[java-plugin-shibd-oidc] branch main updated: Comment out keys that are not required by default
Codeberg
noreply at shibboleth.net
Tue Feb 24 18:05:09 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/12d26313c2736e8281f61c3f5a12d7f014a23ac5
The following commit(s) were added to refs/heads/main by this push:
new 12d2631 Comment out keys that are not required by default
12d2631 is described below
commit 12d26313c2736e8281f61c3f5a12d7f014a23ac5
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Feb 24 18:05:02 2026 +0000
Comment out keys that are not required by default
---
.../shibboleth/idp/module/conf/sp/oidc-credentials.xml | 14 +++++++++++---
.../net/shibboleth/idp/module/conf/sp/oidc.properties | 2 --
.../shibboleth/idp/module/conf/sp/oidc-credentials.xml | 14 +++++++++++---
.../shibboleth/idp/module/conf/sp/oidc-test-agents.xml | 17 +++++++++++++++--
.../shibboleth/idp/module/conf/sp/oidc-test.properties | 12 ------------
5 files changed, 37 insertions(+), 22 deletions(-)
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
index 71e0144..d54e17b 100644
--- a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
+++ b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
@@ -16,6 +16,9 @@
This file contains default OIDC signing and encryption credentials. This file should be imported into agents.xml.
-->
+ <!-- Uncomment these credentials for advanced signing and decryption operations -->
+
+ <!--
<bean id="shibboleth.oidc.DefaultRSSigningCredential" parent="shibboleth.oidc.JWKCredential"
p:resource="%{sp.oidc.signing.rs.key:#{null}}" p:throwIfNull="false" />
@@ -24,14 +27,17 @@
<bean id="shibboleth.oidc.DefaultRSAEncryptionCredential" parent="shibboleth.oidc.JWKCredential"
p:resource="%{sp.oidc.encryption.rsa.key:#{null}}" p:throwIfNull="false" />
+ -->
<!--
Lists ALL of your RP's signing credentials for the default security configuration.
If you define additional signing credentials make sure to include them within this list.
-->
<util:list id="shibboleth.oidc.SigningCredentials">
- <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
- <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
+ <!--
+ <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
+ <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
+ -->
</util:list>
<!--
@@ -39,7 +45,9 @@
If you define additional decryption credentials make sure to include them within this list.
-->
<util:list id="shibboleth.oidc.EncryptionCredentials">
- <ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
+ <!--
+ <ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
+ -->
</util:list>
<!--
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
index 41fb517..eca086d 100644
--- a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
+++ b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
@@ -18,8 +18,6 @@
# Global profile defaults relating to interactions with an OP, some can originate from the Agent
-#sp.oidc.redirecturl.allowedOrigins = http://localhost
-
#sp.oidc.idtoken.jwt.verifier.clockSkew = PT60S
#sp.oidc.idtoken.jwt.verifier.authnLifetime = PT60S
#sp.oidc.idtoken.jwt.verifier.authnRequestClockSkew = PT0S
diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
similarity index 92%
copy from sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
copy to sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
index 71e0144..4a26085 100644
--- a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
@@ -16,6 +16,9 @@
This file contains default OIDC signing and encryption credentials. This file should be imported into agents.xml.
-->
+ <!-- Uncomment these credentials for advanced signing and decryption operations -->
+
+
<bean id="shibboleth.oidc.DefaultRSSigningCredential" parent="shibboleth.oidc.JWKCredential"
p:resource="%{sp.oidc.signing.rs.key:#{null}}" p:throwIfNull="false" />
@@ -25,13 +28,16 @@
<bean id="shibboleth.oidc.DefaultRSAEncryptionCredential" parent="shibboleth.oidc.JWKCredential"
p:resource="%{sp.oidc.encryption.rsa.key:#{null}}" p:throwIfNull="false" />
+
<!--
Lists ALL of your RP's signing credentials for the default security configuration.
If you define additional signing credentials make sure to include them within this list.
-->
<util:list id="shibboleth.oidc.SigningCredentials">
- <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
- <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
+
+ <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
+ <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
+
</util:list>
<!--
@@ -39,7 +45,9 @@
If you define additional decryption credentials make sure to include them within this list.
-->
<util:list id="shibboleth.oidc.EncryptionCredentials">
- <ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
+
+ <ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
+
</util:list>
<!--
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
index 40fdf82..01fd580 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
@@ -26,9 +26,12 @@
<bean p:id="test-oidc-application-without-ro" parent="shibboleth.sp.Application"
p:profileConfigurations-ref="test.ProfileConfigurations"/>
-
+
+ <!-- Test using a profile that requires a request object, also override the authenticatingAuthority just to check that -->
<bean p:id="test-oidc-application-with-ro" parent="shibboleth.sp.Application"
+ p:authenticatingAuthority="https://op.example.org"
p:profileConfigurations-ref="test.RequestObjectProfileConfigurations"/>
+
<bean p:id="test-oidc-application-with-ro-with-requested-attrs" parent="shibboleth.sp.Application"
p:profileConfigurations-ref="test.RequestedClaimsProfileConfigurations"/>
@@ -115,7 +118,17 @@
-->
<util:list id="shibboleth.sp.RelyingPartyOverrides">
- <!-- Your RelyingParty overrides here. -->
+ <!--<bean id="OpenID" parent="RelyingPartyByName" c:relyingPartyIds="https://op.example.org">
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.SSO" p:useRequestObject="false">
+ <property name="clientCredential">
+ <bean parent="shibboleth.oidc.ClientSecretCredential" p:secret="another-secret-cooool"/>
+ </property>
+ </bean>
+ </list>
+ </property>
+ </bean> -->
</util:list>
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test.properties b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test.properties
index 312af06..bf112fe 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test.properties
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test.properties
@@ -2,16 +2,6 @@
## TODO check where these are being used
-# Settings for RP public/private signing and encryption key(s)
-# During decryption key rollover, point the ".2" properties at a second
-# keypair, uncomment in credentials.xml, then publish it in your metadata.
-
-## TODO, should these be different credentials than the SAML specific SP ones? Or are they for the agent comms...not sure
-#sp.oidc.signing.key = %{idp.home}/credentials/sp/sp-signing.key
-#sp.oidc.signing.cert = %{idp.home}/credentials/sp/sp-signing.crt
-#sp.oidc.encryption.key = %{idp.home}/credentials/sp/sp-encryption.key
-#sp.oidc.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
-
sp.oidc.signing.rs.key = %{idp.home}/credentials/sp/sp-signing-rs.jwk
sp.oidc.signing.es.key = %{idp.home}/credentials/sp/sp-signing-es.jwk
sp.oidc.encryption.rsa.key = %{idp.home}/credentials/sp/sp-encryption-rsa.jwk
@@ -19,8 +9,6 @@ sp.oidc.encryption.rsa.key = %{idp.home}/credentials/sp/sp-encryption-rsa.jwk
#sp.oidc.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
#sp.oidc.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
-sp.oidc.redirecturl.allowedOrigins = http://localhost
-
#sp.oidc.extractStandardAttributes = true
## TEST ENC FOR NOW from profile config
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list