[java-idp-plugin-oidc-op-oidfed] branch main updated: Cleaned and harmonised property names
Codeberg
noreply at shibboleth.net
Fri Aug 28 06:35:22 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/5722ad2d8bc71a5eecf637c8486aba9462a84aca
The following commit(s) were added to refs/heads/main by this push:
new 5722ad2 Cleaned and harmonised property names
5722ad2 is described below
commit 5722ad2d8bc71a5eecf637c8486aba9462a84aca
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Aug 28 09:32:51 2026 +0300
Cleaned and harmonised property names
- Also included initial/current properties in oidcfed-op.properties
- WIP: undocumented, subject to change
- Not yet wired to the module
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 10 +--
.../oidfed/resolve-entity/resolve-entity-beans.xml | 6 +-
.../oidfed/signed-keyset/signed-keyset-beans.xml | 48 +------------
.../op/oidfed/conf/oidfed/oidfed-op.properties | 83 ++++++++++++++++++++++
.../idp/module/conf/oidfed/oidfed-op.properties | 3 +-
5 files changed, 95 insertions(+), 55 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 79c40a4..43ff00f 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -11,10 +11,10 @@
<bean id="shibboleth.oidfed.DefaultOpenIdConfigurationResolver"
class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.DynamicFilesystemProviderMetadataResolver"
- p:minRefreshDelay="%{idp.oidc.config.minRefreshDelay:PT5M}"
- p:maxRefreshDelay="%{idp.oidc.config.maxRefreshDelay:PT4H}"
+ p:minRefreshDelay="%{idp.oidfed.op.metadata.minRefreshDelay:PT5M}"
+ p:maxRefreshDelay="%{idp.oidfed.op.metadata.maxRefreshDelay:PT4H}"
c:metadata="#{getObject('shibboleth.oidfed.OpenIDConfiguration') ?: getObject('DefaultMetadataSkeleton')}"
- p:dynamicValueResolvers-ref="#{'%{idp.oidfed.configuration.resolver.values:shibboleth.oidfed.configuration.DefaultDynamicValueResolvers}'.trim()}"/>
+ p:dynamicValueResolvers-ref="#{'%{idp.oidfed.op.metadata.values:shibboleth.oidfed.configuration.DefaultDynamicValueResolvers}'.trim()}"/>
<bean id="shibboleth.oidfed.configuration.DefaultDynamicValueResolvers"
parent="shibboleth.oidc.discovery.DefaultDynamicValueResolvers"
@@ -42,7 +42,7 @@
<bean parent="shibboleth.Functions.Constant">
<constructor-arg>
<bean class="java.util.List" factory-method="copyOf">
- <constructor-arg value="%{idp.oidfed.entityConfiguration.registrationTypesSupported:automatic,explicit}" />
+ <constructor-arg value="%{idp.oidfed.op.metadata.registrationTypesSupported:automatic,explicit}" />
</bean>
</constructor-arg>
</bean>
@@ -415,7 +415,7 @@
<bean id="ProviderMetadataEntityConfigurationMetadataDecorator"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.ProviderMetadataEntityConfigurationMetadataDecorator"
- p:metadataResolver-ref="#{'%{idp.oidfed.configuration.op.resolver:shibboleth.oidfed.DefaultOpenIdConfigurationResolver}'.trim()}"/>
+ p:metadataResolver-ref="#{'%{idp.oidfed.op.metadata.resolver:shibboleth.oidfed.DefaultOpenIdConfigurationResolver}'.trim()}"/>
<import resource="${idp.home}/conf/oidfed/oidfed-trustchain-resolver.xml"/>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
index 74aabf1..4c41d7a 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
@@ -49,8 +49,8 @@
<bean id="shibboleth.oidfed.ResolveEntityResponseMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:minCacheDuration="%{idp.oidfed.resolve-entity.maxRefreshDelay:PT1S}"
- p:maxCacheDuration="%{idp.oidfed.resolve-entity.maxRefreshDelay:PT30S}">
+ p:minCacheDuration="%{idp.oidfed.cache.resolveEntity.minRefreshDelay:PT1S}"
+ p:maxCacheDuration="%{idp.oidfed.cache.resolveEntity.maxRefreshDelay:PT30S}">
<property name="criteriaToIdentifierStrategy">
<bean parent="shibboleth.Functions.Expression"
c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.local.ResolveEntityRequestCriterion))?.getRequest().toString()"/>
@@ -72,7 +72,7 @@
<bean id="ValidateRequest" class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.ValidateResolveEntityRequest"
scope="prototype"
- p:localTrustAnchorsCache-ref="#{'%{idp.oidfed.resove-entity.LocalTrustAnchorsMetadataCache:shibboleth.oidfed.LocalTrustAnchorsMetadataCache}'.trim()}" />
+ p:localTrustAnchorsCache-ref="#{'%{idp.oidfed.resolve-entity.LocalTrustAnchorsMetadataCache:shibboleth.oidfed.LocalTrustAnchorsMetadataCache}'.trim()}" />
<bean id="LookupCachedResolveEntityResponse"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.LookupCachedResolveEntityResponse"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/signed-keyset/signed-keyset-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/signed-keyset/signed-keyset-beans.xml
index f23a7ff..4f32d42 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/signed-keyset/signed-keyset-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/signed-keyset/signed-keyset-beans.xml
@@ -24,8 +24,8 @@
<bean id="shibboleth.oidfed.SignedKeysetResponseMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:minCacheDuration="%{idp.oidfed.signed-keyset.maxRefreshDelay:PT1S}"
- p:maxCacheDuration="%{idp.oidfed.signed-keyset.maxRefreshDelay:PT30S}">
+ p:minCacheDuration="%{idp.oidfed.op.cache.signedKeyset.minRefreshDelay:PT1S}"
+ p:maxCacheDuration="%{idp.oidfed.op.cache.signedKeyset.maxRefreshDelay:PT30S}">
<property name="criteriaToIdentifierStrategy">
<bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
</property>
@@ -53,10 +53,6 @@
p:credentialsToPublishLookupStrategy="#{getObject('shibboleth.oidc.keyset.KeySetCredentialsToPublishLookupStrategy') ?:
getObject('shibboleth.oidc.keyset.DefaultKeySetCredentialsToPublishLookupStrategy')}"/>
- <bean id="DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
- class="net.shibboleth.oidfed.metadata.cache.local.DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
- p:metadataSkeletonCache-ref="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCache"/>
-
<bean id="PopulateEntityStatementSignatureSigningParameters"
class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters" scope="prototype"
c:strategy-ref="shibboleth.MessageContextLookup.Outbound"
@@ -125,44 +121,4 @@
scope="prototype" p:responseCache-ref="shibboleth.oidfed.SignedKeysetResponseMetadataCache">
</bean>
- <bean id="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultEntityConfigurationMetadataSkeletonMetadataCache"
- parent="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCacheBuilderSpec"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.BatchMetadataCacheBuilderSpec"
- p:metadataValidPredicate-ref="shibboleth.Conditions.TRUE">
- <property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
- </property>
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
- </property>
- <property name="loadingStrategy">
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultResourceLoadingStrategy">
- <constructor-arg name="metadata">
- <bean class="org.springframework.core.io.Resource"
- factory-bean="PreferFileSystemResourceLoader" factory-method="getResource">
- <constructor-arg>
- <bean class="java.lang.String" factory-method="valueOf">
- <constructor-arg value="%{idp.oidfed.configuration.MetadataSkaletonFile:%{idp.home}/conf/oidfed/oidfed-entity-configuration-metadata.json}" />
- </bean>
- </constructor-arg>
- </bean>
- </constructor-arg>
- </bean>
- </property>
- <property name="parsingStrategy">
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultJSONMapParsingStrategy"
- c:valueClass="java.util.Map"/>
- </property>
- <property name="sourceMetadataExpiryStrategy">
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultSourceMetadataExpirationTimeStrategy"
- c:duration="%{idp.oidfed.configuration.MetadataSkaletonCacheLifetime:PT10M}"/>
- </property>
- </bean>
-
</beans>
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
new file mode 100644
index 0000000..a4f9af8
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
@@ -0,0 +1,83 @@
+# postconfig.xml
+idp.oidfed.authorize.automaticRegistrationCondition = shibboleth.Conditions.FALSE
+idp.oidfed.token.automaticRegistrationCondition = shibboleth.Conditions.FALSE
+idp.oidfed.par.automaticRegistrationCondition = shibboleth.Conditions.FALSE
+idp.oidfed.userinfo.automaticRegistrationCondition = shibboleth.Conditions.FALSE
+idp.oidfed.resolve-entity.automaticRegistrationCondition = shibboleth.Conditions.TRUE
+idp.oidfed.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
+idp.oidfed.trustchain.resolver.fallbackToLocalCondition = shibboleth.Conditions.TRUE
+
+idp.oidfed.op.metadata.minRefreshDelay = PT5M
+idp.oidfed.op.metadata.maxRefreshDelay = PT4H
+idp.oidfed.op.metadata.values = shibboleth.oidfed.configuration.DefaultDynamicValueResolvers
+idp.oidfed.op.metadata.registrationTypesSupported = automatic,explicit
+idp.oidfed.op.metadata.resolver = shibboleth.oidfed.DefaultOpenIdConfigurationResolver
+idp.oidfed.autoreg.clientInformationManager = shibboleth.oidc.ClientInformationManager
+idp.oidfed.SignedKeysetMetadataCache = shibboleth.oidfed.SignedKeysetMetadataCache
+idp.oidfed.cache.explicitRegistration.maxJwtLifetime = PT1M
+idp.oidfed.cache.explicitRegistration.critClaims = %{idp.oidfed.cache.default.critClaims:}
+idp.oidfed.resolve-entity.authn.flows = OAuth2Client
+
+# relying-party/postconfig.xml
+idp.oidfed.automaticRegistration.mandatoryTrustMarks =
+idp.oidfed.automaticRegistration.defaultClaimsSetDecorationType =
+idp.oidfed.automaticRegistration.providedClaimsSetDecorationType = store
+idp.oidfed.explicitRegistration.mandatoryTrustMarks =
+idp.oidfed.resolve-entity.endpointAuthMethods = private_key_jwt
+idp.oidfed.resolve-entity.targetedEndpointAsJWTAudience = false
+idp.oidfed.resolve-entity.requireSingleJWTAudience = true
+
+# resolve-entity-beans
+idp.service.logging.oidfedresolve = OIDFED.ResolveEntity
+idp.oidc.logging.removeIpAddressFromProtocolMessage = false
+idp.oidfed.requestParser.ResolveEntityRequest =
+idp.oidfed.cache.resolveEntity.minRefreshDelay = PT1S
+idp.oidfed.cache.resolveEntity.maxRefreshDelay = PT30S
+idp.oidfed.resolve-entity.LocalTrustAnchorsMetadataCache = shibboleth.oidfed.LocalTrustAnchorsMetadataCache
+idp.oidfed.resolve-entity.MetadataPolicyOperatorsy = shibboleth.oidfed.StandardMetadataPolicyOperators
+idp.oidfed.resolve-entity.MetadataPolicMergingyStrategy = MetadataPolicMergingyStrategy
+idp.oidfed.resolve-entity.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
+idp.oidfed.resolve-entity.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
+idp.oidfed.resolve-entity.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
+idp.oidfed.entity.sigalg = RS256
+idp.oidc.logging.objectMapper = shibboleth.oidc.JSONObjectMapper
+
+# register-beans
+idp.service.logging.oidfeddynreg = OIDFED.Registration
+idp.oidc.requestParser.FederationRegisterRequest =
+idp.oidfed.register.TrustChainMetadataPolicyMergingStrategy = DefaultTrustChainMetadataPolicyMergingStrategy
+idp.oidfed.register.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
+idp.oidfed.policy.arraysAsSpaceSeparatedList = scope
+idp.oidfed.MetadataValidationCondition = DefaultMetadataValidationCondition
+idp.oidfed.FederationPolicyConstraints = shibboleth.oidfed.DefaultFederationPolicyConstraints
+idp.oidfed.register.ProvidedTrustChainMetadataCache = DefaultFetchThroughProvidedTrustChainMetadataCache
+idp.oidfed.cache.explicitRegistration.trustChain.customFilterStrategies =
+idp.oidfed.register.ProvidedEntityConfigurationMetadataCache = FetchThroughProvidedEntityConfigurationMetadataCache
+idp.oidfed.cache.explicitRegistration.entityConfiguration.customFilterStrategies =
+idp.oidfed.cache.explicitRegistrationRequest.claimsValidator = shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator
+idp.oidfed.register.MetadataPolicyOperatorsy = shibboleth.oidfed.StandardMetadataPolicyOperators
+idp.oidfed.register.MetadataPolicMergingyStrategy = MetadataPolicMergingyStrategy
+idp.oidfed.register.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
+idp.oidfed.register.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
+idp.oidfed.expreg.defaultScope = openid profile email address phone offline_access
+idp.oidfed.expreg.defaultSubjectType = public
+idp.oidfed.expreg.validateRemoteJwks = shibboleth.Conditions.TRUE
+idp.oidfed.expreg.clientInformationManager = shibboleth.oidc.ClientInformationManager
+
+# signed-keyset-beans
+idp.service.logging.oidfedconfig = OIDFED.SignedKeyset
+idp.oidfed.op.cache.signedKeyset.minRefreshDelay = PT1S
+idp.oidfed.op.cache.signedKeyset.maxRefreshDelay = PT30S
+
+# metadata-lookup-ext-oidfed-beans
+idp.oidfed.autoregister.TrustChainMetadataPolicyMergingStrategy = DefaultTrustChainMetadataPolicyMergingStrategy
+idp.oidfed.autoregister.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
+idp.oidfed.autoregister.ProvidedTrustChainMetadataCache = DefaultAutoRegisterFetchThroughProvidedTrustChainMetadataCache
+idp.oidfed.cache.providedTrustChain.customFilterStrategies =
+idp.oidfed.authorize.MetadataPolicyOperatorsy = shibboleth.oidfed.StandardMetadataPolicyOperators
+idp.oidfed.authorize.MetadataPolicMergingyStrategy = MetadataPolicMergingyStrategy
+idp.oidfed.authorize.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
+idp.oidfed.authorize.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
+idp.oidfed.authorize.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
+idp.oidfed.authorize.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
+
diff --git a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-op.properties b/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-op.properties
index 2c74f4e..eeb9e5f 100644
--- a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-op.properties
+++ b/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-op.properties
@@ -2,7 +2,8 @@ idp.oidfed.authorize.automaticRegistrationCondition = shibboleth.Conditions.TRUE
idp.oidfed.token.automaticRegistrationCondition = shibboleth.Conditions.TRUE
idp.oidfed.par.automaticRegistrationCondition = shibboleth.Conditions.TRUE
idp.oidfed.userinfo.automaticRegistrationCondition = shibboleth.Conditions.TRUE
-idp.oidfed.configuration.resolver.values = CustomEntityConfigurationValues
+idp.oidfed.op.metadata.values = CustomEntityConfigurationValues
+
idp.oidfed.configuration.MetadataSkaletonFile = src/test/resources/net/shibboleth/idp/module/conf/oidfed-entity-configuration-metadata.json
idp.oidfed.trustchain.resolver.useResolverApiCondition = HeaderUseResolveApiCondition
idp.oidfed.trustchain.resolver.fallbackToLocalCondition = HeaderFallbackToLocalCondition
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list