[java-plugin-shibd-oidc] 01/04: WIP: Early, successful so far, attempt to replace signing cred resolver
Codeberg
noreply at shibboleth.net
Mon Aug 3 13:09:57 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/JSHIBDOIDC-31-cred-resolver
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/deba0cf457b49f1d7a1b1fa4204fcd6e7518b616
commit deba0cf457b49f1d7a1b1fa4204fcd6e7518b616
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jul 29 17:32:33 2026 +0100
WIP: Early, successful so far, attempt to replace signing cred resolver
- Use the CredentialResolver via the signing config bridge
- No change yet to pulling the client_secret from the profile config.
this only replaces the assymetric keys.
---
pom.xml | 5 ++
sp-oidc-conf-impl/pom.xml | 5 ++
.../META-INF/net.shibboleth.idp/postconfig.xml | 2 +-
.../net/shibboleth/sp/service/agent/postconfig.xml | 85 +++++++++++--------
.../sp/service/credentials/postconfig.xml | 46 +++++++++++
.../oidc/flows/OIDCSessionInitiatorFlowTest.java | 10 +--
sp-oidc-impl/pom.xml | 5 ++
.../impl/BasicSignatureSigningConfiguration.java | 94 ++++++++++++++++++++++
8 files changed, 211 insertions(+), 41 deletions(-)
diff --git a/pom.xml b/pom.xml
index a473a53..e83c15c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -164,6 +164,11 @@ copyright/license information. -->
<groupId>${oidc-common.groupId}</groupId>
<artifactId>oidc-common-profile-impl</artifactId>
<version>${oidc-common.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-saml-api</artifactId>
+ <version>${oidc-common.version}</version>
</dependency>
<!-- Import Dependencies: Shib-Metadata/Attribute/Profile -->
<dependency>
diff --git a/sp-oidc-conf-impl/pom.xml b/sp-oidc-conf-impl/pom.xml
index 2a4f2bd..ef3a122 100644
--- a/sp-oidc-conf-impl/pom.xml
+++ b/sp-oidc-conf-impl/pom.xml
@@ -118,6 +118,11 @@
<artifactId>oidc-common-profile-impl</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-saml-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>${opensaml.groupId}</groupId>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 4256b8b..36aa329 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -96,7 +96,7 @@
c:_0="token" c:_1="SAML:" /> -->
<bean p:id="sp/logout/consumer/oidc/redirect" class="net.shibboleth.sp.profile.BasicLogoutConsumerFlowDescriptor">
- <!-- <property name="activationCondition">
+ <!-- TODO <property name="activationCondition">
<bean parent="shibboleth.Conditions.OR">
<constructor-arg>
<list>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index 6b38143..7878a00 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -52,32 +52,11 @@
p:httpClient="#{getObject('%{sp.oidc.HttpClient:}') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('%{sp.oidc.httpClientSecurityParameters:}')}" />
- <!--
- Security Configuration Defaults. These settings establish the default security configurations for
- signatures and loads the default credentials used.
- -->
- <bean id="shibboleth.oidc.BasicSignatureValidationConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
-
- <bean id="shibboleth.oidc.BasicSignatureSigningConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
-
- <bean id="shibboleth.oidc.BasicEncryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
-
- <bean id="shibboleth.oidc.BasicDecryptionConfiguration" abstract="true"
- class="net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration"
- p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
- p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
+ <!-- Profile Beans -->
<bean id="AbstractOIDCProfile" abstract="true"
- p:securityConfiguration-ref="%{sp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
+ p:securityConfiguration-ref="%{sp.oidc.security.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
<bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
p:issuer="#{getObject('shibboleth.oidc.issuer')}"
@@ -128,6 +107,43 @@
<util:constant id="OIDC.SSO.FEATURE_SCOPE"
static-field="net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.FEATURE_SCOPE"/>
+
+ <!--
+ Security Configuration Defaults. These settings establish the default security configurations for
+ signatures and loads the default credentials used.
+ -->
+ <bean id="shibboleth.oidc.BasicSignatureValidationConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicSignatureSigningConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicEncryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
+ <bean id="shibboleth.oidc.BasicDecryptionConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidc.IncludedEncryptionAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidc.ExcludedEncryptionAlgorithms')}" />
+
+
+ <!--
+ Bridging beans to link the basic security configuration to the CredentialResolver service to aquire credentials
+ -->
+
+ <bean id="shibboleth.sp.oidc.BasicSignatureSigningConfiguration" parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
+ class="net.shibboleth.sp.jose.config.impl.BasicSignatureSigningConfiguration"
+ c:resolver-ref="shibboleth.sp.CredentialResolverBridge" />
+
+ <!--
+ Security configuration beans.
+ -->
<bean id="shibboleth.oidc.DefaultSecurityConfiguration"
class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration" c:clockSkew="%{sp.policy.clockSkew:PT1M}">
@@ -141,22 +157,21 @@
</bean>
</constructor-arg>
<property name="jwtSignatureSigningConfiguration">
- <ref bean="#{'%{sp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
+ <ref bean="#{'%{sp.oidc.signing.config:shibboleth.sp.oidc.SigningConfiguration}'.trim()}" />
</property>
<property name="jwtEncryptionConfiguration">
- <ref bean="#{'%{sp.oidc.encryption.config:shibboleth.oidc.EncryptionConfiguration}'.trim()}" />
+ <ref bean="#{'%{sp.oidc.encryption.config:shibboleth.sp.oidc.EncryptionConfiguration}'.trim()}" />
</property>
<property name="jwtDecryptionConfiguration">
- <ref bean="#{'%{sp.oidc.decryption.config:shibboleth.oidc.DecryptionConfiguration}'.trim()}" />
+ <ref bean="#{'%{sp.oidc.decryption.config:shibboleth.sp.oidc.DecryptionConfiguration}'.trim()}" />
</property>
<property name="jwtSignatureValidationConfiguration">
- <ref bean="#{'%{sp.oidc.validation.config:shibboleth.oidc.SignatureValidationConfiguration}'.trim()}" />
+ <ref bean="#{'%{sp.oidc.validation.config:shibboleth.sp.oidc.SignatureValidationConfiguration}'.trim()}" />
</property>
</bean>
- <bean id="shibboleth.oidc.SigningConfiguration"
- parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.oidc.SigningCredentialsFactory">
+ <bean id="shibboleth.sp.oidc.SigningConfiguration"
+ parent="shibboleth.sp.oidc.BasicSignatureSigningConfiguration">
<property name="signatureAlgorithms">
<list>
<util:constant
@@ -187,7 +202,7 @@
</property>
</bean>
- <bean id="shibboleth.oidc.EncryptionConfiguration" parent="shibboleth.oidc.BasicEncryptionConfiguration"
+ <bean id="shibboleth.sp.oidc.EncryptionConfiguration" parent="shibboleth.oidc.BasicEncryptionConfiguration"
p:KEKCredentialResolver-ref="defaultOIDCKeyEncryptionCredentialResolver"
p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentEncryptionKeyCredentialResolver">
<property name="keyTransportEncryptionAlgorithms">
@@ -242,7 +257,7 @@
</property>
</bean>
- <bean id="shibboleth.oidc.SigningCredentialsFactory"
+ <bean id="shibboleth.sp.oidc.SigningCredentialsFactory"
class="net.shibboleth.oidc.profile.config.CredentialsListFactory"
c:_0="#{getObject('shibboleth.oidc.SigningCredentials')}" />
@@ -272,7 +287,7 @@
</constructor-arg>
</bean>
- <bean id="shibboleth.oidc.DecryptionConfiguration"
+ <bean id="shibboleth.sp.oidc.DecryptionConfiguration"
parent="shibboleth.oidc.BasicDecryptionConfiguration"
p:KEKCredentialResolver-ref="defaultOIDCKeyDecryptionCredentialResolver"
p:contentEncryptionKeyCredentialResolver-ref="defaultOIDCContentDecryptionKeyCredentialResolver">
@@ -310,7 +325,7 @@
</constructor-arg>
</bean>
- <bean id="shibboleth.oidc.SignatureValidationConfiguration"
+ <bean id="shibboleth.sp.oidc.SignatureValidationConfiguration"
parent="shibboleth.oidc.BasicSignatureValidationConfiguration"
p:signatureTrustEngine-ref="ExplicitKeySignedJWTTrustEngine"/>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml
new file mode 100644
index 0000000..67eab5f
--- /dev/null
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- Installs a "default" set of OIDC credentials into the resolver service. -->
+
+ <bean id="shibboleth.sp.oidc.DefaultCredentialResolver" class="net.shibboleth.sp.credential.impl.StaticCredentialResolver"
+ c:_0="#{getObject('shibboleth.sp.oidc.DefaultCredentials') ?: getObject('DefaultCredentials')}">
+ <property name="protocols">
+ <util:constant static-field="net.shibboleth.oidc.saml.xmlobject.Constants.OIDC_PROTOCOL_URI" />
+ </property>
+ </bean>
+
+ <bean id="DefaultCredentials" class="org.springframework.beans.factory.config.ListFactoryBean" lazy-init="true">
+ <property name="sourceList">
+ <list>
+
+ <!-- TODO p:usageType comes from the JWK use, not that specified, maybe this should be overriden if specified -->
+ <bean id="shibboleth.oidc.DefaultRSSigningCredential"
+ parent="shibboleth.oidc.JWKCredential"
+ p:resource="%{sp.oidc.signing.rs.key:#{null}}"
+ p:throwIfNull="false" />
+
+ <bean id="shibboleth.oidc.DefaultESSigningCredential"
+ parent="shibboleth.oidc.JWKCredential"
+ p:resource="%{sp.oidc.signing.es.key:#{null}}"
+ p:throwIfNull="false" />
+
+ <bean id="shibboleth.oidc.DefaultRSAEncryptionCredential"
+ parent="shibboleth.oidc.JWKCredential"
+ p:resource="%{sp.oidc.encryption.rsa.key:#{null}}" p:throwIfNull="false" />
+ </list>
+ </property>
+ </bean>
+
+</beans>
\ No newline at end of file
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
index 6d2f2ca..b8f99ef 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
@@ -226,7 +226,7 @@ public class OIDCSessionInitiatorFlowTest extends AbstractSPFlowTest {
* @throws MessageDecodingException
*/
@Test
- public void testFlowWithState() throws IOException, MessageDecodingException {
+ public void testFlowWithState_WithRO() throws IOException, MessageDecodingException {
setDefaultAuth();
final DDF input = new DDF(null).structure();
@@ -249,7 +249,7 @@ public class OIDCSessionInitiatorFlowTest extends AbstractSPFlowTest {
* @throws Exception on error
*/
@Test
- public void testForceAuthnFromAgent() throws Exception {
+ public void testForceAuthnFromAgent_WithRO() throws Exception {
setDefaultAuth();
final DDF input = new DDF(null).structure();
@@ -274,7 +274,7 @@ public class OIDCSessionInitiatorFlowTest extends AbstractSPFlowTest {
* @throws Exception on error
*/
@Test
- public void testMaxAgeFromAgent() throws Exception {
+ public void testMaxAgeFromAgent_WithRO() throws Exception {
setDefaultAuth();
final DDF input = new DDF(null).structure();
@@ -298,7 +298,7 @@ public class OIDCSessionInitiatorFlowTest extends AbstractSPFlowTest {
* @throws Exception on error
*/
@Test
- public void testPromptFromAgent() throws Exception {
+ public void testPromptFromAgent_WithRO() throws Exception {
setDefaultAuth();
final DDF input = new DDF(null).structure();
@@ -322,7 +322,7 @@ public class OIDCSessionInitiatorFlowTest extends AbstractSPFlowTest {
* @throws Exception on error
*/
@Test
- public void testACRFromAgent() throws Exception {
+ public void testACRFromAgent_WithRO() throws Exception {
setDefaultAuth();
final DDF input = new DDF(null).structure();
diff --git a/sp-oidc-impl/pom.xml b/sp-oidc-impl/pom.xml
index 63e1f58..d6085be 100644
--- a/sp-oidc-impl/pom.xml
+++ b/sp-oidc-impl/pom.xml
@@ -91,6 +91,11 @@
<artifactId>oidc-common-profile-impl</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-saml-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>${shib-profile.groupId}</groupId>
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/jose/config/impl/BasicSignatureSigningConfiguration.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/jose/config/impl/BasicSignatureSigningConfiguration.java
new file mode 100644
index 0000000..0389a7d
--- /dev/null
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/jose/config/impl/BasicSignatureSigningConfiguration.java
@@ -0,0 +1,94 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.jose.config.impl;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.saml.criterion.ProtocolCriterion;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.CredentialResolver;
+import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.UsageCriterion;
+import org.slf4j.Logger;
+
+import net.shibboleth.oidc.saml.xmlobject.Constants;
+import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.resolver.CriteriaSet;
+import net.shibboleth.shared.resolver.ResolverException;
+
+/**
+ * Subclass of OpenSAML version to provide support for CredentialResolver service
+ * through a bridging class.
+ *
+ * <p>This class currently assumes SAML protocol usage when resolving credentials.</p>
+ */
+public class BasicSignatureSigningConfiguration
+ extends net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(BasicSignatureSigningConfiguration.class);
+
+ /** Bridge to resolve credentials. */
+ @Nonnull private final CredentialResolver credentialResolver;
+
+ /**
+ * Constructor.
+ *
+ * @param resolver a credential resolver service to use
+ */
+ public BasicSignatureSigningConfiguration(
+ @Nonnull @ParameterName(name="resolver") final CredentialResolver resolver) {
+ credentialResolver = Constraint.isNotNull(resolver, "CredentialResolver cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nonnull @Unmodifiable @NotLive public List<Credential> getSigningCredentials() {
+ final List<Credential> hardwired = super.getSigningCredentials();
+ if (!hardwired.isEmpty()) {
+ return hardwired;
+ }
+
+ // Resolve if possible using: TODO
+ // * UsageType = SIGNING
+ // * Class = X509Credential
+ // * Protocol = if set
+
+ final CriteriaSet criteria = new CriteriaSet(new UsageCriterion(UsageType.SIGNING),
+ new ProtocolCriterion(Constants.OIDC_PROTOCOL_URI));
+
+ try {
+ final Iterable<Credential> creds = credentialResolver.resolve(criteria);
+ final ArrayList<Credential> accumulator = new ArrayList<>();
+ creds.forEach(accumulator::add);
+ log.debug("Resolved {} signing key(s)", accumulator.size());
+ return accumulator;
+ } catch (final ResolverException e) {
+ log.error("Exception resolving signing credentials", e);
+ }
+
+ log.debug("Resolved 0 signing key(s)");
+ return CollectionSupport.emptyList();
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list