[java-plugin-shibd-oidc] branch main updated: Improve default properties file

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/e1f5ff673cee24dd06c4e47a431dc243b0cb8e15

The following commit(s) were added to refs/heads/main by this push:
     new e1f5ff6  Improve default properties file
e1f5ff6 is described below

commit e1f5ff673cee24dd06c4e47a431dc243b0cb8e15
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Feb 19 18:30:21 2026 +0000

    Improve default properties file
---
 .../net/shibboleth/sp/service/agent/postconfig.xml |  4 +--
 .../shibboleth/idp/module/conf/sp/oidc.properties  | 35 ++++++++++++++++++++--
 2 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index b04b11c..e7c0037 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -91,7 +91,7 @@
         p:refreshTokenTimeout="%{sp.oidc.refreshToken.defaultTimeout:PT2H}"
         p:refreshTokenChainLifetime="%{sp.oidc.refreshToken.defaultChainLifetime:PT2H}"
         p:alwaysIncludedAttributes="%{sp.oidc.alwaysIncludedAttributes:}"        
-        p:tokenEndpointAuthMethod="%{sp.oidc..authenticationMethod:client_secret_basic}"
+        p:tokenEndpointAuthMethod="%{sp.oidc.authenticationMethod:client_secret_basic}"
         p:useTargetedEndpointAsJWTAudience="%{sp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:true}"
         p:requireSingleJWTAudience="%{sp.oauth2.jwtAuth.requireSingleJWTAudience:false}"
         p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}"
@@ -248,7 +248,7 @@
                 <bean id="OIDCProviderMetadataCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ProviderMetadataCredentialResolver"
                     c:remoteJwkSetCache-ref="shibboleth.oidc.RemoteJwkSetCache"
-                    c:keyFetchInterval="%{sp.oidc.provider.keyfetch.interval:PT30M}" />
+                    c:keyFetchInterval="%{sp.oidc.keyfetch.interval:PT30M}" />
                 <bean id="ClientSecretCriterionCredentialResolver"
                     class="net.shibboleth.oidc.security.credential.impl.ClientSecretCriterionCredentialResolver"/>
             </list>
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
index 59a4547..d86ad55 100644
--- a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
+++ b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
@@ -3,20 +3,49 @@
 # A client_secret to use by default, disable if you are using more than one authenticatingAuthority
 #sp.oidc.defaultClientSecret =
 
-## TODO key rollover
+# TODO key rollover
 ## Signing and encryption/decryption keys for request objects, id tokens, and userinfo response
 #sp.oidc.signing.rs.key = %{idp.home}/credentials/sp/sp-signing-rs.jwk
 #sp.oidc.signing.es.key = %{idp.home}/credentials/sp/sp-signing-es.jwk
 #sp.oidc.signing.rsa.enc.key = %{idp.home}/credentials/sp/sp-encryption-rsa.jwk
 
+# The OP's keyset document fetch interval i.e. how long should keys from the OP be cached.
+#sp.oidc.keyfetch.interval = PT30M
+# TODO this is global, but should be per OP
+# Should validation be skipped if the at_hash is not present in the id_token response. Defaults to 'true' as 
+# access token at_hash validation is optional in the Authorization Code Flow. 
+#sp.oidc.tokenresponse.allowMissingAtHash = true
+
+# Global profile defaults relating to interactions with an OP, some can originate from the Agent
+
 #sp.oidc.redirecturl.allowedOrigins = http://localhost
-#sp.oidc.requestobject.encrypted = true
 
-## TODO check these are sensibly named
 #sp.oidc.idtoken.jwt.verifier.clockSkew = PT60S
 #sp.oidc.idtoken.jwt.verifier.authnLifetime = PT60S
 #sp.oidc.idtoken.jwt.verifier.authnRequestClockSkew = PT0S
 
+# If true and the token was retrieved using TLS with server validation, JWS signature checking will be skipped.
+#sp.oidc.idtoken.tlsServerValidationOnly = false
+
+# Comma seperated list of additional scopes e.g. PROFILE or EMAIL. The openid scope is added by default.
+#sp.oidc.scopes = 
+# The HTTP method use to send the authorization request
+#sp.oidc.httpRequestMethod = GET
+# Override the default response_mode for the given response_type
+#sp.oidc.responseMode = query
+# Client authentication method.
+#sp.oidc.authenticationMethod = client_secret_basic
+#sp.oidc.authenticationMethod.jwt.expiryOffset = PT30S
+
+# Enable PKCE for the authorization code flow
+#sp.oidc.forcePKCE = false
+#sp.oidc.allowPKCEPlain = false
+
+# Whether to use a request object to send authentication parameters, and if it should be encrypted and or signed.
+#sp.oidc.requestobject.used= false
+#sp.oidc.requestobject.encrypted = false
+#sp.oidc.requestobject.signed = true
+# Should the ACR value in the response be compared to those in the request?
 #sp.oidc.idtoken.validateAcrValue = true
 
 # Each protocol plugin will contain an order priority controlling

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.