", identifier, e);
+ }
+ return httpRequest;
+ } else {
+ final HttpPost httpRequest = new HttpPost(identifier.getEndpoint());
+ clientAuthentication.accept(httpRequest, nvps);
+ final UrlEncodedFormEntity urlEncodedFormEntity = new UrlEncodedFormEntity(nvps, StandardCharsets.UTF_8);
+ httpRequest.setEntity(urlEncodedFormEntity);
+ httpRequest.setHeader(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_FORM_URLENCODED);
+ return httpRequest;
}
- return httpRequest;
}
/** {@inheritDoc} */
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementFetchingStrategy.java
index 41069f8..1c413e7 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementFetchingStrategy.java
@@ -17,19 +17,29 @@ package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate;
import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
+import java.nio.charset.StandardCharsets;
import java.time.Instant;
+import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.Optional;
+import java.util.function.BiConsumer;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.apache.hc.client5.http.classic.methods.HttpGet;
+import org.apache.hc.client5.http.classic.methods.HttpPost;
+import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
import org.apache.hc.core5.http.ClassicHttpRequest;
import org.apache.hc.core5.http.ClassicHttpResponse;
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.HttpRequest;
+import org.apache.hc.core5.http.NameValuePair;
import org.apache.hc.core5.http.ProtocolException;
import org.apache.hc.core5.http.io.entity.EntityUtils;
+import org.apache.hc.core5.http.message.BasicNameValuePair;
import org.apache.hc.core5.net.URIBuilder;
import org.slf4j.Logger;
@@ -40,6 +50,7 @@ import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
@@ -130,10 +141,17 @@ public class DefaultSubordinateStatementFetchingStrategy
log.error("Could not resolve entity configuration for issuer {}", issuerEntityId);
return null;
}
- final Map<String, Object> federationEntity =
+ final EntityStatement<?> issuerStatement =
Optional.ofNullable(issuerStatements.get(0).getStatement())
.filter(statement -> statement instanceof EntityStatement<?>)
.map(statement -> (EntityStatement<?>) statement)
+ .orElse(null);
+ if (issuerStatement == null) {
+ log.warn("Could not resolve entity configuration for issuer {}", issuerEntityId);
+ return null;
+ }
+ final Map<String, Object> federationEntity =
+ Optional.of(issuerStatement)
.map(statement -> statement.getParsedPayload().getMetadata())
.map(metadata -> metadata.getFederationEntityMetadata())
.orElse(null);
@@ -142,16 +160,30 @@ public class DefaultSubordinateStatementFetchingStrategy
return null;
}
if (federationEntity.get("federation_fetch_endpoint") instanceof String endpoint) {
- final HttpGet httpRequest = new HttpGet(endpoint);
- try {
- final URI uri =
- new URIBuilder(httpRequest.getUri()).addParameter("sub", id.getSubject()).build();
- httpRequest.setUri(uri);
- log.debug("URI set to {}", uri);
- } catch (final URISyntaxException e) {
- log.error("Could not create URI with the given parameters {}", issuerEntityId, e);
+ final BiConsumer<HttpRequest, List<NameValuePair>> clientAuthentication =
+ getClientAuthentication(new CriteriaSet(
+ new FederationEndpointEntityStatementCriterion(issuerStatement)));
+ if (clientAuthentication == null) {
+ final HttpGet httpRequest = new HttpGet(endpoint);
+ try {
+ final URI uri =
+ new URIBuilder(httpRequest.getUri()).addParameter("sub", id.getSubject()).build();
+ httpRequest.setUri(uri);
+ } catch (final URISyntaxException e) {
+ log.error("Could not create URI with the given parameters {}", issuerEntityId, e);
+ }
+ return httpRequest;
+ } else {
+ final HttpPost httpRequest = new HttpPost(endpoint);
+ final List<NameValuePair> parameters = new ArrayList<>(
+ List.of(new BasicNameValuePair("sub", id.getSubject())));
+ clientAuthentication.accept(httpRequest, parameters);
+ final UrlEncodedFormEntity urlEncodedFormEntity = new UrlEncodedFormEntity(parameters,
+ StandardCharsets.UTF_8);
+ httpRequest.setEntity(urlEncodedFormEntity);
+ httpRequest.setHeader(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_FORM_URLENCODED);
+ return httpRequest;
}
- return httpRequest;
} else {
log.warn("Could not parse federation_fetch_endpoint for {}", issuerEntityId);
}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkFetchingStrategy.java
index d753486..0797763 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkFetchingStrategy.java
@@ -17,16 +17,23 @@ package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
+import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.util.ArrayList;
import java.util.List;
+import java.util.function.BiConsumer;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.apache.hc.client5.http.classic.methods.HttpGet;
+import org.apache.hc.client5.http.classic.methods.HttpPost;
+import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
import org.apache.hc.core5.http.ClassicHttpRequest;
import org.apache.hc.core5.http.ClassicHttpResponse;
+import org.apache.hc.core5.http.ContentType;
+import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.HttpRequest;
import org.apache.hc.core5.http.NameValuePair;
import org.apache.hc.core5.http.ProtocolException;
import org.apache.hc.core5.http.io.entity.EntityUtils;
@@ -81,17 +88,29 @@ public class DefaultTrustMarkFetchingStrategy
/** {@inheritDoc} */
@Nullable protected ClassicHttpRequest initializeHttpRequest(@Nonnull final CriteriaSet criteria,
@Nonnull TrustMarkCacheIdentifier request) {
- final HttpGet httpRequest = new HttpGet(request.getEndpoint());
final List<NameValuePair> nvps = new ArrayList<>();
nvps.add(new BasicNameValuePair("trust_mark_type", request.getTrustMarkType()));
nvps.add(new BasicNameValuePair("sub", request.getSubject()));
- try {
- final URI uri = new URIBuilder(httpRequest.getUri()).addParameters(nvps).build();
- httpRequest.setUri(uri);
- } catch (final URISyntaxException e) {
- log.error("Could not create URI with the given parameters {}", request, e);
+ final BiConsumer<HttpRequest,List<NameValuePair>> clientAuthentication = getClientAuthentication(criteria);
+ if (clientAuthentication == null) {
+ final HttpGet httpRequest = new HttpGet(request.getEndpoint());
+ try {
+ final URI uri = new URIBuilder(httpRequest.getUri()).addParameters(nvps).build();
+ httpRequest.setUri(uri);
+ } catch (final URISyntaxException e) {
+ log.error("Could not create URI with the given parameters {}", request, e);
+ }
+ return httpRequest;
+ } else {
+ final HttpPost httpRequest = new HttpPost(request.getEndpoint());
+ httpRequest.setHeader(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_FORM_URLENCODED);
+ clientAuthentication.accept(httpRequest, nvps);
+ final UrlEncodedFormEntity urlEncodedFormEntity = new UrlEncodedFormEntity(
+ nvps, StandardCharsets.UTF_8);
+ httpRequest.setEntity(urlEncodedFormEntity);
+ return httpRequest;
}
- return httpRequest;
+
}
/** {@inheritDoc} */
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkStatusFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkStatusFetchingStrategy.java
index c4b01c2..2ab0f98 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkStatusFetchingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkStatusFetchingStrategy.java
@@ -19,6 +19,7 @@ import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.util.ArrayList;
import java.util.List;
+import java.util.function.BiConsumer;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -29,6 +30,7 @@ import org.apache.hc.core5.http.ClassicHttpRequest;
import org.apache.hc.core5.http.ClassicHttpResponse;
import org.apache.hc.core5.http.ContentType;
import org.apache.hc.core5.http.HttpHeaders;
+import org.apache.hc.core5.http.HttpRequest;
import org.apache.hc.core5.http.NameValuePair;
import org.apache.hc.core5.http.ProtocolException;
import org.apache.hc.core5.http.io.entity.EntityUtils;
@@ -87,6 +89,10 @@ public class DefaultTrustMarkStatusFetchingStrategy
final HttpPost httpRequest = new HttpPost(identifier.getEndpoint());
final List<NameValuePair> nvps = new ArrayList<>();
nvps.add(new BasicNameValuePair("trust_mark", identifier.getTrustMark().serialize()));
+ final BiConsumer<HttpRequest,List<NameValuePair>> clientAuthentication = getClientAuthentication(criteria);
+ if (clientAuthentication != null) {
+ clientAuthentication.accept(httpRequest, nvps);
+ }
final UrlEncodedFormEntity urlEncodedFormEntity = new UrlEncodedFormEntity(nvps, StandardCharsets.UTF_8);
httpRequest.setEntity(urlEncodedFormEntity);
httpRequest.setHeader(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_FORM_URLENCODED);
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java
index a095edc..1f2fc19 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java
@@ -14,14 +14,12 @@
package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util;
-import java.net.URI;
import java.text.ParseException;
import java.time.Instant;
import java.util.ArrayList;
import java.util.Comparator;
import java.util.List;
import java.util.Objects;
-import java.util.Optional;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -36,16 +34,11 @@ import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.EntityConfigurationImpl;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.SubordinateStatementImpl;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
/**
* Static utility method related to entity statements.
@@ -78,38 +71,6 @@ public class EntityStatementHelper {
return entityStatement == null ? null : entityStatement.getJwt().serialize();
}
- /**
- * Fetch the endpoint URI for the given endpoint ID from a federation_entity metadata. The entity statement is
- * fetched from the given cache by using the given entity ID as {@link SubjectEntityIDCriterion}.
- *
- * @param cache metadata cache used for fetching the entity configuration
- * @param entityId entity ID of the entity
- * @param endpointId the endpoint ID
- * @return endpoint URI
- */
- @Nullable public static URI fetchEndpointUriFromFederationEntity(
- @Nonnull MetadataCache<EntityConfigurationContainer> cache,
- @Nonnull final String entityId, @Nonnull final String endpointId) {
- final CriteriaSet criteria = new CriteriaSet(new SubjectEntityIDCriterion(entityId));
- try {
- final List<EntityConfigurationContainer> result = cache.get(criteria);
- if (!result.isEmpty()) {
- return Optional.ofNullable(result.get(0).getStatement())
- .map(statement -> statement.getParsedPayload().getMetadata())
- .map(metadata -> metadata.getFederationEntityMetadata())
- .map(map -> map.get(endpointId))
- .filter(String.class::isInstance)
- .map(String.class::cast)
- .map(URI::create)
- .orElse(null);
- }
- } catch (final MetadataCacheException e) {
- log.debug("Error while fetching entity configuration for {}", entityId, e);
- }
- log.warn("Could not fetch entity configuration for {}", entityId);
- return null;
- }
-
/**
* Get the list of entity IDs of the entities in the given trust chain. The first item is the entity ID of the
* leaf entity.
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
index fc0fb5b..25a8b96 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
@@ -47,6 +47,7 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponse;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
@@ -388,14 +389,21 @@ public class CallResolveEntityApi extends AbstractProfileAction {
try {
configurationCacheResult = entityConfigurationCache.get(criteria);
} catch (final MetadataCacheException e) {
+ log.warn("{} Could not resolve entity configuration for {}", getLogPrefix(), trustedEntity, e);
continue;
}
if (configurationCacheResult.isEmpty()) {
log.warn("{} Could not resolve entity configuration for {}", getLogPrefix(), trustedEntity);
continue;
}
- final URI uri = Optional.ofNullable(configurationCacheResult.get(0).getStatement())
- .map(statement -> statement.getParsedPayload().getMetadata())
+ final EntityConfiguration configuration =
+ Optional.ofNullable(configurationCacheResult.get(0).getStatement())
+ .orElse(null);
+ if (configuration == null) {
+ log.warn("{} Could not resolve entity configuration for {}", getLogPrefix(), trustedEntity);
+ continue;
+ }
+ final URI uri = Optional.of(configuration.getParsedPayload().getMetadata())
.map(metadata -> metadata.getFederationEntityMetadata())
.map(entityMetadata -> entityMetadata.get("federation_resolve_endpoint"))
.map(endpoint -> URI.create((String) endpoint))
@@ -413,6 +421,7 @@ public class CallResolveEntityApi extends AbstractProfileAction {
final CriteriaSet criteriaSet = new CriteriaSet();
baseCriteriaSet.forEach(c -> criteriaSet.add(c));
criteriaSet.add(new ResolveEntityCacheIdentifierCriterion(entityRequest));
+ criteriaSet.add(new FederationEndpointEntityStatementCriterion(configuration));
final List<ResolveEntityResponseContainer> cacheResult;
try {
cacheResult = resolveEntityTrustChainMetadataCache.get(criteriaSet);
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
index 0e22ad2..0c85835 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
@@ -17,6 +17,7 @@ package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
import java.net.URI;
import java.util.List;
import java.util.Map;
+import java.util.Optional;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -25,12 +26,14 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMark;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkContainer;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkCacheIdentifier;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkIdentifierCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteEntity;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
@@ -143,8 +146,33 @@ public class DefaultTrustMarkFromMetadataCacheFetchingFunction extends AbstractI
checkComponentActive();
final String entityId = trustedEntity.getEntityId();
assert entityConfigurationCache != null;
- final URI uri = EntityStatementHelper.fetchEndpointUriFromFederationEntity(entityConfigurationCache,
- entityId, "trust_mark_endpoint");
+ final CriteriaSet criteria = new CriteriaSet(new SubjectEntityIDCriterion(entityId));
+ final EntityConfiguration configuration;
+ try {
+ final List<EntityConfigurationContainer> result = entityConfigurationCache.get(criteria);
+ if (!result.isEmpty()) {
+ configuration = Optional.ofNullable(result.get(0).getStatement()).orElse(null);
+ } else {
+ return null;
+ }
+ } catch (final MetadataCacheException e) {
+ log.debug("Error while fetching entity configuration for {}", entityId, e);
+ return null;
+ }
+
+ if (configuration == null) {
+ log.warn("Could not fetch entity configuration for {}", entityId);
+ return null;
+ }
+
+ final URI uri = Optional.ofNullable(configuration.getParsedPayload().getMetadata())
+ .map(metadata -> metadata.getFederationEntityMetadata())
+ .map(map -> map.get("trust_mark_endpoint"))
+ .filter(String.class::isInstance)
+ .map(String.class::cast)
+ .map(URI::create)
+ .orElse(null);
+
if (uri == null) {
log.warn("Could not fetch trust mark endpoint for {}", entityId);
return null;
@@ -153,7 +181,8 @@ public class DefaultTrustMarkFromMetadataCacheFetchingFunction extends AbstractI
assert uriValue != null; assert trustMarkType != null; assert subject != null;
final TrustMarkCacheIdentifier trustMarkIdentifier =
new TrustMarkCacheIdentifier(uriValue, trustMarkType, subject);
- final CriteriaSet criteriaSet = new CriteriaSet(new TrustMarkIdentifierCriterion(trustMarkIdentifier));
+ final CriteriaSet criteriaSet = new CriteriaSet(new TrustMarkIdentifierCriterion(trustMarkIdentifier),
+ new FederationEndpointEntityStatementCriterion(configuration));
final List<TrustMarkContainer> cacheResult;
try {
cacheResult = trustMarkCache.get(criteriaSet);
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jose/impl/EndpointAuthenticationSignatureSigningParametersResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jose/impl/EndpointAuthenticationSignatureSigningParametersResolver.java
new file mode 100644
index 0000000..0630c0b
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jose/impl/EndpointAuthenticationSignatureSigningParametersResolver.java
@@ -0,0 +1,117 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oidfed.security.jose.impl;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion;
+import net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver;
+import net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver;
+import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.resolver.CriteriaSet;
+
+/**
+ * An implementation of an {@link SignatureSigningParametersResolver} that extends the {@link
+ * BasicSignatureSigningParametersResolver} functionality by adding a configurable lookup strategy for fetching
+ * the desired algorithm value from {@link EntityStatement}. It is expected to be found from the criteria set.
+ */
+public class EndpointAuthenticationSignatureSigningParametersResolver extends BasicSignatureSigningParametersResolver
+ implements SignatureSigningParametersResolver {
+
+ /** Class logger.*/
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(EndpointAuthenticationSignatureSigningParametersResolver.class);
+
+ /** The default algorithm value used if lookup strategy returned null. */
+ @Nullable private final String defaultAlgorithmValue;
+
+ /**
+ * Constructor.
+ *
+ * @param defaultValue the default algorithm value used if lookup strategy returned null
+ */
+ public EndpointAuthenticationSignatureSigningParametersResolver(
+ @Nullable @ParameterName(name = "defaultAlgorithmValue") final String defaultValue) {
+ defaultAlgorithmValue = defaultValue;
+ }
+
+
+ /**
+ * Get the effective list of signature algorithm URIs to consider, including application of
+ * include/exclude policy.
+ *
+ * @param criteria the input criteria being evaluated
+ * @param includeExcludePredicate the include/exclude predicate to use
+ * @return the list of effective algorithm URIs
+ */
+ @Override
+ @Nonnull protected List<String> getEffectiveSignatureAlgorithms(@Nonnull final CriteriaSet criteria,
+ @Nonnull final Predicate<String> includeExcludePredicate) {
+ final List<String> accumulator = super.getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
+ final List<String> algorithms =
+ Optional.ofNullable(criteria.get(FederationEndpointEntityStatementCriterion.class))
+ .map(criterion -> criterion.getValue())
+ .map(statement -> statement.getParsedPayload().getMetadata())
+ .map(metadata -> metadata.getFederationEntityMetadata())
+ .map(entityMetadata -> entityMetadata.get("endpoint_auth_signing_alg_values_supported"))
+ .filter(algs -> algs instanceof List<?>)
+ .map(algs -> (List<?>) algs)
+ .map(algs -> algs.stream().filter(String.class::isInstance).map(String.class::cast).toList())
+ .orElse(null);
+ log.trace("Resolved algorithms via criteria set: {}", algorithms);
+ if (algorithms == null || algorithms.isEmpty()) {
+ if (StringSupport.trimOrNull(defaultAlgorithmValue) != null) {
+ log.debug("No algorithms resolved via criteria set, using default");
+ assert defaultAlgorithmValue != null;
+ return convertIntoListIfEnabled(defaultAlgorithmValue, accumulator);
+ }
+ log.error("No algorithms resolved via criteria set");
+ return CollectionSupport.emptyList();
+ }
+
+ final List<String> result = algorithms.stream().filter(algorithm -> accumulator.contains(algorithm)).toList();
+ assert result != null;
+ return result;
+ }
+
+ /**
+ * Returns the given algorithm in a {@link List} if it was enabled in the list of enabled algorithms. An empty
+ * list is returned if the algorithm was not enabled.
+ *
+ * @param algorithm the algorithm to be checked against the list
+ * @param enabledAlgorithms the list of enabled algorithms
+ * @return the given algorithm as list if it was enabled, or an empty list if not
+ */
+ @Nonnull protected List<String> convertIntoListIfEnabled(@Nonnull final String algorithm,
+ @Nonnull final List<String> enabledAlgorithms) {
+ if (enabledAlgorithms.contains(algorithm)) {
+ return CollectionSupport.listOf(algorithm);
+ } else {
+ log.warn("The algorithm {} is not enabled, returning empty list", algorithm);
+ return CollectionSupport.emptyList();
+ }
+ }
+}
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 1820bdd..23aaaba 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -282,10 +282,44 @@
</constructor-arg>
</bean>
</property>
+ <property name="clientAuthenticationLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
+ p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
+ <property name="supportedAuthenticationMethodsLookupStrategy">
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_fetch_endpoint_auth_methods')" />
+ </property>
+ </bean>
+ </property>
</bean>
</property>
</bean>
+ <util:list id="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultPrivateKeyJwtClientAuthenticationFunction"
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}">
+ <property name="typeHeaderLookupStrategy">
+ <bean parent="shibboleth.Functions.Expression" c:expression="#null" />
+ </property>
+ <property name="audienceLookupStrategy">
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getSubject()" />
+ </property>
+ <property name="issuerLookupStrategy">
+ <bean parent="shibboleth.Functions.Constant"
+ c:target-ref="shibboleth.oidc.issuer" />
+ </property>
+ <property name="securityConfigurationLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultAuthenticationSecurityConfigurationLookupFunction"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyResolverService" />
+ </property>
+ <property name="signatureSigningParametersResolver">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jose.impl.EndpointAuthenticationSignatureSigningParametersResolver">
+ <constructor-arg index="0" value="%{idp.oidfed.cache.clientauthentication.jwt.defaultalg:RS256}" />
+ </bean>
+ </property>
+ </bean>
+ </util:list>
+
+
<bean id="shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator">
<property name="claimValidators">
@@ -457,6 +491,14 @@
</constructor-arg>
</bean>
</property>
+ <property name="clientAuthenticationLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
+ p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
+ <property name="supportedAuthenticationMethodsLookupStrategy">
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_resolve_entity_endpoint_auth_methods')" />
+ </property>
+ </bean>
+ </property>
</bean>
</property>
</bean>
@@ -590,6 +632,14 @@
</constructor-arg>
</bean>
</property>
+ <property name="clientAuthenticationLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
+ p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
+ <property name="supportedAuthenticationMethodsLookupStrategy">
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_trust_mark_status_endpoint_auth_methods')" />
+ </property>
+ </bean>
+ </property>
</bean>
</property>
</bean>
@@ -681,6 +731,14 @@
</constructor-arg>
</bean>
</property>
+ <property name="clientAuthenticationLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
+ p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
+ <property name="supportedAuthenticationMethodsLookupStrategy">
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_trust_mark_endpoint_auth_methods')" />
+ </property>
+ </bean>
+ </property>
</bean>
</property>
</bean>
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
index 76a68c1..9b505f8 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
@@ -48,6 +48,7 @@ import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
@@ -106,6 +107,52 @@ public class SubordinateStatementMetadataCacheTest extends AbstractFederationFlo
}
}
+ @Test
+ public void testValidSubordinateStatement_clientAuthentication()
+ throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
+ final String entityId = uniqueClientId();
+ final String intermediateId = uniqueIntermediateId();
+ final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder().issuer(intermediateId).subject(entityId)
+ .issueTime(Date.from(Instant.now()))
+ .expirationTime(Date.from(Instant.now().plusSeconds(300)))
+ .claim("jwks", new JWKSet(leafKey).toJSONObject(true))
+ .claim("metadata", Map.of("federation_entity", Collections.emptyMap()));
+ final String subordinateStatement = TrustChainTestUtil.signedJwt(
+ JWSAlgorithm.RS256, intermediateKey, "entity-statement+jwt", builder.build()).serialize();
+
+ final JWTClaimsSet.Builder ecBuilder = new JWTClaimsSet.Builder().issuer(intermediateId).subject(intermediateId)
+ .issueTime(Date.from(Instant.now()))
+ .expirationTime(Date.from(Instant.now().plusSeconds(300)))
+ .claim("jwks", new JWKSet(intermediateKey).toJSONObject(true))
+ .claim("metadata", Map.of("federation_entity", Map.of(
+ "federation_fetch_endpoint", intermediateId + "/fetch",
+ "federation_fetch_endpoint_auth_methods", List.of("private_key_jwt"),
+ "endpoint_auth_signing_alg_values_supported", List.of("ES512"))));
+ final EntityStatement<?> intermediateConfiguration =
+ TrustChainTestUtil.entityStatement(JWSAlgorithm.RS256, intermediateKey, ecBuilder.build());
+
+
+ mapResponse(entityConfigurationUrl(intermediateId), mockResponse(intermediateConfiguration.getJwt().serialize()));
+ // raw anchorFetchEndpoint URL as the request is POST
+ mapResponse(intermediateId + "/fetch", mockResponse(subordinateStatement));
+
+ try {
+ final List<SubordinateStatementContainer> result =
+ subordinateStatementCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
+ new ResponseContainerExpirationCriterion(Instant.now().plusSeconds(300)),
+ new IssuerEntityIDCriterion(intermediateId)));
+ Assert.assertNotNull(result);
+ Assert.assertEquals(result.size(), 1);
+ final SubordinateStatement statement = result.get(0).getStatement();
+ Assert.assertNotNull(statement);
+ assert statement != null;
+ Assert.assertNull(statement.getParsedPayload().getCustomClaims()
+ .get(CustomSubordinateStatementFilterStrategy.CUSTOM_CLAIM_NAME));
+ } catch (MetadataCacheException e) {
+ Assert.fail("Could not resolve entity configuration", e);
+ }
+ }
+
@Test
public void testValidSubordinateStatement_customCriticalClaim()
throws MetadataCacheException, UnsupportedOperationException, IOException, URISyntaxException {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list