[java-plugin-shibd-oidc] branch main updated: JSHIBD-18 - Automate population of flows, profiles, etc.
Codeberg
noreply at shibboleth.net
Thu Feb 5 11:54:46 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/6a6d5311e55482eb208f84f8aa7f30651282110e
The following commit(s) were added to refs/heads/main by this push:
new 6a6d531 JSHIBD-18 - Automate population of flows, profiles, etc.
6a6d531 is described below
commit 6a6d5311e55482eb208f84f8aa7f30651282110e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Feb 5 11:54:37 2026 +0000
JSHIBD-18 - Automate population of flows, profiles, etc.
- Harmonise configuration with the changes to allow automatic profile
configuration
https://shibboleth.atlassian.net/browse/JSHIBD-18
---
.../shibboleth/idp/flows/sp/oidc-common-beans.xml | 4 +-
.../net/shibboleth/sp/service/agent/postconfig.xml | 12 ++++-
.../oidc/flows/OIDCSessionInitiatorFlowTest.java | 23 +++++++++
.../net/shibboleth/idp/module/conf/sp/agents.xml | 59 +++++++++++-----------
.../idp/module/conf/sp/oidc-test-agents.xml | 44 ++++++++--------
5 files changed, 90 insertions(+), 52 deletions(-)
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml
index 369b7fc..e2992a7 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml
@@ -72,12 +72,12 @@
<bean id="shibboleth.AuthenticationRequestLookup.FromOutbound"
class="net.shibboleth.sp.oidc.context.navigate.AuthenticationRequestFromOutboundLookupStrategy" />
- <!-- Add BiFunction for use with validators that finds the clientId from the sp.issuer -->
+ <!-- Add BiFunction for use with validators that find the clientId from the sp.issuer -->
<bean id="shibboleth.ClientIdLookup.BiFunction" class="net.shibboleth.sp.oidc.context.navigate.ClientIdBiFunctionLookupStrategy">
<constructor-arg ref="shibboleth.ClientIdLookup.Simple"/>
</bean>
- <!-- An alias to make it clear the clientId is coming from the issuer of the request, lookup -->
+ <!-- An alias to make it clear the clientId is coming from the issuer of the request -->
<alias alias="shibboleth.ClientIdLookup.Simple" name="shibboleth.IssuerLookup.Simple"/>
<bean id="shibboleth.ChildLookup.OIDCProviderMetadataContextFromPeerContext" parent="shibboleth.Functions.Compose">
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index 443f3ed..a4dead3 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -22,7 +22,17 @@
p:id="OIDC"
p:order="%{sp.oidc.relativeOrder:1}"
p:sessionInitiators="oidc"
- p:tokenConsumers="#{{'oidc/code/query', 'oidc/code/post'}}" />
+ p:tokenConsumers="#{{'oidc/code/query', 'oidc/code/post'}}">
+ <property name="defaultProfileConfigurations">
+ <list>
+ <ref bean="OIDC.SSO" />
+ </list>
+ </property>
+ <property name="metadataDrivenDefaultProfileConfigurations">
+ <list>
+ </list>
+ </property>
+ </bean>
<!-- Credential bean factories -->
<!-- TODO should these be here? -->
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
index 3ba7456..ad0a75a 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
@@ -110,6 +110,29 @@ public class OIDCSessionInitiatorFlowTest extends AbstractSPFlowTest {
validateOutputMessage(result);
}
+ /**
+ * Basic flow test which uses the default profile configuration.
+ *
+ * @throws IOException on error
+ * @throws MessageDecodingException
+ */
+ @Test
+ public void testFlow_WithDefaultProfile() throws IOException, MessageDecodingException {
+ setDefaultAuth();
+
+ final DDF input = new DDF(null).structure();
+ input.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
+ input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
+ input.addmember(SPConstants.TARGET).unsafe_string(RESOURCE_URL);
+ setApplicationRequest("test-oidc-application-with-default-profile", input);
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertFlowExecutionResult(result, FLOW_ID);
+ assertFlowExecutionOutcome(result.getOutcome());
+
+ validateOutputMessage(result);
+ }
+
/**
* Basic flow test with present state
*
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index 5ea1f24..4b63d08 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -12,58 +12,59 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <!--
- This is a test agent config file allowing the testbed to be used to exercise agents.
- It's not used by any unit tests, but overrides the vanilla/empty agents.xml resource
- present in the SP "root" plugin, which is not SAML/OpenID aware.
+ <!--
+ This is a test agent config file allowing the testbed to be used to exercise agents
+ by importing the necessary credentials. It's deliberately unused by any unit tests.
-->
<!--
This is a master file defining the Agents, Applications, and RelyingParty configurations to use.
- You can add any number of additional imported files to organize your configuration.
-
- By default, the RelyingParty definitions below are used for all Applications unless overridden.
-
- This is an "empty" example in that it assumes neither SAML, OpenID, or any other protocols.
+ You may also add any number of additional imported files to organize your configuration in other ways.
-->
<!-- ============ Agents and their Applications ============ -->
- <bean p:id="localhost" parent="shibboleth.sp.Agent" p:sharedSecrets="foo" />
+ <bean p:id="localhost" parent="shibboleth.sp.Agent" p:credentials="#{ {null : 'foo'} }" />
- <!-- ============ Profile defaults ============ -->
+ <!-- ============ RelyingParty Overrides ============ -->
- <!-- Used for all applications by default to provide a baseline for profile settings. -->
+ <!--
+ These overrides are wired into *all* Applications across all Agents by default. You can create
+ customized alternatives in whatever combination you require to plug into specific Application
+ beans.
+ -->
- <util:list id="shibboleth.sp.DefaultProfileConfigurations">
- <!-- Your profiles here. -->
- <bean parent="OIDC.SSO" />
+ <util:list id="shibboleth.sp.RelyingPartyOverrides">
+ <!-- Your RelyingParty overrides here. -->
</util:list>
-
-
- <!--
- Unverified RP configuration, defaults to no support for any profiles.
- "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the identity and
- legitimacy of an authenticating system. Some profiles may simply be designed to operate this way.
- -->
- <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
+ <util:list id="shibboleth.sp.DefaultProfileConfigurations">
<!-- Your profiles here. -->
+ <bean parent="OIDC.SSOs" />
</util:list>
- <!-- ============ RelyingParty Overrides ============ -->
+
+ <!-- ============ Overridden Profile Configuration Defaults ============ -->
<!--
- These overrides are wired into *all* Applications across all Agents by default. You can create
- customized alternatives in whatever combination you require to plug into specific Application
- beans.
+ The Hub auto-enables all profiles supplied by any plugins installed for you.
+ Uncommenting and defining these lists will override the default sets and apply them to
+ every Agent/Application for you, if you do not also override the individual properties.
+
+ "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the
+ identity and legitimacy of an authenticating system. Some profiles are designed to operate
+ this way, usually to expose public information about the system.
-->
- <util:list id="shibboleth.sp.RelyingPartyOverrides">
- <!-- Your RelyingParty overrides here. -->
+ <!--
+ <util:list id="shibboleth.sp.DefaultProfileConfigurations">
</util:list>
+ <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
+ </util:list>
+ -->
+
<import resource="oidc-credentials.xml" />
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
index e85af89..d6e7c7b 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
@@ -22,6 +22,9 @@
p:issuer="testsp.example.org">
<property name="applications">
<set>
+ <bean p:id="test-oidc-application-with-default-profile" parent="shibboleth.sp.Application"
+ p:metadataResolver-ref="shibboleth.ProviderMetadataResolverService"/>
+
<bean p:id="test-oidc-application-without-ro" parent="shibboleth.sp.Application"
p:profileConfigurations-ref="test.ProfileConfigurations"
p:metadataResolver-ref="shibboleth.ProviderMetadataResolverService"/>
@@ -107,26 +110,6 @@
</bean>
- <!-- ============ Profile defaults ============ -->
-
- <!-- Used for all applications by default to provide a baseline for profile settings. -->
-
- <util:list id="shibboleth.sp.DefaultProfileConfigurations">
- <!-- Your profiles here. -->
- <ref bean="OIDC.SSO" />
- </util:list>
-
-
- <!--
- Unverified RP configuration, defaults to no support for any profiles.
-
- "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the identity and
- legitimacy of an authenticating system. Some profiles may simply be designed to operate this way.
- -->
- <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
- <!-- Your profiles here. -->
- </util:list>
-
<!-- ============ RelyingParty Overrides ============ -->
<!--
@@ -139,4 +122,25 @@
<!-- Your RelyingParty overrides here. -->
</util:list>
+
+ <!-- ============ Overridden Profile Configuration Defaults ============ -->
+
+ <!--
+ The Hub auto-enables all profiles supplied by any plugins installed for you.
+ Uncommenting and defining these lists will override the default sets and apply them to
+ every Agent/Application for you, if you do not also override the individual properties.
+
+ "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the
+ identity and legitimacy of an authenticating system. Some profiles are designed to operate
+ this way, usually to expose public information about the system.
+ -->
+
+ <!--
+ <util:list id="shibboleth.sp.DefaultProfileConfigurations">
+ </util:list>
+
+ <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
+ </util:list>
+ -->
+
</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list