[java-idp-plugin-oidc-op-oidfed] 01/01: Merge branch 'dev/CACHE-REFACTOR'

Codeberg noreply at shibboleth.net
Thu May 7 10:47:56 UTC 2026


This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/aa31c4f42e7c86c102d3e8829822e83fc262134f

commit aa31c4f42e7c86c102d3e8829822e83fc262134f
Merge: 958ce30 f6d3427
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu May 7 13:45:49 2026 +0300

    Merge branch 'dev/CACHE-REFACTOR'

 idp-oidfed-op-api/pom.xml                          |  10 -
 .../oidc/op/oidfed/metadata/BaseJWTWrapper.java    |  41 +-
 .../oidc/op/oidfed/metadata/BasePayload.java       |  38 +-
 .../op/oidfed/metadata/EntityConfiguration.java    |  10 +-
 .../oidc/op/oidfed/metadata/EntityStatement.java   |  37 +
 .../op/oidfed/metadata/ResolveEntityResponse.java  |  10 +-
 .../oidc/op/oidfed/metadata/SignedKeyset.java      |  11 +-
 .../op/oidfed/metadata/SubordinateStatement.java   |  10 +-
 .../plugin/oidc/op/oidfed/metadata/TrustMark.java  |  10 +-
 .../oidc/op/oidfed/metadata/TrustMarkStatus.java   |  10 +-
 .../payload/BaseExpirableSubjectPayload.java}      |  26 +-
 .../metadata/payload/BaseMetadataPayload.java      |  16 +-
 .../payload/EntityConfigurationPayload.java        |  67 ++
 .../metadata/payload/EntityStatementPayload.java   |  41 +
 .../payload/ResolveEntityResponsePayload.java      |  41 +
 .../metadata/payload/SignedKeysetPayload.java      |  19 +-
 .../payload/SubordinateStatementPayload.java       |  59 ++
 .../oidfed/metadata/payload/TrustMarkPayload.java  |  51 ++
 .../metadata/payload/TrustMarkStatusPayload.java   |  40 +
 .../op/oidfed/metadata/payload/claim/Metadata.java |  83 ++
 .../metadata/payload/claim/TrustMarkOwner.java     |  38 +-
 ...ration.java => ProvidedTrustChainResolver.java} |  21 +-
 ...nAutomaticRegistrationProfileConfiguration.java |  29 +
 ...tityStatementProducingProfileConfiguration.java |  30 +
 ...ederationResolveEntityProfileConfiguration.java |   6 +-
 ...ederationSignedKeysetProfileConfiguration.java} |  13 +-
 ...ionTrustMarkValidatingProfileConfiguration.java |  10 +
 ... => ClaimsSetDecorationTypeLookupFunction.java} |  21 +-
 .../EntityStatementLifetimeLookupFunction.java     |   7 +-
 ...tionalClaimsLookupStrategiesLookupFunction.java |   6 +-
 ...hainClaimsSetDecorationTypeLookupFunction.java} |  21 +-
 .../RemoteTrustMarkValidationPredicate.java        |  43 +
 .../context/AutomaticRegistrationContext.java      |  51 ++
 .../context/RelyingPartyTrustChainContext.java     |  72 +-
 .../oidfed/profile/context/VerifiedTrustChain.java |  76 ++
 .../navigate/TrustAnchorIdLookupFunction.java      |   3 +-
 .../oidfed/support/ClaimsSetExtensionSupport.java  |  51 +-
 .../support/ClientInformationExtensionSupport.java |   6 -
 idp-oidfed-op-impl/pom.xml                         |   5 +
 .../policyrule/impl/EntityTrustMarkPolicyRule.java |   4 +-
 .../ExplicitClientRegistrationRequestDecoder.java  |  36 +-
 .../decoding/impl/ResolveEntityRequestDecoder.java |  24 +-
 .../impl/EntityConfigurationResponse.java          |  55 ++
 .../impl/ExplicitClientRegistrationRequest.java    |  16 +-
 .../impl/ExplicitClientRegistrationResponse.java   |   1 +
 .../messaging/impl/ResolveEntityRequest.java       |  25 +-
 .../messaging/impl/SignedKeysetResponse.java       |  55 ++
 .../oidfed/messaging/impl/TrustMarkResponse.java   |  87 --
 .../messaging/impl/TrustMarkStatusRequest.java     |  72 --
 .../messaging/impl/TrustMarkStatusResponse.java    |  87 --
 ...ntityStatementSignatureValidationComponent.java |  47 --
 ...FederationEndpointResponseFetchingStrategy.java | 194 -----
 ...ityConfigurationEndpointExtractionStrategy.java |  82 --
 ...tyStatementContentValidationFilterStrategy.java |  83 --
 .../DefaultEntityStatementFetchingStrategy.java    | 171 ----
 ...atementSubjectIdentifierExtractionStrategy.java |  40 -
 ...IssuerEntityIDCriteriaToIdentifierStrategy.java |  42 -
 ...efaultProvidedTrustChainValidationStrategy.java | 135 ----
 ...eEntityRequestCriteriaToIdentifierStrategy.java |  42 -
 ...EntityResponseIdentifierExtractionStrategy.java |  38 -
 ...yResponseSignatureValidationFilterStrategy.java | 128 ---
 ...ultResolveEntityTrustChainFetchingStrategy.java | 122 ---
 ...ubjectEntityIDCriteriaToIdentifierStrategy.java |  42 -
 ...rdinateStatementEndpointExtractionStrategy.java | 149 ----
 ...inateStatementIdentifierExtractionStrategy.java |  43 -
 ...StatementSignatureValidationFilterStrategy.java | 116 ---
 .../DefaultTrustChainExpirationTimeStrategy.java   |  60 --
 .../DefaultTrustChainFetchingStrategy.java         | 382 ---------
 ...ChainTrustedTrustMarkIssuersLookupStrategy.java | 114 ---
 ...tChainTrustedTrustMarkOwnersLookupStrategy.java | 103 ---
 .../metadata/DefaultTrustMarkFetchingStrategy.java | 114 ---
 ...kResponseSignatureValidationFilterStrategy.java | 128 ---
 .../DefaultTrustMarkStatusFetchingStrategy.java    | 113 ---
 ...sResponseSignatureValidationFilterStrategy.java | 128 ---
 .../op/oidfed/metadata/EntityStatementHelper.java  | 200 -----
 .../oidfed/metadata/TrustMarkRequestCriterion.java |  79 --
 .../metadata/TrustMarkResponseContainer.java       |  75 --
 .../metadata/TrustMarkStatusRequestCriterion.java  |  80 --
 .../metadata/TrustMarkStatusResponseContainer.java |  69 --
 ...FederationEndpointResponseFetchingStrategy.java | 328 ++++++++
 ...actTrustEngineSignatureValidationComponent.java |   2 +-
 .../BaseExpirableMetadataContainer.java}           |  36 +-
 .../cache/BaseExpirableStatementContainer.java     |  97 +++
 ...icationSecurityConfigurationLookupFunction.java | 117 +++
 .../DefaultClientAuthenticationLookupFunction.java | 113 +++
 ...tEntityStatementContentValidationCondition.java | 181 +++++
 ...faultEntityStatementMetadataFilterStrategy.java | 120 +++
 ...ntityStatementSignatureValidationCondition.java |  96 +++
 ...atementValidationCriteriaSetLookupFunction.java | 116 +++
 ...tPrivateKeyJwtClientAuthenticationFunction.java | 315 ++++++++
 ...ltResponseContainerExpirationTimeStrategy.java} |  23 +-
 ...DefaultTrustChainHeaderValidationCondition.java | 196 +++++
 ...ederationEndpointEntityStatementCriterion.java} |  25 +-
 .../{ => cache}/IssuerEntityIDCriterion.java       |   9 +-
 .../IssuerEntityStatementCriterion.java            |  21 +-
 .../PreSelectedTrustChainCriterion.java            |   2 +-
 .../ResponseContainerExpirationCriterion.java      |   2 +-
 ...ignatureValidationKeyContainerJwtCriterion.java |   2 +-
 .../{ => cache}/SubjectEntityIDCriterion.java      |   6 +-
 .../SubjectEntityStatementCriterion.java           |  19 +-
 .../SubjectLocallyTrustedKeysCriterion.java        |   2 +-
 .../SubjectStatementCriterion.java}                |  32 +-
 .../{ => cache}/TrustAnchorEntityIDsCriterion.java |   2 +-
 .../metadata/{ => cache}/TrustMarkCriterion.java   |   2 +-
 .../{ => cache}/TrustMarkOwnersCriterion.java      |   9 +-
 ...tityConfigurationCriteriaSetLookupFunction.java |  47 ++
 ...DefaultEntityConfigurationFetchingStrategy.java | 138 ++++
 .../EntityConfigurationContainer.java              |  59 ++
 .../ProvidedEntityConfigurationContainer.java      |  54 ++
 ...videdEntityConfigurationContainerCriterion.java |  88 ++
 ...faultSignedKeysetCriteriaSetLookupFunction.java |  49 ++
 .../DefaultSignedKeysetFetchingStrategy.java       | 145 ++++
 .../cache/keyset/SignedKeysetCacheIdentifier.java  | 105 +++
 .../cache/keyset/SignedKeysetContainer.java        |  68 ++
 .../keyset/SubjectSignedKeysetCriterion.java}      |  31 +-
 .../keyset/SubjectSignedKeysetUriCriterion.java}   |  24 +-
 ...onfigurationMetadataSkeletonLookupStrategy.java |  18 +-
 ...ntityConfigurationResponseFetchingStrategy.java |   3 +-
 ...StatementSignatureValidationFilterStrategy.java |  17 +-
 .../local}/DefaultLocalTrustAnchorsValidator.java  |   2 +-
 ...busResponseContainerExpirationTimeStrategy.java |   4 +-
 ...faultResolveEntityResponseFetchingStrategy.java |   3 +-
 .../{ => cache/local}/LocalKeyContainer.java       |   8 +-
 .../{ => cache/local}/NimbusResponseContainer.java |   2 +-
 .../{ => cache/local}/NimbusResponseCriterion.java |   2 +-
 .../local}/ResolveEntityRequestCriterion.java      |   2 +-
 .../local}/ResolveEntityResponseContainer.java     |   2 +-
 ...ultResolveEntityTrustChainFetchingStrategy.java | 162 ++++
 .../ResolveEntityCacheContainerIdentifier.java}    |  56 +-
 .../ResolveEntityCacheIdentifierCriterion.java}    |  33 +-
 .../resolver/ResolveEntityResponseContainer.java   |  69 ++
 ...inateStatementCriteriaToIdentifierStrategy.java |  14 +-
 ...efaultSubordinateStatementFetchingStrategy.java | 236 ++++++
 .../SubordinateStatementCacheIdentifier.java       | 103 +++
 .../subordinate/SubordinateStatementContainer.java |  69 ++
 .../DefaultTrustChainFetchingStrategy.java         | 463 +++++++++++
 ...rustChainSignatureValidationFilterStrategy.java | 100 ++-
 ...stChainSubjectIdentifierExtractionStrategy.java |  12 +-
 .../trustchain/ProvidedTrustChainContainer.java    |  49 ++
 .../ProvidedTrustChainContainerCriterion.java}     |  34 +-
 .../cache/trustchain/TrustChainsContainer.java     |  98 +++
 .../DefaultTrustMarkFetchingStrategy.java          | 158 ++++
 .../DefaultTrustMarkStatusFetchingStrategy.java    | 144 ++++
 ...ustMarkValidationCriteriaSetLookupFunction.java | 124 +++
 .../cache/trustmark/TrustMarkCacheIdentifier.java} |  57 +-
 .../cache/trustmark/TrustMarkContainer.java        |  68 ++
 .../trustmark/TrustMarkIdentifierCriterion.java}   |  34 +-
 .../trustmark/TrustMarkStatusCacheIdentifier.java  | 103 +++
 .../cache/trustmark/TrustMarkStatusContainer.java  |  80 ++
 .../TrustMarkStatusIdentifierCriterion.java}       |  35 +-
 .../constraints/FederationPolicyConstraint.java    |  15 +-
 .../FederationPolicyConstraintHelper.java          |  53 +-
 .../impl/AbstractFederationPolicyConstraint.java   |  17 +-
 .../impl/DefaultAllowedEntityTypesConstraint.java  |  80 +-
 .../impl/DefaultMaxPathLengthConstraint.java       |  21 +-
 .../impl/DefaultNamingConstraintsConstraint.java   |  14 +-
 .../metadata/impl/AbstractJWTWrapperImpl.java      |  92 +++
 .../metadata/impl/EntityConfigurationImpl.java     |  65 ++
 .../oidfed/metadata/impl/EntityStatementImpl.java  |  59 ++
 .../metadata/impl/ResolveEntityResponseImpl.java   |  64 ++
 .../op/oidfed/metadata/impl/SignedKeysetImpl.java  |  63 ++
 .../metadata/impl/SubordinateStatementImpl.java    |  64 ++
 .../op/oidfed/metadata/impl/TrustMarkImpl.java     |  63 ++
 .../oidfed/metadata/impl/TrustMarkStatusImpl.java  |  64 ++
 .../metadata/jackson/InstantDeserializer.java      |  52 ++
 .../oidfed/metadata/jackson/JWKDeserializer.java   |  72 ++
 .../metadata/jackson/JWKSetDeserializer.java       |  72 ++
 .../LocalKeyContainerDeserializer.java}            |   9 +-
 .../metadata/payload/claim/impl/MetadataImpl.java  | 293 +++++++
 .../payload/claim/impl/TrustMarkOwnerImpl.java     | 120 +++
 .../impl/BaseExpirableSubjectPayloadImpl.java      | 102 +++
 .../payload/impl/BaseMetadataPayloadImpl.java      |  66 ++
 .../metadata/payload/impl/BasePayloadImpl.java     | 131 +++
 .../impl/EntityConfigurationPayloadImpl.java       | 186 +++++
 .../payload/impl/EntityStatementPayloadImpl.java   | 108 +++
 .../impl/ResolveEntityResponsePayloadImpl.java     | 106 +++
 .../payload/impl/SignedKeysetPayloadImpl.java      |  82 ++
 .../impl/SubordinateStatementPayloadImpl.java      | 161 ++++
 .../payload/impl/TrustMarkPayloadImpl.java         | 149 ++++
 .../payload/impl/TrustMarkStatusPayloadImpl.java   | 101 +++
 .../policy/FederationMetadataPolicyOperator.java   |   8 +
 ...DefaultFederationMetadataPolicyAddOperator.java |   6 +
 ...ultFederationMetadataPolicyDefaultOperator.java |   6 +
 ...tFederationMetadataPolicyEssentialOperator.java |   6 +
 ...faultFederationMetadataPolicyOneOfOperator.java |   6 +
 ...ltFederationMetadataPolicySubsetOfOperator.java |   6 +
 ...FederationMetadataPolicySupersetOfOperator.java |   6 +
 ...faultFederationMetadataPolicyValueOperator.java |   6 +
 .../metadata/util/EntityStatementHelper.java       | 203 +++++
 .../idp/plugin/oidc/op/oidfed/package-info.java    |   2 +-
 ...FederationRegistrationProfileConfiguration.java |  32 +
 ...nAutomaticRegistrationProfileConfiguration.java |  69 ++
 ...ionEntityConfigurationProfileConfiguration.java |   6 +-
 ...onExplicitRegistrationProfileConfiguration.java |  78 ++
 ...ederationResolveEntityProfileConfiguration.java | 152 +++-
 ...ederationSignedKeysetProfileConfiguration.java} |  80 +-
 .../impl/AbstractBuildEntityStatementAction.java   |   3 +-
 .../impl/AbstractTokenClaimsSetDecorator.java      | 123 +++
 .../impl/AbstractTrustChainResolutionAction.java   | 110 ++-
 .../impl/AddExtensionsToClientInformation.java     |  15 +-
 ...edClientInformationStoreClaimsSetDecorator.java | 145 ++++
 ...redTrustChainAccessTokenClaimsSetDecorator.java |  54 +-
 ...stChainAuthorizationCodeClaimsSetDecorator.java |  54 +-
 ...RegisteredTrustChainIDsClaimsSetDecorator.java} |  16 +-
 ...edTrustChainRefreshTokenClaimsSetDecorator.java |  54 +-
 ...eredTrustChainRequestUriClaimsSetDecorator.java |  52 +-
 .../profile/impl/BuildEntityConfiguration.java     |  17 +-
 .../BuildResolveEntityErrorResponseFromEvent.java  |  16 +-
 .../profile/impl/BuildResolveEntityResponse.java   |  33 +-
 .../op/oidfed/profile/impl/BuildSignedKeyset.java  | 140 ++++
 .../oidfed/profile/impl/CallResolveEntityApi.java  | 140 ++--
 .../impl/DefaultProvidedTrustChainResolver.java    | 116 +++
 ...TrustMarkFromMetadataCacheFetchingFunction.java | 103 +--
 .../profile/impl/EntityStatementContext.java       |  38 +-
 .../impl/FormExplicitRegistrationResponse.java     |  18 +-
 ...ormOutboundFederationConfigurationResponse.java |  21 +-
 .../impl/FormOutboundResolveEntityResponse.java    |  11 +-
 ....java => FormOutboundSignedKeysetResponse.java} |  27 +-
 .../impl/InitializeEntityStatementContext.java     |  10 +-
 .../InitializeEntityStatementContextForKeyset.java | 189 +++++
 ...sponse.java => LookupCachedNimbusResponse.java} |  16 +-
 .../impl/LookupCachedResolveEntityResponse.java    |  10 +-
 .../oidfed/profile/impl/OidFederationEventIds.java |  28 +-
 .../op/oidfed/profile/impl/ResolveTrustChains.java |  35 +-
 .../op/oidfed/profile/impl/ResolveTrustMarks.java  |  81 +-
 .../op/oidfed/profile/impl/SelectTrustChain.java   |  24 +-
 .../profile/impl/StoreAutomaticRegistration.java   |  10 +-
 ...eAutomaticRegistrationProfileConfiguration.java | 113 ++-
 .../impl/ValidateProvidedEntityConfiguration.java  |  13 +-
 .../profile/impl/ValidateProvidedTrustChain.java   | 123 ++-
 .../profile/impl/ValidateResolveEntityRequest.java |   8 +-
 .../profile/impl/ValidateSelectedTrustChain.java   |  36 +-
 .../op/oidfed/profile/impl/ValidateTrustMarks.java | 247 ++++++
 ...videdEntityConfigurationValidationStrategy.java |  97 +++
 ...efaultProvidedTrustChainValidationStrategy.java |  96 +++
 ...actRequestObjectProvidedTrustChainResolver.java | 146 ++++
 ...ionRequestObjectProvidedTrustChainResolver.java |  43 +
 ...mbinedMetadataFromTrustChainLookupStrategy.java |  45 +-
 .../DefaultMetadataValidationCondition.java        |   1 +
 ...aultPreSelectedTrustChainIDsLookupStrategy.java |   3 -
 ...ionRequestObjectProvidedTrustChainResolver.java |  45 ++
 ...DefaultSelectedTrustChainIDsLookupStrategy.java |   9 +-
 ...dTrustChainImmediateSuperiorLookupStrategy.java |   5 +-
 ...ltSelectedTrustChainMetadataLookupStrategy.java |  11 +-
 ...electedTrustChainTrustAnchorLookupStrategy.java |   4 +-
 .../DefaultTrustAnchorHintsLookupStrategy.java     |   4 +-
 .../DefaultTrustChainIDsLookupStrategy.java        |   8 +-
 ...ultTrustChainMetadataPolicyMergingStrategy.java |  97 +--
 .../DefaultTrustChainSelectionStrategy.java        |  24 +-
 ...DefaultTrustChainTrustMarksParsingStrategy.java |  89 +--
 ...ChainTrustedTrustMarkIssuersLookupStrategy.java |  66 ++
 ...tChainTrustedTrustMarkOwnersLookupStrategy.java |  61 ++
 ...tRegistrationRequestClientIDLookupFunction.java |  11 +-
 ...onRequestEntityConfigurationLookupFunction.java |   7 +-
 ...entRegistrationRequestJWKSetLookupFunction.java |  11 +-
 ...ientRegistrationRequestTrustChainResolver.java} |  31 +-
 ...ormationFederationEntityCredentialResolver.java | 127 +++
 ...ientInformationSignedKeysetJWKSetDecorator.java | 174 ++++
 ...faultEntityConfigurationCredentialResolver.java |  21 +-
 .../DefaultLocalTrustAnchorCredentialResolver.java |   6 +-
 ...DefaultPayloadJOSEObjectCredentialResolver.java |  10 +-
 ...yloadSignatureValidationCredentialResolver.java |  12 +-
 ...aultSubordinateStatementCredentialResolver.java |  54 +-
 .../DefaultTrustMarkOwnerCredentialResolver.java   |  24 +-
 .../DefaultTrustMarkStatusCredentialResolver.java} |  55 +-
 ...ticationSignatureSigningParametersResolver.java | 117 +++
 .../impl/ConstraintsSyntaxClaimsValidator.java     | 100 +++
 .../jwt/claims/impl/CritClaimsValidator.java       |  97 +++
 ...faultMetadataPolicyOperatorsLookupStrategy.java | 103 +++
 .../impl/MetadataPolicyCritClaimsValidator.java    | 105 +++
 .../impl/NonEmptyStringArrayClaimsValidator.java   |  88 ++
 .../impl/TrustMarkOwnersClaimsValidator.java       |  81 ++
 .../jwt/claims/impl/TrustMarksClaimsValidator.java | 109 +++
 .../META-INF/net.shibboleth.idp/postconfig.xml     | 883 ++++++++++++++++++---
 .../oidfed/metadata-lookup-ext-oidfed-beans.xml    | 104 ++-
 .../oidfed/metadata-lookup-ext-oidfed-flow.xml     |  18 +-
 .../entity-configuration-beans.xml                 |  10 +-
 .../entity-configuration-flow.xml                  |   4 +-
 .../idp/flows/oidfed/register/register-beans.xml   | 167 ++--
 .../oidfed/resolve-entity/resolve-entity-beans.xml |  47 +-
 .../oidfed/resolve-entity/resolve-entity-flow.xml  |  53 +-
 .../signed-keyset-beans.xml}                       |  53 +-
 .../signed-keyset-flow.xml}                        |  12 +-
 .../idp/service/relying-party/postconfig.xml       |  45 +-
 .../plugin/oidc/op/oidfed/TrustChainTestUtil.java  |  76 +-
 .../DefaultTrustChainFetchingStrategyTest.java     | 365 +++++++++
 .../flow/oidfed/AbstractFederationFlowTest.java    | 237 ++++--
 .../AuthorizeFlowAutomaticRegistrationTest.java    | 236 +++++-
 .../flow/oidfed/EntityConfigurationFlowTest.java   |  63 +-
 ...shedAuthorizeFlowAutomaticRegistrationTest.java | 106 +++
 .../profile/flow/oidfed/RegistrationFlowTest.java  | 135 +++-
 .../profile/flow/oidfed/ResolveEntityFlowTest.java | 232 +++++-
 .../profile/flow/oidfed/SignedKeysetFlowTest.java  | 146 ++++
 .../oidfed/TokenFlowAutomaticRegistrationTest.java |  66 +-
 .../UserInfoFlowAutomaticRegistrationTest.java     |  18 +-
 .../EntityConfigurationMetadataCacheTest.java      | 374 ++++++++-
 .../cache/SignedKeysetMetadataCacheTest.java       | 233 ++++++
 .../SubordinateStatementMetadataCacheTest.java     | 665 ++++++++++++++++
 .../oidfed/cache/TrustChainMetadataCacheTest.java  | 274 +++++++
 .../CustomEntityConfigurationFilterStrategy.java   |  58 ++
 .../CustomSubordinateStatementFilterStrategy.java  |  58 ++
 .../support/CustomTrustChainFilterStrategy.java    |  47 ++
 .../credentials/fed-local-intermediate.jwk         |  12 +
 .../net/shibboleth/idp/module/conf/global.xml      |  18 +
 .../module/conf/oidfed/oidfed-trust-anchors.json   |  11 +
 .../idp/module/conf/oidfed/oidfed.properties       |  13 +-
 .../shibboleth/idp/module/conf/relying-party.xml   |  10 +
 pom.xml                                            |  11 +-
 308 files changed, 16948 insertions(+), 5339 deletions(-)

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list