[java-plugin-shibd-oidc] branch main updated: Cleanup the default properties file

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/81d38480f6315c9181670b77199f6e4786ded4b8

The following commit(s) were added to refs/heads/main by this push:
     new 81d3848  Cleanup the default properties file
81d3848 is described below

commit 81d38480f6315c9181670b77199f6e4786ded4b8
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Feb 25 12:01:50 2026 +0000

    Cleanup the default properties file
    
     - And make it clear some features are experimental in the Alpha.
---
 .../shibboleth/idp/module/conf/sp/oidc.properties  | 35 ++++++++++++++--------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
index eca086d..4e8c81e 100644
--- a/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
+++ b/sp-oidc-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/oidc.properties
@@ -3,7 +3,6 @@
 # A client_secret to use by default, disable if you are using more than one authenticatingAuthority
 #sp.oidc.defaultClientSecret =
 
-# TODO key rollover
 ## Signing and encryption/decryption keys for request objects, id tokens, client authentication, and userinfo response
 #sp.oidc.signing.rs.key = %{idp.home}/credentials/sp/sp-signing-rs.jwk
 #sp.oidc.signing.es.key = %{idp.home}/credentials/sp/sp-signing-es.jwk
@@ -11,19 +10,13 @@
 
 # The OP's keyset document fetch interval i.e. how long should keys from the OP be cached.
 #sp.oidc.keyfetch.interval = PT30M
-# TODO this is global, but should be per OP
-# Should validation be skipped if the at_hash is not present in the id_token response. Defaults to 'true' as 
-# access token at_hash validation is optional in the Authorization Code Flow. 
-#sp.oidc.tokenresponse.allowMissingAtHash = true
 
-# Global profile defaults relating to interactions with an OP, some can originate from the Agent
 
-#sp.oidc.idtoken.jwt.verifier.clockSkew = PT60S
-#sp.oidc.idtoken.jwt.verifier.authnLifetime = PT60S
-#sp.oidc.idtoken.jwt.verifier.authnRequestClockSkew = PT0S
+# IMPORTANT: The below settings are for intermediate cases which should be regarded experimental in the alpha version.
+
+
+# Global Request And Response Settings
 
-# If true and the token was retrieved using TLS with server validation, JWS signature checking will be skipped.
-#sp.oidc.idtoken.tlsServerValidationOnly = false
 
 # Comma seperated list of additional scopes e.g. PROFILE or EMAIL. The openid scope is added by default.
 #sp.oidc.scopes = 
@@ -39,12 +32,30 @@
 #sp.oidc.forcePKCE = false
 #sp.oidc.allowPKCEPlain = false
 
-# Whether to use a request object to send authentication parameters, and if it should be encrypted and or signed.
+# Whether to use a request object to send authentication parameters, and if it should be encrypted and or signed. These
+# features will need appropriate singing keys enabled. 
 #sp.oidc.requestobject.used= false
 #sp.oidc.requestobject.encrypted = false
 #sp.oidc.requestobject.signed = true
+
+
+# Global Token Validation Settings
+
+
+# Should validation be skipped if the at_hash is not present in the id_token response. Defaults to 'true' as 
+# access token at_hash validation is optional in the Authorization Code Flow. 
+#sp.oidc.tokenresponse.allowMissingAtHash = true
+#sp.oidc.idtoken.jwt.verifier.clockSkew = PT60S
+#sp.oidc.idtoken.jwt.verifier.authnLifetime = PT60S
+#sp.oidc.idtoken.jwt.verifier.authnRequestClockSkew = PT0S
 # Should the ACR value in the response be compared to those in the request?
 #sp.oidc.idtoken.validateAcrValue = true
+# If true and the token was retrieved using TLS with server validation, JWS signature checking will be skipped.
+#sp.oidc.idtoken.tlsServerValidationOnly = false
+
+
+# Global Attribute Settings
+
 
 # Set true to accept any decided attributes without a filtering rule
 #sp.oidc.acceptUnfilteredAttributes = false

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.