[java-plugin-shibd-oidc] branch dev/JSHIBDOIDC-30 updated: Add keyset flow from RP
Codeberg
noreply at shibboleth.net
Fri Jul 17 14:00:01 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/JSHIBDOIDC-30
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/cad2aacd86aa2defc7e103806885ece4e5a43bc9
The following commit(s) were added to refs/heads/dev/JSHIBDOIDC-30 by this push:
new cad2aac Add keyset flow from RP
cad2aac is described below
commit cad2aacd86aa2defc7e103806885ece4e5a43bc9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jul 17 14:59:49 2026 +0100
Add keyset flow from RP
- This is not going to work as is, will need changing
---
.../idp/flows/sp/keyset/keyset-beans.xml | 84 ++++++++++++++++++++++
.../shibboleth/idp/flows/sp/keyset/keyset-flow.xml | 50 +++++++++++++
2 files changed, 134 insertions(+)
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/keyset/keyset-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/keyset/keyset-beans.xml
new file mode 100644
index 0000000..252fb8c
--- /dev/null
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/keyset/keyset-beans.xml
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <bean id="shibboleth.authn.oidc.rp.profileId" class="java.lang.String"
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration).PROFILE_ID}" />
+
+ <bean id="shibboleth.authn.oidc.rp.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidckeyset:OIDC.RP.Keyset}" />
+
+ <bean id="InitializeProfileRequestContext"
+ class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
+ p:profileId-ref="shibboleth.authn.oidc.rp.profileId"
+ p:legacyProfileId="#{getObject('hibboleth.authn.oidc.rp.legacyProfileId')}"
+ p:loggingId-ref="shibboleth.authn.oidc.rp.loggingId"
+ p:browserProfile="false" />
+
+ <bean id="InitializeOutboundMessageContext"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeBlankOutboundResponseMessageContext" scope="prototype" />
+
+ <bean id="InitializeRelyingPartyContext"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeUnverifiedRelyingPartyContext" scope="prototype" />
+
+ <bean id="SelectRelyingPartyConfiguration"
+ class="net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration" scope="prototype"
+ p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyResolverService" />
+
+ <bean id="SelectProfileConfiguration" class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration"
+ scope="prototype" />
+
+ <bean id="FormOutboundMessage"
+ class="net.shibboleth.oidc.profile.impl.FormOutboundKeySetResponseMessage" scope="prototype"
+ p:credentialsToPublishLookupStrategy="#{getObject('shibboleth.authn.oidc.rp.keyset.KeySetCredentialsToPublishLookupStrategy') ?:
+ getObject('shibboleth.authn.oidc.rp.keyset.DefaultKeySetCredentialsToPublishLookupStrategy')}"/>
+
+
+ <bean id="shibboleth.authn.oidc.rp.keyset.DefaultKeySetCredentialsToPublishLookupStrategy"
+ class="net.shibboleth.oidc.profile.config.navigate.JWKCredentialsToPublishLookupStrategy"/>
+
+ <bean id="EncodeMessage" class="org.opensaml.profile.action.impl.EncodeMessage" scope="prototype"
+ p:messageEncoderFactory-ref="shibboleth.authn.oidc.rp.keyset.messageEncoderFactory"
+ p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier" />
+
+ <bean id="shibboleth.authn.oidc.rp.keyset.messageEncoderFactory"
+ class="net.shibboleth.oidc.profile.encoding.impl.OIDCResponseEncoderFactory"
+ p:messageEncoder-ref="shibboleth.authn.oidc.rp.keyset.nimbusEncoder" scope="prototype" />
+
+ <bean id="shibboleth.authn.oidc.rp.keyset.nimbusEncoder"
+ class="net.shibboleth.oidc.profile.encoding.impl.SimpleNimbusResponseEncoder" scope="prototype"
+ p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier" init-method="" />
+
+ <bean id="RecordResponseComplete" class="net.shibboleth.idp.profile.impl.RecordResponseComplete"
+ scope="prototype" />
+
+ <bean id="PostKeySetResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostKeySetResponsePopulateAuditContext') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostKeySetResponsePopulateAuditContext')}" />
+
+ <bean id="WriteAuditLog" class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
+ p:formattingMap-ref="shibboleth.AuditFormattingMap"
+ p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
+ p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
+ p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
+
+ <bean id="BuildErrorResponseFromEvent"
+ class="net.shibboleth.oidc.profile.impl.BuildJSONErrorResponseFromEvent" scope="prototype"
+ p:defaultStatusCode="500" p:defaultCode="server_error"
+ p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier">
+ <property name="eventContextLookupStrategy">
+ <bean class="net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction" />
+ </property>
+ </bean>
+
+ <bean id="LogEvent" class="org.opensaml.profile.action.impl.LogEvent" scope="prototype"
+ p:suppressedEvents="#{getObject('shibboleth.SuppressedEvents') ?: getObject('shibboleth.DefaultSuppressedEvents')}">
+ <property name="eventContextLookupStrategy">
+ <bean class="net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction" />
+ </property>
+ </bean>
+
+</beans>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/keyset/keyset-flow.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/keyset/keyset-flow.xml
new file mode 100644
index 0000000..8a80703
--- /dev/null
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/keyset/keyset-flow.xml
@@ -0,0 +1,50 @@
+<flow xmlns="http://www.springframework.org/schema/webflow"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd">
+
+ <action-state id="InitializeMandatoryContexts">
+ <evaluate expression="InitializeProfileRequestContext" />
+ <evaluate expression="InitializeOutboundMessageContext" />
+ <evaluate expression="InitializeRelyingPartyContext" />
+ <evaluate expression="SelectRelyingPartyConfiguration" />
+ <evaluate expression="SelectProfileConfiguration" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="BuildResponseMessage" />
+ </action-state>
+
+ <action-state id="BuildResponseMessage">
+ <evaluate expression="FormOutboundMessage" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="CommitResponse" />
+ </action-state>
+
+ <action-state id="HandleError">
+ <on-entry>
+ <evaluate
+ expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.SpringRequestContext), true).setRequestContext(flowRequestContext)" />
+ <evaluate expression="LogEvent" />
+ </on-entry>
+ <evaluate expression="BuildErrorResponseFromEvent" />
+ <evaluate expression="'proceed'" />
+ <transition on="proceed" to="CommitResponse" />
+ </action-state>
+
+
+ <end-state id="CommitResponse">
+ <on-entry>
+ <evaluate expression="EncodeMessage" />
+ <evaluate expression="PostKeySetResponsePopulateAuditContext" />
+ <evaluate expression="WriteAuditLog" />
+ <evaluate expression="RecordResponseComplete" />
+ </on-entry>
+ </end-state>
+
+ <!-- all unhandled non proceed results are turned into errors -->
+ <global-transitions>
+ <transition on-exception="java.lang.RuntimeException" to="LogRuntimeException" />
+ <transition on="#{!'proceed'.equals(currentEvent.id)}" to="HandleError" />
+ </global-transitions>
+
+ <bean-import resource="keyset-beans.xml" />
+
+</flow>
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list