[java-plugin-shibd-oidc] branch main updated: Fix security params lookup for client_authentication
Codeberg
noreply at shibboleth.net
Wed Mar 11 15:30:23 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/fe79234601ca40e7acf940097eafd765abdbbec9
The following commit(s) were added to refs/heads/main by this push:
new fe79234 Fix security params lookup for client_authentication
fe79234 is described below
commit fe79234601ca40e7acf940097eafd765abdbbec9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Mar 11 15:30:13 2026 +0000
Fix security params lookup for client_authentication
- I was using the wrong function for looking up the security params for
private_key_jwt client_authentication.
- Add explicit flow test for private_key_jwt
---
.../idp/flows/sp/consumer/oidc/oidc-beans.xml | 2 +-
.../shibboleth/idp/flows/sp/oidc-common-beans.xml | 11 +++++-
.../sp/oidc/flows/OIDCTokenConsumerFlowTest.java | 40 +++++++++++++++++++++-
.../idp/module/conf/sp/oidc-test-agents.xml | 14 ++++++++
4 files changed, 64 insertions(+), 3 deletions(-)
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
index d45183c..c3a7165 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/oidc/oidc-beans.xml
@@ -100,7 +100,7 @@
<constructor-arg name="f" ref="shibboleth.MessageContextLookup.Inbound"/>
</bean>
- <!-- TODO check inbound or outbound at this point, outbound to get ID token, but inbound from Agent -->
+ <!-- Build the request based on the inbound context -->
<bean id="InitializeOAuth2ClientAuthenticationContextHandler" parent="WebFlowInboundMessageHandlerAdaptor"
scope="prototype">
<constructor-arg>
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml
index e264dde..be352f4 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/oidc-common-beans.xml
@@ -123,12 +123,21 @@
</constructor-arg>
</bean>
+ <bean id="shibboleth.ChildLookup.OAuth2ClientAuthenticationContextFromOIDCPeer" parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <ref bean="shibboleth.ChildLookup.OAuth2ClientAuthenticationContext" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <ref bean="shibboleth.ChildLookup.OIDCPeerEntityContext" />
+ </constructor-arg>
+ </bean>
+
<bean id="shibboleth.ChildLookupOrCreate.SecurityParametersFromOAuth2ClientAuthenticationContext" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
<ref bean="shibboleth.ChildLookupOrCreate.SecurityParametersContext" />
</constructor-arg>
<constructor-arg name="f">
- <ref bean="shibboleth.ChildLookup.OAuth2ClientAuthenticationContext" />
+ <ref bean="shibboleth.ChildLookup.OAuth2ClientAuthenticationContextFromOIDCPeer" />
</constructor-arg>
</bean>
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
index 3e2cf31..bef9712 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
@@ -144,6 +144,7 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
public void beforeMethod() throws Exception{
setDefaultAuth();
final ApplicationContext applicationContext2 = applicationContext;
+ // Check the mock HTTP client has been defined
if (applicationContext2 != null) {
httpClient = applicationContext2.getBean("Mock.HttpClient", HttpClient.class);
} else {
@@ -155,7 +156,7 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
// Add a default metadata response
final var metadataFromFile = new ClassPathResource("metadata/openid-configuration.json");
final String json = new String(metadataFromFile.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
- metadata = OIDCProviderMetadata.parse(JSONObjectUtils.parse(json));
+ metadata = OIDCProviderMetadata.parse(JSONObjectUtils.parse(json));
}
@@ -196,6 +197,43 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
TestConstants.RESOURCE_URL);
}
+ /**
+ * Test successful flow with a signed id_token and a plain user info response. Use private_key_jwt client
+ * authentication.
+ *
+ * @throws IOException on error
+ */
+ @Test
+ public void testSuccess_SignedIDToken_PlainUserInfo_PrivateKeyJWT() throws Exception {
+ mockOIDCEndpoints(constructSuccessfulTokenResponseSigned(Instant.now().plusSeconds(3600), Instant.now(), null, null),
+ constructJSONUserInfoResponse());
+
+ final AuthenticationSuccessResponse response =
+ buildOIDCAuthorizationCodeResponse(TestConstants.RESPONSE_URL, ResponseMode.QUERY,
+ TestConstants.STATE_STRING);
+ final DDF input = buildRemotedQueryStringResponse(response);
+
+ // Add cookies
+ input.addmember("http.headers.Cookie").unsafe_string(TestConstants.buildCookieHeader(
+ TestConstants.AUTHENTICATION_STATE,
+ TestConstants.APPLICATION_ID,
+ TestConstants.AUTHENTICATION_NONCE,
+ TestConstants.TARGET_URL,
+ TestConstants.buildAuthenticationState(null, false, null)));
+
+ // Use application which requires private_key_jwt
+ setApplicationRequest("test-oidc-application-with-ro-private-key-jwt", input);
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(TestConstants.FLOW_ID, null, externalContext);
+ assertFlowExecutionResult(result, TestConstants.FLOW_ID);
+ assertFlowExecutionOutcome(result.getOutcome());
+ final DDF output = assertOutputMessageSuccess(result);
+ assert output != null;
+ System.out.println("test output: " + output.toString());
+ validateOutputMessage(result, CollectionSupport.setOf("sub","mail","displayName","eduPersonScopedAffiliation"),
+ TestConstants.RESOURCE_URL);
+ }
+
/**
* Test successful flow with a signed id_token and a plain user info response.
*
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
index 01fd580..2a37f8f 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
@@ -32,6 +32,11 @@
p:authenticatingAuthority="https://op.example.org"
p:profileConfigurations-ref="test.RequestObjectProfileConfigurations"/>
+ <!-- Use private_key_jwt client authentication -->
+ <bean p:id="test-oidc-application-with-ro-private-key-jwt" parent="shibboleth.sp.Application"
+ p:authenticatingAuthority="https://op.example.org"
+ p:profileConfigurations-ref="test.RequestObjectProfileConfigurations.PrivateKeyJWT"/>
+
<bean p:id="test-oidc-application-with-ro-with-requested-attrs" parent="shibboleth.sp.Application"
p:profileConfigurations-ref="test.RequestedClaimsProfileConfigurations"/>
@@ -59,6 +64,15 @@
</bean>
</util:list>
+ <util:list id="test.RequestObjectProfileConfigurations.PrivateKeyJWT">
+ <bean parent="OIDC.SSO" p:securityConfiguration-ref="testSecConfig" p:useRequestObject="true" p:signRequestObject="true" p:encryptRequestObject="false"
+ p:tokenEndpointAuthMethod="private_key_jwt">
+ <property name="clientCredential">
+ <bean parent="shibboleth.oidc.ClientSecretCredential" p:secret="secret"/>
+ </property>
+ </bean>
+ </util:list>
+
<util:list id="test.RequestedClaimsProfileConfigurations">
<bean parent="OIDC.SSO" p:securityConfiguration-ref="testSecConfig" p:useRequestObject="true" p:signRequestObject="true" p:encryptRequestObject="false">
<property name="requestedClaimsLookupStrategy">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list