[java-plugin-shibd-oidc] branch main updated: Cleanup default profile configuration, add PKCE initiator test flow
Codeberg
noreply at shibboleth.net
Wed Mar 18 16:34:23 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/b80f46b30ccabf975afaab5c875e8c777556b6f1
The following commit(s) were added to refs/heads/main by this push:
new b80f46b Cleanup default profile configuration, add PKCE initiator test flow
b80f46b is described below
commit b80f46b30ccabf975afaab5c875e8c777556b6f1
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Mar 18 16:34:12 2026 +0000
Cleanup default profile configuration, add PKCE initiator test flow
---
.../net/shibboleth/sp/service/agent/postconfig.xml | 26 +++------------------
.../oidc/flows/OIDCSessionInitiatorFlowTest.java | 27 ++++++++++++++++++++++
.../idp/module/conf/sp/oidc-test-agents.xml | 11 +++++++++
.../profile/impl/PKCEOptionsLookupStrategy.java | 1 -
4 files changed, 41 insertions(+), 24 deletions(-)
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index b8c4888..b544a5a 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -76,38 +76,19 @@
<bean id="AbstractOIDCProfile" abstract="true"
p:securityConfiguration-ref="%{sp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
-<!-- TODO make sure the idtoken properties are idToken, and what to do with all the OP specific settings -->
<bean id="AbstractOIDCSSOProfile" parent="AbstractOIDCProfile" abstract="true"
p:issuer="#{getObject('shibboleth.oidc.issuer')}"
- p:tokenEndpointAuthMethods="%{sp.oidc.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"
p:claimsValidator="#{getObject('DefaultJWTClaimsValidator')}"
- p:encryptionOptional="%{sp.oidc.encryptionOptional:true}"
p:forcePKCE="%{sp.oidc.forcePKCE:false}"
- p:allowPKCEPlain="%{sp.oidc.allowPKCEPlain:false}"
- p:iDTokenLifetime="%{sp.oidc.idToken.defaultLifetime:PT1H}"
- p:accessTokenType="%{sp.oauth2.accessToken.type:}"
- p:accessTokenLifetime="%{sp.oidc.accessToken.defaultLifetime:PT10M}"
- p:refreshTokenType="%{sp.oauth2.refreshToken.type:}"
- p:refreshTokenTimeout="%{sp.oidc.refreshToken.defaultTimeout:PT2H}"
- p:refreshTokenChainLifetime="%{sp.oidc.refreshToken.defaultChainLifetime:PT2H}"
- p:alwaysIncludedAttributes="%{sp.oidc.alwaysIncludedAttributes:}"
+ p:allowPKCEPlain="%{sp.oidc.allowPKCEPlain:false}"
p:tokenEndpointAuthMethod="%{sp.oidc.authenticationMethod:client_secret_basic}"
p:useTargetedEndpointAsJWTAudience="%{sp.oauth2.jwtAuth.targetedEndpointAsJWTAudience:true}"
- p:requireSingleJWTAudience="%{sp.oauth2.jwtAuth.requireSingleJWTAudience:false}"
- p:unregisteredClientPolicy="#{getObject('shibboleth.oidc.DefaultUnregisteredClientPolicy')}"
- p:dpopProofClaimsValidator="#{getObject('DefaultDPoPProofClaimsValidator')}"
- p:dpopProofSignatureValidationConfiguration="#{getObject('DPoPSignatureValidationConfiguration')}"
- p:dpopProofNonceGenerator="#{getObject('DefaultOAuth2DPoPNonceGenerator')}"
- p:strictScopeValidation="%{sp.oidc.strictScopeValidation:false}"
p:clientCredential="#{%{sp.oidc.discoveryRequired:false} == true ? {null} : getObject('shibboleth.oidc.DefaultCredential')}"
p:extractStandardAttributes="%{sp.oidc.extractStandardAttributes:false}"/>
<bean id="OIDC.SSO" parent="AbstractOIDCSSOProfile" lazy-init="true"
class="net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration"
- p:authorizeCodeLifetime="%{sp.oidc.authorizeCode.defaultLifetime:PT5M}"
- p:encodeConsentInTokens="%{sp.oidc.encodeConsentInTokens:false}"
- p:encodedAttributes="%{sp.oidc.encodedAttributes:%{sp.oidc.embeddedAttributes:}}"
- p:deniedUserInfoAttributes="%{sp.oidc.deniedUserInfoAttributes:}"
+ p:encodedAttributes="%{sp.oidc.encodedAttributes:%{sp.oidc.embeddedAttributes:}}"
p:resolveAttributes="%{sp.oidc.resolveAttributes:true}"
p:httpRequestMethod="%{sp.oidc.httpRequestMethod:GET}"
p:retrieveUserInfoEndpointClaims="%{sp.oidc.userinfo.enabled:true}"
@@ -120,8 +101,7 @@
p:userInfoHttpRequestMethod="%{sp.oidc.userinfo.httpRequestMethod:GET}"
p:scopes="%{sp.oidc.scopes:#{null}}"
p:responseModes="%{sp.oauth2.responseModes:}"
- p:shouldValidateAcrValue="%{sp.oidc.idToken.validateAcrValue:true}"
- p:requireAuthenticationRequestPredicate-ref="%{sp.oauth2.requireAuthenticationRequestPredicate:shibboleth.Conditions.TRUE}">
+ p:shouldValidateAcrValue="%{sp.oidc.idToken.validateAcrValue:true}">
</bean>
<bean id="shibboleth.oidc.DefaultSecurityConfiguration"
diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
index f37bee7..89ab7d6 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCSessionInitiatorFlowTest.java
@@ -52,6 +52,7 @@ import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.pkce.CodeChallengeMethod;
import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
@@ -171,6 +172,32 @@ public class OIDCSessionInitiatorFlowTest extends AbstractSPFlowTest {
validateOutputMessage(result);
}
+ /**
+ * Basic flow test with PKCE
+ *
+ * @throws IOException on error
+ * @throws MessageDecodingException
+ */
+ @Test
+ public void testFlow_WithPKCE() throws IOException, MessageDecodingException {
+ setDefaultAuth();
+
+ final DDF input = new DDF(null).structure();
+ input.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
+ input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
+ input.addmember(SPConstants.TARGET).unsafe_string(RESOURCE_URL);
+ setApplicationRequest("test-oidc-application-with-pkce", input);
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertFlowExecutionResult(result, FLOW_ID);
+ assertFlowExecutionOutcome(result.getOutcome());
+
+ final AuthenticationRequest request = validateOutputMessage(result);
+ assertNotNull(request.getCodeChallenge());
+ assertNotNull(request.getCodeChallengeMethod());
+ assertNotNull(request.getCodeChallengeMethod().compareTo(CodeChallengeMethod.S256));
+ }
+
/**
* Basic flow test but where the resource URL is not supplied.
*
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
index 2a37f8f..0587107 100644
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
+++ b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-test-agents.xml
@@ -26,6 +26,9 @@
<bean p:id="test-oidc-application-without-ro" parent="shibboleth.sp.Application"
p:profileConfigurations-ref="test.ProfileConfigurations"/>
+
+ <bean p:id="test-oidc-application-with-pkce" parent="shibboleth.sp.Application"
+ p:profileConfigurations-ref="test.WithPKCE"/>
<!-- Test using a profile that requires a request object, also override the authenticatingAuthority just to check that -->
<bean p:id="test-oidc-application-with-ro" parent="shibboleth.sp.Application"
@@ -56,6 +59,14 @@
</bean>
</util:list>
+ <util:list id="test.WithPKCE">
+ <bean parent="OIDC.SSO" p:securityConfiguration-ref="testSecConfig" p:forcePKCE="true">
+ <property name="clientCredential">
+ <bean parent="shibboleth.oidc.ClientSecretCredential" p:secret="secret"/>
+ </property>
+ </bean>
+ </util:list>
+
<util:list id="test.RequestObjectProfileConfigurations">
<bean parent="OIDC.SSO" p:securityConfiguration-ref="testSecConfig" p:useRequestObject="true" p:signRequestObject="true" p:encryptRequestObject="false">
<property name="clientCredential">
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PKCEOptionsLookupStrategy.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PKCEOptionsLookupStrategy.java
index 2781286..c46f10d 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PKCEOptionsLookupStrategy.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PKCEOptionsLookupStrategy.java
@@ -41,7 +41,6 @@ public class PKCEOptionsLookupStrategy extends AbstractAgentAndRelyingPartyConte
if (rpConfig == null) {
return null;
}
- // If there is no other path, and the compiler can prove rpConfig is true, you can use it here.
final boolean enabled = rpConfig.isForcePKCE(PRC_LOOKUP.apply(messageContext));
final boolean allowPlain = rpConfig.isAllowPKCEPlain(PRC_LOOKUP.apply(messageContext));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list