[java-plugin-shibd-oidc] branch main updated: Improve assembly and properties
Codeberg
noreply at shibboleth.net
Mon Feb 16 18:30:03 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/e35ca0167b848747a1c2d548cf77f321d06bb212
The following commit(s) were added to refs/heads/main by this push:
new e35ca01 Improve assembly and properties
e35ca01 is described below
commit e35ca0167b848747a1c2d548cf77f321d06bb212
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Feb 16 18:29:56 2026 +0000
Improve assembly and properties
---
.../idp/flows/sp/consumer/oidc/oidc-beans.xml | 6 ++--
.../shibboleth/idp/module/conf/sp/oidc.properties | 33 +++++++---------------
.../idp/module/conf/sp/oidc-test.properties | 4 +++
sp-oidc-dist/src/main/assembly/assembly.xml | 14 ++++-----
4 files changed, 24 insertions(+), 33 deletions(-)
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
index f3a1f5f..53c4cd3 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
@@ -279,14 +279,14 @@
</util:set>
<bean id="ExpiryClaimsValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
- p:clockSkew="#{environment.containsProperty('sp.oidc.jwt.verifier.clockSkew') ? environment.getProperty('sp.oidc.jwt.verifier.clockSkew') : '%{idp.policy.clockSkew:PT1M}'}" />
+ p:clockSkew="#{environment.containsProperty('sp.oidc.idtoken.jwt.verifier.clockSkew') ? environment.getProperty('sp.oidc.idtoken.jwt.verifier.clockSkew') : '%{idp.policy.clockSkew:PT1M}'}" />
<bean id="NotBeforeClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.NotBeforeClaimsValidator"
- p:clockSkew="#{environment.containsProperty('sp.oidc.jwt.verifier.clockSkew') ? environment.getProperty('sp.oidc.jwt.verifier.clockSkew') : '%{idp.policy.clockSkew:PT1M}'}" />
+ p:clockSkew="#{environment.containsProperty('sp.oidc.idtoken.jwt.verifier.clockSkew') ? environment.getProperty('sp.oidc.idtoken.jwt.verifier.clockSkew') : '%{idp.policy.clockSkew:PT1M}'}" />
<bean id="IssuedAtClaimsValidator" class="net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator"
- p:clockSkew="#{environment.containsProperty('sp.oidc.jwt.verifier.clockSkew') ? environment.getProperty('sp.oidc.jwt.verifier.clockSkew') : '%{idp.policy.clockSkew:PT1M}'}"
+ p:clockSkew="#{environment.containsProperty('sp.oidc.idtoken.jwt.verifier.clockSkew') ? environment.getProperty('sp.oidc.idtoken.jwt.verifier.clockSkew') : '%{idp.policy.clockSkew:PT1M}'}"
p:messageLifetime="%{idp.policy.messageLifetime:PT1M}"
p:requiredRule="false" />
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
index 72e7f5d..e50fb07 100644
--- a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
+++ b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
@@ -1,33 +1,20 @@
# OIDC-specific RP settings
-# Settings for RP public/private signing and encryption key(s)
-# During decryption key rollover, point the ".2" properties at a second
-# keypair, uncomment in credentials.xml, then publish it in your metadata.
-
-## TODO, should these be different credentials than the SAML specific SP ones? Or are they for the agent comms...not sure
-#sp.oidc.signing.key = %{idp.home}/credentials/sp/sp-signing.key
-#sp.oidc.signing.cert = %{idp.home}/credentials/sp/sp-signing.crt
-#sp.oidc.encryption.key = %{idp.home}/credentials/sp/sp-encryption.key
-#sp.oidc.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
-
-sp.oidc.signing.rs.key = %{idp.home}/credentials/sp/sp-signing-rs.jwk
-sp.oidc.signing.es.key = %{idp.home}/credentials/sp/sp-signing-es.jwk
-sp.oidc.signing.rsa.enc.key = %{idp.home}/credentials/sp/sp-encryption-rsa.jwk
-
-#sp.oidc.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
-#sp.oidc.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
+## TODO key rollover
+## Signing and encryption/decryption keys for request objects, id tokens, and userinfo response
+#sp.oidc.signing.rs.key = %{idp.home}/credentials/sp/sp-signing-rs.jwk
+#sp.oidc.signing.es.key = %{idp.home}/credentials/sp/sp-signing-es.jwk
+#sp.oidc.signing.rsa.enc.key = %{idp.home}/credentials/sp/sp-encryption-rsa.jwk
#sp.oidc.redirecturl.allowedOrigins = http://localhost
-
-## TEST ENC FOR NOW from profile config
-#idp.oidc.requestobject.encrypted = true
+#sp.oidc.requestobject.encrypted = true
## TODO check these are sensibly named
+#sp.oidc.idtoken.jwt.verifier.clockSkew = PT60S
+#sp.oidc.idtoken.jwt.verifier.authnLifetime = PT60S
+#sp.oidc.idtoken.jwt.verifier.authnRequestClockSkew = PT0S
-#sp.oidc.jwt.verifier.clockSkew =
-#sp.oidc.idtoken.jwt.verifier.clockSkew:PT60S
-#sp.oidc.idtoken.jwt.verifier.authnLifetime:PT60S
-#sp.oidc.idtoken.jwt.verifier.authnRequestClockSkew:PT0S
+#sp.oidc.idtoken.validateAcrValue = true
# Each protocol plugin will contain an order priority controlling
# relative order of use when handling requests, lower is "earlier".
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test.properties b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test.properties
index f8b2493..2148007 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test.properties
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test.properties
@@ -24,5 +24,9 @@ idp.oidc.requestobject.encrypted = false
#sp.oidc.idtoken.validateAcrValue = true
+#sp.oidc.idtoken.jwt.verifier.clockSkew = PT60S
+#sp.oidc.idtoken.jwt.verifier.authnLifetime = PT60S
+#sp.oidc.idtoken.jwt.verifier.authnRequestClockSkew = PT0S
+
#idp.oidc.encryption.config = dummy.oidc.EncryptionConfiguration
diff --git a/sp-oidc-dist/src/main/assembly/assembly.xml b/sp-oidc-dist/src/main/assembly/assembly.xml
index 6c3bfe6..cc4c49d 100644
--- a/sp-oidc-dist/src/main/assembly/assembly.xml
+++ b/sp-oidc-dist/src/main/assembly/assembly.xml
@@ -5,10 +5,10 @@
</formats>
<fileSets>
<fileSet>
- <directory>../sp-oidc-impl/target</directory>
+ <directory>../sp-oidc-api/target</directory>
<outputDirectory>webapp/WEB-INF/lib</outputDirectory>
<includes>
- <include>sp-oidc-impl-*.jar</include>
+ <include>sp-oidc-api-*.jar</include>
</includes>
<excludes>
<exclude>*test*.jar</exclude>
@@ -17,10 +17,10 @@
</excludes>
</fileSet>
<fileSet>
- <directory>../sp-oidc-api/target</directory>
+ <directory>../sp-oidc-impl/target</directory>
<outputDirectory>webapp/WEB-INF/lib</outputDirectory>
<includes>
- <include>sp-oidc-api-*.jar</include>
+ <include>sp-oidc-impl-*.jar</include>
</includes>
<excludes>
<exclude>*test*.jar</exclude>
@@ -29,10 +29,10 @@
</excludes>
</fileSet>
<fileSet>
- <directory>../sp-oidc-impl/target/dependency</directory>
+ <directory>../sp-oidc-conf-impl/target</directory>
<outputDirectory>webapp/WEB-INF/lib</outputDirectory>
<includes>
- <include>*.jar</include>
+ <include>sp-oidc-conf-impl-*.jar</include>
</includes>
<excludes>
<exclude>*test*.jar</exclude>
@@ -41,7 +41,7 @@
</excludes>
</fileSet>
<fileSet>
- <directory>../sp-oidc-conf-impl/target/classes/net/shibboleth/idp/plugin/sp</directory>
+ <directory>../sp-oidc-conf-impl/target/classes/net/shibboleth/sp/oidc/conf</directory>
<outputDirectory>bootstrap</outputDirectory>
<includes>
<include>plugin.properties</include>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list