[java-oidfed-common] branch main updated: Simplify trust mark wiring to the entity configuration
Codeberg
noreply at shibboleth.net
Thu Aug 27 11:07:00 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-oidfed-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/0d95ccb5533bcfb5f20cd21717ece9446b392da8
The following commit(s) were added to refs/heads/main by this push:
new 0d95ccb Simplify trust mark wiring to the entity configuration
0d95ccb is described below
commit 0d95ccb5533bcfb5f20cd21717ece9446b392da8
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Aug 27 14:06:23 2026 +0300
Simplify trust mark wiring to the entity configuration
- Global generic abstract bean "shibboleth.oidfed.TrustedRemoteEntity" for trusted entities
- Global abstract beans "shibboleth.oidfed.RemoteTrustMark" and "..ConstantTrustMark"
- Wiring example in oidfed-common-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 10 +--
.../idp/service/relying-party/postconfig.xml | 8 +++
.../oidfed/oidfed-entity-configuration-claims.xml | 42 ++++--------
.../impl/DefaultConstantTrustMarkFunction.java | 79 ++++++++++++++++++++++
...TrustMarkFromMetadataCacheFetchingFunction.java | 26 +++----
5 files changed, 120 insertions(+), 45 deletions(-)
diff --git a/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 90e36b2..1b2e5d9 100644
--- a/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -1038,6 +1038,12 @@
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"
p:trustMarkCache-ref="shibboleth.oidfed.TrustMarkMetadataCache"/>
+ <bean id="shibboleth.oidfed.ConstantTrustMark" abstract="true"
+ class="net.shibboleth.oidfed.profile.impl.DefaultConstantTrustMarkFunction"/>
+
+ <bean id="shibboleth.oidfed.TrustedRemoteEntity" abstract="true"
+ class="net.shibboleth.oidfed.profile.TrustedRemoteEntity"/>
+
<bean id="shibboleth.oidfed.DefaultPostResponseAuditExtractors"
class="org.springframework.beans.factory.config.MapFactoryBean">
<property name="sourceMap">
@@ -1046,10 +1052,6 @@
</property>
</bean>
- <bean id="DefaultTrustAnchorHintsLookupStrategy"
- class="net.shibboleth.oidfed.profile.navigate.DefaultTrustAnchorHintsLookupStrategy"
- p:trustAnchorsCache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache"/>
-
<bean parent="shibboleth.AdminFlow"
c:id="http://shibboleth.net/ns/profiles/oidfed/test-trust-chain-resolution"
p:loggingId="%{idp.oidfed.admin.resolvertest.logging:TestTrustChainResolver}"
diff --git a/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index a877910..d7ec795 100644
--- a/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -103,6 +103,14 @@
p:includedAlgorithms="#{getObject('shibboleth.oidfed.IncludedSignatureAlgorithms')}"
p:excludedAlgorithms="#{getObject('shibboleth.oidfed.ExcludedSignatureAlgorithms')}" />
+ <bean id="DefaultTrustAnchorHintsLookupStrategy"
+ class="net.shibboleth.oidfed.profile.navigate.DefaultTrustAnchorHintsLookupStrategy"
+ p:trustAnchorsCache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache"/>
+
+ <bean id="DefaultTrustMarksLookupStrategy"
+ class="net.shibboleth.oidfed.profile.navigate.DefaultEntityConfigurationTrustMarksLookupStrategy"
+ p:trustMarkLookupStrategies-ref="shibboleth.oidfed.DefaultTrustMarkLookupStrategies"/>
+
<import resource="${idp.home}/conf/oidfed/oidfed-entity-configuration-claims.xml"/>
</beans>
diff --git a/oidfed-common-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml b/oidfed-common-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml
index 9a2accb..90d6626 100644
--- a/oidfed-common-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml
+++ b/oidfed-common-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml
@@ -9,36 +9,22 @@
default-init-method="initialize" default-destroy-method="destroy">
- <bean id="ExampleTrustedTrustMarkIssuer"
- class="net.shibboleth.oidfed.profile.TrustedRemoteEntity"
- c:entity="https://dyn-trust-mark-issuer.federation.local"/>
-
<util:map id="shibboleth.oidfed.EntityConfigurationClaimsLookupStrategies"
value-type="java.util.function.Function">
- <entry key="trust_anchor_hints" value-ref="#{'%{idp.oidfed.entity-configuration.trustAnchoHintsLookup:DefaultTrustAnchorHintsLookupStrategy}'.trim()}"/>
- <entry key="trust_marks">
- <bean class="net.shibboleth.oidfed.profile.navigate.DefaultEntityConfigurationTrustMarksLookupStrategy">
- <property name="trustMarkLookupStrategies">
- <util:list value-type="java.util.function.Function">
- <bean parent="shibboleth.oidfed.RemoteTrustMark"
- p:trustMarkType="https://dyn-trust-mark-issuer.federation.local/example"
- p:trustedEntity-ref="ExampleTrustedTrustMarkIssuer" />
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg name="target">
- <util:map key-type="java.lang.String" value-type="java.lang.String">
- <entry
- key="trust_mark_type"
- value="https://example.org/a-trust-mark" />
- <entry
- key="trust_mark"
- value="eyJraWQiOiJtb2NrVHJ1c3RNYXJrSXNzdWVyS2V5IiwidHlwIjoidHJ1c3QtbWFyaytqd3QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RydXN0LW1hcmstaXNzdWVyLmZlZGVyYXRpb24ubG9jYWwiLCJzdWIiOiJodHRwczovL29wLmV4YW1wbGUub3JnIiwidHJ1c3RfbWFya190eXBlIjoiaHR0cHM6Ly9leGFtcGxlLm9yZy9hLXRydXN0LW1hcmsiLCJleHAiOjQ5MTgzNjczMzYsImlhdCI6MTc2NDc2NzMzNn0.smmtxeU_vCh2XFHLCxGHtwr_ZQ9A0-T7V9Poq5tNqwuU7_QlMAUJG1CJcprqQ9hH2oNSSQPIfUk7fOB1VUEY66U_bGBQ-KNQiIj-j25IQs7JalOCT1qjzcsMkq6i [...]
- </util:map>
- </constructor-arg>
- </bean>
- </util:list>
- </property>
- </bean>
- </entry>
+ <entry key="trust_anchor_hints" value-ref="#{'%{idp.oidfed.entity-configuration.trustAnchoHintsLookupStrategy:DefaultTrustAnchorHintsLookupStrategy}'.trim()}"/>
+ <entry key="trust_marks" value-ref="#{'%{idp.oidfed.entity-configuration.trustMarksLookupStrategy:DefaultTrustMarksLookupStrategy}'.trim()}"/>
</util:map>
+ <util:list id="shibboleth.oidfed.DefaultTrustMarkLookupStrategies" value-type="java.util.function.Function">
+ <bean parent="shibboleth.oidfed.RemoteTrustMark"
+ p:trustMarkType="https://dyn-trust-mark-issuer.federation.local/example">
+ <property name="trustMarkIssuer">
+ <bean parent="shibboleth.oidfed.TrustedRemoteEntity"
+ c:entity="https://dyn-trust-mark-issuer.federation.local" />
+ </property>
+ </bean>
+ <bean parent="shibboleth.oidfed.ConstantTrustMark"
+ p:trustMark="eyJraWQiOiJtb2NrVHJ1c3RNYXJrSXNzdWVyS2V5IiwidHlwIjoidHJ1c3QtbWFyaytqd3QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RydXN0LW1hcmstaXNzdWVyLmZlZGVyYXRpb24ubG9jYWwiLCJzdWIiOiJodHRwczovL29wLmV4YW1wbGUub3JnIiwidHJ1c3RfbWFya190eXBlIjoiaHR0cHM6Ly9leGFtcGxlLm9yZy9hLXRydXN0LW1hcmsiLCJleHAiOjQ5MTgzNjczMzYsImlhdCI6MTc2NDc2NzMzNn0.smmtxeU_vCh2XFHLCxGHtwr_ZQ9A0-T7V9Poq5tNqwuU7_QlMAUJG1CJcprqQ9hH2oNSSQPIfUk7fOB1VUEY66U_bGBQ-KNQiIj-j25IQs7JalOCT1qjzcsMkq6ihdOI4sQnTrxfJNpAz5LLgb [...]
+ </util:list>
+
</beans>
\ No newline at end of file
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultConstantTrustMarkFunction.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultConstantTrustMarkFunction.java
new file mode 100644
index 0000000..51f8ecf
--- /dev/null
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultConstantTrustMarkFunction.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidfed.profile.impl;
+
+import java.text.ParseException;
+import java.util.Map;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import com.nimbusds.jwt.SignedJWT;
+
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+/**
+ * Function to define a constant/static trust mark.
+ */
+public class DefaultConstantTrustMarkFunction extends AbstractIdentifiableInitializableComponent
+ implements Function<ProfileRequestContext, Map<String, String>> {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(DefaultConstantTrustMarkFunction.class);
+
+ /** Trust mark value. */
+ @NonnullAfterInit private String trustMark;
+
+ /**
+ * Set the trust mark.
+ *
+ * @param tm trust mark
+ */
+ public void setTrustMark(@Nonnull @NotEmpty final String tm) {
+ checkSetterPreconditions();
+ trustMark = Constraint.isNotEmpty(tm, "Trust mark cannot be empty");
+ }
+
+ /** {@inheritDoc} */
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+ if (trustMark == null) {
+ throw new ComponentInitializationException("Trust mark cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override @Nullable
+ public Map<String, String> apply(@Nullable final ProfileRequestContext profileRequestContext) {
+ checkComponentActive();
+ try {
+ final SignedJWT jwt = SignedJWT.parse(trustMark);
+ final String trustMarkType = jwt.getJWTClaimsSet().getStringClaim("trust_mark_type");
+ return Map.of("trust_mark_type", trustMarkType, "trust_mark", trustMark);
+ } catch (final ParseException e) {
+ log.error("Could not parse JWT from the given trust mark {}", trustMark);
+ }
+ return null;
+ }
+}
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
index 6e2bfcf..286fc0d 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
@@ -47,7 +47,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
/**
* Function to fetch a trust mark from the configured cache of trust marks. The configurable cache is used for
- * fetching the trust_mark_endpoint of the trusted entity.
+ * fetching the federation_trust_mark_endpoint of the trust mark issuer.
*/
public class DefaultTrustMarkFromMetadataCacheFetchingFunction extends AbstractIdentifiableInitializableComponent
implements Function<ProfileRequestContext, Map<String, String>> {
@@ -61,8 +61,8 @@ public class DefaultTrustMarkFromMetadataCacheFetchingFunction extends AbstractI
/** Cache containing responses from Trust Mark APIs. */
@NonnullAfterInit private MetadataCache<TrustMarkContainer> trustMarkCache;
- /** Trusted trust mark API entity. */
- @NonnullAfterInit private TrustedRemoteEntity trustedEntity;
+ /** Trusted trust mark issuer entity. */
+ @NonnullAfterInit private TrustedRemoteEntity trustMarkIssuer;
/** Trust mark type. */
@NonnullAfterInit private String trustMarkType;
@@ -91,13 +91,13 @@ public class DefaultTrustMarkFromMetadataCacheFetchingFunction extends AbstractI
}
/**
- * Set the trusted trust mark API entity.
+ * Set the trusted trust mark issuer entity.
*
- * @param entity trusted trust mark API entity
+ * @param entity trusted trust mark issuer entity
*/
- public void setTrustedEntity(@Nonnull final TrustedRemoteEntity entity) {
+ public void setTrustMarkIssuer(@Nonnull final TrustedRemoteEntity entity) {
checkSetterPreconditions();
- trustedEntity = Constraint.isNotNull(entity, "Trusted entity cannot be null");
+ trustMarkIssuer = Constraint.isNotNull(entity, "Trust mark issuer cannot be null");
}
/**
@@ -129,8 +129,8 @@ public class DefaultTrustMarkFromMetadataCacheFetchingFunction extends AbstractI
if (trustMarkCache == null) {
throw new ComponentInitializationException("Trust Mark cache cannot be null");
}
- if (trustedEntity == null) {
- throw new ComponentInitializationException("Trusted entity cannot be null");
+ if (trustMarkIssuer == null) {
+ throw new ComponentInitializationException("Trust mark issuer entity cannot be null");
}
if (trustMarkType == null) {
throw new ComponentInitializationException("Trust mark type cannot be null");
@@ -144,7 +144,7 @@ public class DefaultTrustMarkFromMetadataCacheFetchingFunction extends AbstractI
@Override @Nullable
public Map<String, String> apply(@Nullable final ProfileRequestContext profileRequestContext) {
checkComponentActive();
- final String entityId = trustedEntity.getEntityId();
+ final String entityId = trustMarkIssuer.getEntityId();
assert entityConfigurationCache != null;
final CriteriaSet criteria = new CriteriaSet(new SubjectEntityIDCriterion(entityId));
final EntityConfiguration configuration;
@@ -187,18 +187,18 @@ public class DefaultTrustMarkFromMetadataCacheFetchingFunction extends AbstractI
try {
cacheResult = trustMarkCache.get(criteriaSet);
} catch (final MetadataCacheException e) {
- log.warn("Could not resolve trust mark {} from {}", trustMarkType, trustedEntity, e);
+ log.warn("Could not resolve trust mark {} from {}", trustMarkType, trustMarkIssuer, e);
return null;
}
if (cacheResult.isEmpty()) {
- log.debug("No data resolved for {} from {}", trustMarkType, trustedEntity);
+ log.debug("No data resolved for {} from {}", trustMarkType, trustMarkIssuer);
return null;
}
final TrustMark trustMark = cacheResult.get(0).getStatement();
if (trustMark != null) {
return Map.of("trust_mark_type", trustMarkType, "trust_mark", trustMark.getJwt().serialize());
} else {
- log.debug("The cache container for {} did not contain trust mark", trustedEntity);
+ log.debug("The cache container for {} did not contain trust mark", trustMarkIssuer);
}
return null;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list