[java-idp-plugin-oidc-op-oidfed] branch dev/OIDFED-COMMON updated: Exploit TrustMark interface instead of SignedJWT for trust marks
Codeberg
noreply at shibboleth.net
Thu Jun 4 14:14:11 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/OIDFED-COMMON
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/07ee0ae1e042d2fb53719796cfaf915478b3f8c6
The following commit(s) were added to refs/heads/dev/OIDFED-COMMON by this push:
new 07ee0ae Exploit TrustMark interface instead of SignedJWT for trust marks
07ee0ae is described below
commit 07ee0ae1e042d2fb53719796cfaf915478b3f8c6
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Jun 4 17:13:26 2026 +0300
Exploit TrustMark interface instead of SignedJWT for trust marks
---
.../profile/impl/BuildResolveEntityResponse.java | 23 ++++------------------
.../oidfed/metadata-lookup-ext-oidfed-beans.xml | 3 ++-
.../idp/flows/oidfed/register/register-beans.xml | 3 ++-
.../oidfed/resolve-entity/resolve-entity-beans.xml | 3 ++-
4 files changed, 10 insertions(+), 22 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
index c0334a2..dae1be2 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
@@ -14,7 +14,6 @@
package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-import java.text.ParseException;
import java.time.Instant;
import java.util.Date;
import java.util.List;
@@ -35,10 +34,10 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultEntityTypesLookupFunction;
import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.TrustMark;
import net.shibboleth.oidfed.metadata.payload.claim.Metadata;
import net.shibboleth.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.oidfed.profile.context.VerifiedTrustChain;
@@ -174,32 +173,18 @@ public class BuildResolveEntityResponse extends AbstractBuildEntityStatementActi
* @return map of trust marks, keyed with trust mark IDs
*/
@Nullable private Map<String, String> buildTrustMarks(@Nonnull final String entityId,
- @Nullable final Map<String, List<SignedJWT>> trustMarks) {
+ @Nullable final Map<String, List<TrustMark>> trustMarks) {
return Optional.ofNullable(trustMarks)
.map(marks -> marks.get(entityId))
.filter(Objects::nonNull)
.map(list -> list.stream()
- .map(trustMark -> new Pair<String, String>(getTrustMarkId(trustMark), trustMark.serialize()))
+ .map(trustMark -> new Pair<String, String>(
+ trustMark.getParsedPayload().getTrustMarkType(), trustMark.getJwt().serialize()))
.filter(Objects::nonNull)
.collect(Collectors.toMap(pair -> pair.getFirst(), pair -> pair.getSecond())))
.orElse(null);
}
- /**
- * Parses the trust mark ID for the given trust mark.
- *
- * @param trustMark the trust mark
- * @return the ID, or null if it could not be parsed
- */
- @Nullable private String getTrustMarkId(@Nullable final SignedJWT trustMark) {
- try {
- return trustMark == null ? null : trustMark.getJWTClaimsSet().getStringClaim("trust_mark_type");
- } catch (final ParseException e) {
- log.error("{} Could not parse the TrustMark JWT contents", getLogPrefix(), e);
- }
- return null;
- }
-
/**
* Resolve expiration time for the given trust chain.
*
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
index 376e4b0..b98c175 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
@@ -155,7 +155,8 @@
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
p:delegationTrustEngine-ref="shibboleth.oidfed.DefaultDelegatedTrustMarkTrustEngine">
<property name="trustChainTrustMarksParsingStrategy">
- <bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustMarksParsingStrategy"/>
+ <bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustMarksParsingStrategy"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"/>
</property>
<property name="trustedTrustMarkIssuersLookupStrategy">
<bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy"/>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
index 5885e21..bdea8d7 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
@@ -247,7 +247,8 @@
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
p:delegationTrustEngine-ref="shibboleth.oidfed.DefaultDelegatedTrustMarkTrustEngine">
<property name="trustChainTrustMarksParsingStrategy">
- <bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustMarksParsingStrategy"/>
+ <bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustMarksParsingStrategy"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"/>
</property>
<property name="trustedTrustMarkIssuersLookupStrategy">
<bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy"/>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
index 36be276..74aabf1 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
@@ -127,7 +127,8 @@
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
p:delegationTrustEngine-ref="shibboleth.oidfed.DefaultDelegatedTrustMarkTrustEngine">
<property name="trustChainTrustMarksParsingStrategy">
- <bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustMarksParsingStrategy"/>
+ <bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustMarksParsingStrategy"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"/>
</property>
<property name="trustedTrustMarkIssuersLookupStrategy">
<bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list