[java-oidfed-common] 02/03: New 'oidfed-common-conf-impl' module for common configuration
Codeberg
noreply at shibboleth.net
Fri May 15 07:49:30 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-oidfed-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/5e2200fa113ca50addfb3162c7478ba3018df549
commit 5e2200fa113ca50addfb3162c7478ba3018df549
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 15 10:00:29 2026 +0300
New 'oidfed-common-conf-impl' module for common configuration
- Move global bean configurations from oidfed-common-impl
- Import generic relying-party beans (security configuration + OIDFED.Configuration) from java-idp-plugin-oidc-op-oidfed
---
oidfed-common-conf-impl/pom.xml | 483 +++++++++++++++
.../META-INF/net.shibboleth.idp/postconfig.xml | 673 +++++----------------
.../idp/service/relying-party/postconfig.xml | 108 ++++
pom.xml | 1 +
4 files changed, 754 insertions(+), 511 deletions(-)
diff --git a/oidfed-common-conf-impl/pom.xml b/oidfed-common-conf-impl/pom.xml
new file mode 100644
index 0000000..1b605c6
--- /dev/null
+++ b/oidfed-common-conf-impl/pom.xml
@@ -0,0 +1,483 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>net.shibboleth.oidfed</groupId>
+ <artifactId>oidfed-common-parent</artifactId>
+ <version>1.0.0-SNAPSHOT</version>
+ </parent>
+
+ <artifactId>oidfed-common-conf-impl</artifactId>
+ <packaging>jar</packaging>
+ <name>Shibboleth IdP :: Plugins :: OpenID Federation Common Library :: Configuration</name>
+ <description>Configuration for the Shibboleth OIDFed Java common library</description>
+
+ <properties>
+ <checkstyle.configLocation>${project.basedir}/../resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
+ <automatic.module.name>net.shibboleth.oidfed.impl</automatic.module.name>
+ </properties>
+
+ <dependencies>
+ <dependency>
+ <groupId>${project.groupId}</groupId>
+ <artifactId>oidfed-common-api</artifactId>
+ <version>${project.version}</version>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${project.groupId}</groupId>
+ <artifactId>oidfed-common-impl</artifactId>
+ <version>${project.version}</version>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-crypto-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-crypto-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-metadata-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-metadata-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-attribute-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-attribute-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-profile-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-admin-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-admin-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-authn-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-authn-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-profile-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-saml-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-session-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-ui</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-profile.groupId}</groupId>
+ <artifactId>shib-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-profile.groupId}</groupId>
+ <artifactId>shib-profile-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-profile.groupId}</groupId>
+ <artifactId>shib-saml-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-attribute.groupId}</groupId>
+ <artifactId>shib-attribute-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-attribute.groupId}</groupId>
+ <artifactId>shib-attribute-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-core-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-messaging-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-saml-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-security-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-storage-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-xmlsec-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-xmlsec-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-spring</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-service</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-networking</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-support</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-security</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.nimbusds</groupId>
+ <artifactId>oauth2-oidc-sdk</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-storage-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-core</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${slf4j.groupId}</groupId>
+ <artifactId>jcl-over-slf4j</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.google.guava</groupId>
+ <artifactId>guava</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.google.code.findbugs</groupId>
+ <artifactId>jsr305</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${spring.groupId}</groupId>
+ <artifactId>spring-web</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>commons-codec</groupId>
+ <artifactId>commons-codec</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${spring.groupId}</groupId>
+ <artifactId>spring-context</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-attribute-filter-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-attribute.groupId}</groupId>
+ <artifactId>shib-attribute-filter-spring</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>net.minidev</groupId>
+ <artifactId>json-smart</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${spring.groupId}</groupId>
+ <artifactId>spring-core</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.nimbusds</groupId>
+ <artifactId>nimbus-jose-jwt</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.nimbusds</groupId>
+ <artifactId>content-type</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>jakarta.servlet</groupId>
+ <artifactId>jakarta.servlet-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>jakarta.json</groupId>
+ <artifactId>jakarta.json-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${spring.groupId}</groupId>
+ <artifactId>spring-beans</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${spring-webflow.groupId}</groupId>
+ <artifactId>spring-webflow</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${spring-webflow.groupId}</groupId>
+ <artifactId>spring-binding</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${httpclient.groupId}</groupId>
+ <artifactId>${httpclient.artifactId}</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>${httpclient.httpcore.groupId}</groupId>
+ <artifactId>${httpclient.httpcore.artifactId}</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <!-- Test dependencies -->
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-crypto-impl</artifactId>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-saml-api</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${oidc-common.groupId}</groupId>
+ <artifactId>oidc-common-saml-impl</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-schema</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-spring</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-testing</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-profile-testing</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-attribute.groupId}</groupId>
+ <artifactId>shib-attribute-filter-impl</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-messaging-impl</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-core-impl</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-testing</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${spring.groupId}</groupId>
+ <artifactId>spring-test</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-conf-impl</artifactId>
+ <version>${idp.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-conf-impl</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-attribute-filter-spring</artifactId>
+ <version>${shib-attribute.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-attribute.groupId}</groupId>
+ <artifactId>shib-attribute-resolver-spring</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-profile-impl</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-testing</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-cli</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-networking-spring</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-security-spring</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.unboundid</groupId>
+ <artifactId>unboundid-ldapsdk</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.codehaus.janino</groupId>
+ <artifactId>janino</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <!-- Spring webflow tests require Junit4, runs in TestNG bridge -->
+ <dependency>
+ <groupId>junit</groupId>
+ <artifactId>junit</artifactId>
+ <version>4.13.2</version>
+ <scope>test</scope>
+ </dependency>
+ <!--
+ <dependency>
+ <groupId>com.squareup.okhttp3</groupId>
+ <artifactId>mockwebserver</artifactId>
+ <scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>junit</groupId>
+ <artifactId>junit</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>com.squareup.okhttp3</groupId>
+ <artifactId>okhttp-tls</artifactId>
+ <scope>test</scope>
+ </dependency>
+ -->
+ <dependency>
+ <groupId>org.openjdk.nashorn</groupId>
+ <artifactId>nashorn-core</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>commons-io</groupId>
+ <artifactId>commons-io</artifactId>
+ <scope>test</scope>
+ </dependency>
+ </dependencies>
+
+</project>
diff --git a/oidfed-common-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
similarity index 56%
rename from oidfed-common-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
rename to oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index b43cf42..36815f0 100644
--- a/oidfed-common-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/oidfed-common-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -9,81 +9,53 @@
default-init-method="initialize" default-destroy-method="destroy">
- <bean id="shibboleth.oidfed.DefaultOpenIdConfigurationResolver"
- class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.DynamicFilesystemProviderMetadataResolver"
- p:minRefreshDelay="%{idp.oidc.config.minRefreshDelay:PT5M}"
- p:maxRefreshDelay="%{idp.oidc.config.maxRefreshDelay:PT4H}"
- c:metadata="#{getObject('shibboleth.oidfed.OpenIDConfiguration') ?: getObject('DefaultMetadataSkeleton')}"
- p:dynamicValueResolvers-ref="#{'%{idp.oidfed.configuration.resolver.values:shibboleth.oidfed.configuration.DefaultDynamicValueResolvers}'.trim()}"/>
+ <bean id="shibboleth.oidfed.entityId" class="java.lang.String" c:_0="%{idp.oidfed.entityID:%{idp.entityID}}" />
- <bean id="shibboleth.oidfed.configuration.DefaultDynamicValueResolvers"
- parent="shibboleth.oidc.discovery.DefaultDynamicValueResolvers"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map merge="true">
- <entry key="federation_registration_endpoint" value-ref="shibboleth.oidfed.configuration.FederationRegistrationEndpointResolver" />
- <entry key="client_registration_types_supported" value-ref="shibboleth.oidfed.configuration.RegistrationTypesResolver" />
- </map>
- </property>
- </bean>
+ <bean id="shibboleth.oidfed.DefaultIdentifierGenerationStrategy"
+ class="net.shibboleth.profile.config.navigate.IdentifierGenerationStrategyLookupFunction"
+ p:defaultIdentifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy" />
- <bean id="shibboleth.oidfed.configuration.FederationRegistrationEndpointResolver"
- class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.FunctionMetadataValueResolver">
- <property name="resolverFunction">
- <bean parent="shibboleth.Functions.Expression"
- c:expression="#custom.get().getRequestURL().toString().replace('/profile/oidfed/entity-configuration','/profile/oidfed/register').replace('/.well-known/openid-federation','/profile/oidfed/register')"
- p:customObject-ref="shibboleth.HttpServletRequestSupplier" />
- </property>
- </bean>
+ <bean id="shibboleth.oidfed.cacheFactory"
+ class="net.shibboleth.oidc.metadata.cache.impl.MetadataCacheBuilder$Builder"/>
- <bean id="shibboleth.oidfed.configuration.RegistrationTypesResolver"
- class="net.shibboleth.idp.plugin.oidc.op.metadata.impl.FunctionMetadataValueResolver">
- <property name="resolverFunction">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.util.List" factory-method="copyOf">
- <constructor-arg value="%{idp.oidfed.entityConfiguration.registrationTypesSupported:automatic,explicit}" />
- </bean>
- </constructor-arg>
- </bean>
- </property>
- </bean>
+ <bean id="shibboleth.oidfed.CacheBuilder" factory-bean="shibboleth.oidfed.cacheFactory" factory-method="build"
+ abstract="true"/>
- <bean id="shibboleth.oidfed.EntityConfigurationMetadataCache" parent="shibboleth.oidc.CacheBuilder">
+ <bean id="shibboleth.oidfed.EntityConfigurationMetadataCache" parent="shibboleth.oidfed.CacheBuilder">
<constructor-arg>
<bean p:cacheId="DefaultEntityConfigurationMetadataCache" parent="shibboleth.oidfed.EntityConfigurationMetadataCacheBuilderSpec"
p:cleanupTaskInterval="%{idp.oidfed.cache.entityConfiguration.cleanupTaskInterval:PT5M}"/>
</constructor-arg>
</bean>
- <bean id="shibboleth.oidfed.SubordinateEntityStatementMetadataCache" parent="shibboleth.oidc.CacheBuilder">
+ <bean id="shibboleth.oidfed.SubordinateEntityStatementMetadataCache" parent="shibboleth.oidfed.CacheBuilder">
<constructor-arg>
<bean p:cacheId="DefaultSubordinateEntityStarementMetadataCache" parent="shibboleth.oidfed.SubordinateEntityStatementMetadataCacheBuilderSpec"
p:cleanupTaskInterval="%{idp.oidfed.cache.subordinateStatement.cleanupTaskInterval:PT5M}"/>
</constructor-arg>
</bean>
- <bean id="shibboleth.oidfed.TrustChainMetadataCache" parent="shibboleth.oidc.CacheBuilder">
+ <bean id="shibboleth.oidfed.TrustChainMetadataCache" parent="shibboleth.oidfed.CacheBuilder">
<constructor-arg>
<bean p:cacheId="DefaultTrustChainMetadataCache" parent="shibboleth.oidfed.TrustChainMetadataCacheBuilderSpec"
p:cleanupTaskInterval="%{idp.oidfed.cache.trustChain.cleanupTaskInterval:PT5M}"/>
</constructor-arg>
</bean>
- <bean id="shibboleth.oidfed.ResolveEntityTrustChainMetadataCache" parent="shibboleth.oidc.CacheBuilder">
+ <bean id="shibboleth.oidfed.ResolveEntityTrustChainMetadataCache" parent="shibboleth.oidfed.CacheBuilder">
<constructor-arg>
<bean p:cacheId="DefaultResolveEntityTrustChainMetadataCache" parent="shibboleth.oidfed.ResolveEntityTrustChainMetadataCacheBuilderSpec"
p:cleanupTaskInterval="%{idp.oidfed.cache.resolveEntity.cleanupTaskInterval:PT5M}"/>
</constructor-arg>
</bean>
- <bean id="shibboleth.oidfed.LocalTrustAnchorsMetadataCache" parent="shibboleth.oidc.CacheBuilder">
+ <bean id="shibboleth.oidfed.LocalTrustAnchorsMetadataCache" parent="shibboleth.oidfed.CacheBuilder">
<constructor-arg>
<bean p:cacheId="DefaultLocalTrustAnchorsMetadataCache" parent="shibboleth.oidfed.LocalTrustAnchorsMetadataCacheBuilderSpec"/>
</constructor-arg>
</bean>
- <bean id="shibboleth.oidfed.SignedKeysetMetadataCache" parent="shibboleth.oidc.CacheBuilder">
+ <bean id="shibboleth.oidfed.SignedKeysetMetadataCache" parent="shibboleth.oidfed.CacheBuilder">
<constructor-arg>
<bean p:cacheId="DefaultSignedKeysetMetadataCache" parent="shibboleth.oidfed.SignedKeysetMetadataCacheBuilderSpec"
p:cleanupTaskInterval="%{idp.oidfed.cache.signedKeyset.cleanupTaskInterval:PT5M}"/>
@@ -91,7 +63,7 @@
</bean>
<bean id="DefaultResponseContainerExpirationTimeStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultResponseContainerExpirationTimeStrategy"/>
+ class="net.shibboleth.oidfed.metadata.cache.DefaultResponseContainerExpirationTimeStrategy"/>
<bean id="shibboleth.oidfed.EntityConfigurationMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
@@ -103,7 +75,7 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.DefaultEntityConfigurationFetchingStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.configuration.DefaultEntityConfigurationFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
@@ -131,21 +103,21 @@
</bean>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.entityConfiguration.customFilterStrategies:}'.trim())}">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.DefaultEntityConfigurationCriteriaSetLookupFunction"/>
+ <bean class="net.shibboleth.oidfed.metadata.cache.configuration.DefaultEntityConfigurationCriteriaSetLookupFunction"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.entityConfiguration.claimsValidator:shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
<property name="headerValidator">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
</property>
<property name="containerIdValidationStrategy">
@@ -184,12 +156,12 @@
p:prohibitedClaims="source_endpoint" />
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
p:prohibitedClaims="aud" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.CritClaimsValidator"
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.CritClaimsValidator"
p:recognizedClaims="%{idp.oidfed.cache.entityConfiguration.critClaims:%{idp.oidfed.cache.default.critClaims:}}" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.TrustMarksClaimsValidator" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.NonEmptyStringArrayClaimsValidator"
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.TrustMarksClaimsValidator" />
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.NonEmptyStringArrayClaimsValidator"
p:nonEmptyArrayClaims="authority_hints,trust_anchor_hints" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.TrustMarkOwnersClaimsValidator" />
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.TrustMarkOwnersClaimsValidator" />
</util:list>
</property>
</bean>
@@ -197,25 +169,25 @@
<bean id="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultEntityConfigurationCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultEntityConfigurationCredentialResolver" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
<bean id="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine"
class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultSubordinateStatementCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultSubordinateStatementCredentialResolver" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
<bean id="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
- parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion))?.getValue()"/>
+ parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion))?.getValue()"/>
<bean id="shibboleth.oidfed.SubordinateEntityStatementMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
@@ -226,31 +198,31 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
</property>
<property name="criteriaToIdentifierStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate.DefaultSubordinateStatementCriteriaToIdentifierStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.subordinate.DefaultSubordinateStatementCriteriaToIdentifierStrategy"
p:criteriaToSubjectEntityIdStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy">
<property name="criteriaToIssuerEntityIdStrategy">
<bean parent="shibboleth.Functions.Expression"
- c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion))?.getValue()"/>
+ c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.IssuerEntityIDCriterion))?.getValue()"/>
</property>
</bean>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.subordinateStatement.customFilterStrategies:}'.trim())}">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementValidationCriteriaSetLookupFunction"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementValidationCriteriaSetLookupFunction"
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.subordinateStatement.claimsValidator:shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
<property name="headerValidator">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
</property>
<property name="containerIdValidationStrategy">
@@ -262,7 +234,7 @@
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate.DefaultSubordinateStatementFetchingStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.subordinate.DefaultSubordinateStatementFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"
@@ -289,10 +261,10 @@
</bean>
</property>
<property name="clientAuthenticationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
<property name="supportedAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_fetch_endpoint_auth_methods')" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_fetch_endpoint_auth_methods')" />
</property>
</bean>
</property>
@@ -301,24 +273,24 @@
</bean>
<util:list id="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultPrivateKeyJwtClientAuthenticationFunction"
- p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}">
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultPrivateKeyJwtClientAuthenticationFunction"
+ p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidfed.JSONObjectMapper}'.trim()}">
<property name="typeHeaderLookupStrategy">
<bean parent="shibboleth.Functions.Expression" c:expression="#null" />
</property>
<property name="audienceLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getSubject()" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getSubject()" />
</property>
<property name="issuerLookupStrategy">
<bean parent="shibboleth.Functions.Constant"
- c:target-ref="shibboleth.oidc.issuer" />
+ c:target-ref="shibboleth.oidfed.entityId" />
</property>
<property name="securityConfigurationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultAuthenticationSecurityConfigurationLookupFunction"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultAuthenticationSecurityConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyResolverService" />
</property>
<property name="signatureSigningParametersResolver">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jose.impl.EndpointAuthenticationSignatureSigningParametersResolver">
+ <bean class="net.shibboleth.oidfed.security.jose.impl.EndpointAuthenticationSignatureSigningParametersResolver">
<constructor-arg index="0" value="%{idp.oidfed.cache.clientauthentication.jwt.defaultalg:RS256}" />
</bean>
</property>
@@ -342,16 +314,16 @@
p:requiredClaims="jwks" />
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.CritClaimsValidator"
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.CritClaimsValidator"
p:recognizedClaims="%{idp.oidfed.cache.subordinateStatement.critClaims:%{idp.oidfed.cache.default.critClaims:}}" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.MetadataPolicyCritClaimsValidator">
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.MetadataPolicyCritClaimsValidator">
<property name="supportedOperatorsLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.DefaultMetadataPolicyOperatorsLookupStrategy"
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.DefaultMetadataPolicyOperatorsLookupStrategy"
p:defaultSupportedOperators-ref="#{'%{idp.oidfed.authorize.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}">
<property name="supportedOperators">
<util:map>
- <entry key="net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest" value-ref="#{'%{idp.oidfed.resolve-entity.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}" />
- <entry key="net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationRequest" value-ref="#{'%{idp.oidfed.register.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}" />
+ <entry key="net.shibboleth.oidfed.messaging.impl.ResolveEntityRequest" value-ref="#{'%{idp.oidfed.resolve-entity.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}" />
+ <entry key="net.shibboleth.oidfed.messaging.impl.ExplicitClientRegistrationRequest" value-ref="#{'%{idp.oidfed.register.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}" />
</util:map>
</property>
</bean>
@@ -369,7 +341,7 @@
p:prohibitedClaims="trust_mark_owners" />
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
p:prohibitedClaims="aud" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.ConstraintsSyntaxClaimsValidator"/>
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.ConstraintsSyntaxClaimsValidator"/>
</util:list>
</property>
</bean>
@@ -384,28 +356,28 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.DefaultTrustChainSignatureValidationFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.trustchain.DefaultTrustChainSignatureValidationFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.trustChain.customFilterStrategies:}'.trim())}">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadSignatureValidationCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadSignatureValidationCredentialResolver" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
</property>
<property name="entityStatementSignatureValidationFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy">
+ <bean class="net.shibboleth.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultLocalTrustAnchorCredentialResolver"
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultLocalTrustAnchorCredentialResolver"
c:cache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
</property>
@@ -414,7 +386,7 @@
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.DefaultTrustChainFetchingStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.trustchain.DefaultTrustChainFetchingStrategy"
p:criteriaToSubjectEntityIdStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"
p:subordinateStatementCache-ref="shibboleth.oidfed.SubordinateEntityStatementMetadataCache"
@@ -443,24 +415,24 @@
p:maxCacheDuration="%{idp.oidfed.cache.resolveEntity.maxRefreshDelay:PT30M}"
p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver.ResolveEntityCacheIdentifierCriterion))?.getIdentifier()"/>
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.resolver.ResolveEntityCacheIdentifierCriterion))?.getIdentifier()"/>
</property>
<property name="identifierExtractionStrategy">
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.resolveEntity.customFilterStrategies:}'.trim())}">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementValidationCriteriaSetLookupFunction"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementValidationCriteriaSetLookupFunction"
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.remoteResolver.claimsValidator:shibboleth.oidfed.DefaultResolveEntityResponseClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
<property name="headerValidator">
@@ -475,7 +447,7 @@
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver.DefaultResolveEntityTrustChainFetchingStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.resolver.DefaultResolveEntityTrustChainFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
@@ -501,10 +473,10 @@
</bean>
</property>
<property name="clientAuthenticationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
<property name="supportedAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_resolve_entity_endpoint_auth_methods')" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_resolve_entity_endpoint_auth_methods')" />
</property>
</bean>
</property>
@@ -530,21 +502,21 @@
p:requiredClaims="metadata" />
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
p:requiredClaims="trust_chain" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.TrustMarksClaimsValidator" />
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.TrustMarksClaimsValidator" />
</util:list>
</property>
</bean>
<util:map id="shibboleth.oidfed.DefaultFederationPolicyConstraints"
- value-type="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.FederationPolicyConstraint">
+ value-type="net.shibboleth.oidfed.metadata.constraints.FederationPolicyConstraint">
<entry key="max_path_length">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl.DefaultMaxPathLengthConstraint" />
+ <bean class="net.shibboleth.oidfed.metadata.constraints.impl.DefaultMaxPathLengthConstraint" />
</entry>
<entry key="naming_constraints">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl.DefaultNamingConstraintsConstraint" />
+ <bean class="net.shibboleth.oidfed.metadata.constraints.impl.DefaultNamingConstraintsConstraint" />
</entry>
<entry key="allowed_entity_types">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl.DefaultAllowedEntityTypesConstraint"
+ <bean class="net.shibboleth.oidfed.metadata.constraints.impl.DefaultAllowedEntityTypesConstraint"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"/>
</entry>
</util:map>
@@ -573,7 +545,7 @@
<property name="parsingStrategy">
<bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultJSONMapParsingStrategy"
c:mapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"
- c:valueClass="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer"/>
+ c:valueClass="net.shibboleth.oidfed.metadata.cache.local.LocalKeyContainer"/>
</property>
<property name="sourceMetadataExpiryStrategy">
<bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultSourceMetadataExpirationTimeStrategy"
@@ -581,7 +553,7 @@
</property>
</bean>
- <bean id="shibboleth.oidfed.TrustMarkStatusMetadataCache" parent="shibboleth.oidc.CacheBuilder">
+ <bean id="shibboleth.oidfed.TrustMarkStatusMetadataCache" parent="shibboleth.oidfed.CacheBuilder">
<constructor-arg>
<bean p:cacheId="DefaultTrustMarkStatusMetadataCache" parent="shibboleth.oidfed.TrustMarkStatusMetadataCacheBuilderSpec"
p:cleanupTaskInterval="PT30S"/>
@@ -597,30 +569,30 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
</property>
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkStatusIdentifierCriterion))?.getIdentifier()"/>
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.trustmark.TrustMarkStatusIdentifierCriterion))?.getIdentifier()"/>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.trustMarkStatus.customFilterStrategies:}'.trim())}">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition">
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultTrustMarkStatusCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultTrustMarkStatusCredentialResolver" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
</property>
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.DefaultTrustMarkValidationCriteriaSetLookupFunction"
+ <bean class="net.shibboleth.oidfed.metadata.cache.trustmark.DefaultTrustMarkValidationCriteriaSetLookupFunction"
p:trustChainCache-ref="shibboleth.oidfed.TrustChainMetadataCache"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.trustMarkStatus.claimsValidator:shibboleth.oidfed.DefaultTrustMarkStatusClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
<property name="headerValidator">
@@ -635,7 +607,7 @@
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.DefaultTrustMarkStatusFetchingStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.trustmark.DefaultTrustMarkStatusFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
@@ -661,10 +633,10 @@
</bean>
</property>
<property name="clientAuthenticationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
<property name="supportedAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue()?.getParsedPayload()?.getMetadata()?.getFederationEntityMetadata()?.get('federation_trust_mark_status_endpoint_auth_methods')" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue()?.getParsedPayload()?.getMetadata()?.getFederationEntityMetadata()?.get('federation_trust_mark_status_endpoint_auth_methods')" />
</property>
</bean>
</property>
@@ -692,7 +664,7 @@
</property>
</bean>
- <bean id="shibboleth.oidfed.TrustMarkMetadataCache" parent="shibboleth.oidc.CacheBuilder">
+ <bean id="shibboleth.oidfed.TrustMarkMetadataCache" parent="shibboleth.oidfed.CacheBuilder">
<constructor-arg>
<bean p:cacheId="DefaultTrustMarkMetadataCache" parent="shibboleth.oidfed.TrustMarkMetadataCacheBuilderSpec"
p:cleanupTaskInterval="PT30S"/>
@@ -708,21 +680,21 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
</property>
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkIdentifierCriterion))?.getIdentifier()"/>
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.trustmark.TrustMarkIdentifierCriterion))?.getIdentifier()"/>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.trustMark.customFilterStrategies:}'.trim())}">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.DefaultTrustMarkValidationCriteriaSetLookupFunction"
+ <bean class="net.shibboleth.oidfed.metadata.cache.trustmark.DefaultTrustMarkValidationCriteriaSetLookupFunction"
p:trustChainCache-ref="shibboleth.oidfed.TrustChainMetadataCache"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.trustMark.claimsValidator:shibboleth.oidfed.DefaultTrustMarkClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
<property name="headerValidator">
@@ -737,7 +709,7 @@
</bean>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.DefaultTrustMarkFetchingStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.trustmark.DefaultTrustMarkFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
@@ -763,10 +735,10 @@
</bean>
</property>
<property name="clientAuthenticationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
<property name="supportedAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_trust_mark_endpoint_auth_methods')" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_trust_mark_endpoint_auth_methods')" />
</property>
</bean>
</property>
@@ -797,10 +769,10 @@
<bean id="shibboleth.oidfed.DefaultDelegatedTrustMarkTrustEngine"
class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultTrustMarkOwnerCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultTrustMarkOwnerCredentialResolver" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
@@ -810,13 +782,13 @@
p:maxCacheDuration="%{idp.oidfed.cache.signedKeyset.maxRefreshDelay:PT30M}"
p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion))?.getValue().getSubject() + ':' + #input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.SubjectSignedKeysetUriCriterion))?.getValue()"/>
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.SubjectEntityStatementCriterion))?.getValue().getSubject() + ':' + #input?.get(T(net.shibboleth.oidfed.metadata.cache.keyset.SubjectSignedKeysetUriCriterion))?.getValue()"/>
</property>
<property name="identifierExtractionStrategy">
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId() + ':' + #input?.getIdentifier().getUri()"/>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.DefaultSignedKeysetFetchingStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.keyset.DefaultSignedKeysetFetchingStrategy"
p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
@@ -844,21 +816,21 @@
</bean>
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.signedKeyset.customFilterStrategies:}'.trim())}">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.DefaultSignedKeysetCriteriaSetLookupFunction"/>
+ <bean class="net.shibboleth.oidfed.metadata.cache.keyset.DefaultSignedKeysetCriteriaSetLookupFunction"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.signedKeyset.claimsValidator:shibboleth.oidfed.DefaultSignedKeysetClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
<property name="headerValidator">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
</property>
<property name="containerIdValidationStrategy">
@@ -895,23 +867,55 @@
class="net.shibboleth.shared.spring.resource.PreferFileSystemResourceLoader"/>
<bean id="shibboleth.oidfed.DefaultLocalTrustAnchorsValidator"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultLocalTrustAnchorsValidator"/>
+ class="net.shibboleth.oidfed.metadata.cache.local.DefaultLocalTrustAnchorsValidator"/>
<bean id="shibboleth.oidfed.LocalTrustAnchorsDefaultIdentifierStrategy"
parent="shibboleth.Functions.Constant" c:target="#{getObject('shibboleth.oidfed.DefaultLocalTrustAnchorsFilename') ?: 'undefined'}" />
-
- <bean id="shibboleth.oidfed.JWTPayloadJSONObjectMapper" parent="shibboleth.oidc.JSONObjectMapper" />
+ <bean id="shibboleth.oidfed.JSONObjectMapper" class="com.fasterxml.jackson.databind.ObjectMapper"/>
+ <bean id="shibboleth.oidfed.JWTPayloadJSONObjectMapper" parent="shibboleth.oidfed.JSONObjectMapper" />
<bean id="shibboleth.oidfed.policy.JSONSimpleModule" class="com.fasterxml.jackson.databind.module.SimpleModule"/>
<bean id="shibboleth.oidfed.JacksonSimpleTypeResolver" class="com.fasterxml.jackson.databind.module.SimpleAbstractTypeResolver"/>
+ <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
+ <property name="targetObject" ref="shibboleth.oidfed.JSONObjectMapper" />
+ <property name="targetMethod" value="configure" />
+ <property name="arguments">
+ <list>
+ <value type="com.fasterxml.jackson.databind.DeserializationFeature">READ_DATE_TIMESTAMPS_AS_NANOSECONDS</value>
+ <value>false</value>
+ </list>
+ </property>
+ </bean>
+
+ <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
+ <property name="targetObject" ref="shibboleth.oidfed.JSONObjectMapper" />
+ <property name="targetMethod" value="configure" />
+ <property name="arguments">
+ <list>
+ <value type="com.fasterxml.jackson.databind.SerializationFeature">WRITE_DATE_TIMESTAMPS_AS_NANOSECONDS</value>
+ <value>false</value>
+ </list>
+ </property>
+ </bean>
+
+ <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
+ <property name="targetObject" ref="shibboleth.oidfed.JSONObjectMapper" />
+ <property name="targetMethod" value="registerModule" />
+ <property name="arguments">
+ <list>
+ <bean class="com.fasterxml.jackson.datatype.jsr310.JavaTimeModule"/>
+ </list>
+ </property>
+ </bean>
+
<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
<property name="targetObject" ref="shibboleth.oidfed.policy.JSONSimpleModule" />
<property name="targetMethod" value="addDeserializer" />
<property name="arguments">
<list>
<value>#{ T(net.shibboleth.oidc.metadata.policy.MetadataPolicy)}</value>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyDeserializer"
+ <bean class="net.shibboleth.oidfed.metadata.policy.FederationMetadataPolicyDeserializer"
c:_0="%{idp.oidfed.policy.arraysAsSpaceSeparatedList:scope}"/>
</list>
</property>
@@ -923,7 +927,7 @@
<property name="arguments">
<list>
<value>#{ T(com.nimbusds.jose.jwk.JWKSet)}</value>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.JWKSetDeserializer"/>
+ <bean class="net.shibboleth.oidfed.metadata.jackson.JWKSetDeserializer"/>
</list>
</property>
</bean>
@@ -934,7 +938,7 @@
<property name="arguments">
<list>
<value>#{ T(com.nimbusds.jose.jwk.JWK)}</value>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.JWKDeserializer"/>
+ <bean class="net.shibboleth.oidfed.metadata.jackson.JWKDeserializer"/>
</list>
</property>
</bean>
@@ -945,7 +949,7 @@
<property name="arguments">
<list>
<value>#{ T(java.time.Instant)}</value>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.InstantDeserializer"/>
+ <bean class="net.shibboleth.oidfed.metadata.jackson.InstantDeserializer"/>
</list>
</property>
</bean>
@@ -955,8 +959,8 @@
<property name="targetMethod" value="addMapping" />
<property name="arguments">
<list>
- <value>#{ T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata)}</value>
- <value>#{ T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl.MetadataImpl)}</value>
+ <value>#{ T(net.shibboleth.oidfed.metadata.payload.claim.Metadata)}</value>
+ <value>#{ T(net.shibboleth.oidfed.metadata.payload.claim.impl.MetadataImpl)}</value>
</list>
</property>
</bean>
@@ -966,8 +970,8 @@
<property name="targetMethod" value="addMapping" />
<property name="arguments">
<list>
- <value>#{ T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.TrustMarkOwner)}</value>
- <value>#{ T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl.TrustMarkOwnerImpl)}</value>
+ <value>#{ T(net.shibboleth.oidfed.metadata.payload.claim.TrustMarkOwner)}</value>
+ <value>#{ T(net.shibboleth.oidfed.metadata.payload.claim.impl.TrustMarkOwnerImpl)}</value>
</list>
</property>
</bean>
@@ -993,65 +997,15 @@
</bean>
<util:list id="shibboleth.oidfed.StandardMetadataPolicyOperators">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyValueOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyAddOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyDefaultOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyOneOfOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicySubsetOfOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicySupersetOfOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEssentialOperator"/>
+ <bean class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyValueOperator"/>
+ <bean class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyAddOperator"/>
+ <bean class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyDefaultOperator"/>
+ <bean class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyOneOfOperator"/>
+ <bean class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicySubsetOfOperator"/>
+ <bean class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicySupersetOfOperator"/>
+ <bean class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEssentialOperator"/>
</util:list>
- <bean p:id="oidc/metadata-lookup-ext/oidfed" parent="shibboleth.oidc.MetadataLookupExtensionFlow" />
-
- <bean id="shibboleth.oidc.DefaultResolveEntityApiMappedErrors"
- parent="shibboleth.oidc.DefaultApiMappedErrors"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map merge="true" value-type="com.nimbusds.oauth2.sdk.ErrorObject">
- <entry>
- <key>
- <util:constant static-field="org.opensaml.profile.action.EventIds.INVALID_MSG_CTX"/>
- </key>
- <bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="server_error" c:_1="Internal server error" c:_2="500" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_TRUST_ANCHOR"/>
- </key>
- <bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_trust_anchor" c:_1="Trust anchor in the request is invalid" c:_2="404" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_SUBJECT"/>
- </key>
- <bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_subject" c:_1="Subject in the request is invalid" c:_2="404" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_METADATA"/>
- </key>
- <bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_metadata" c:_1="Metadata is invalid or not found for the requested entity types" c:_2="400" />
- </entry>
- </map>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.register.DefaultMappedErrors"
- parent="shibboleth.oidc.register.DefaultMappedErrors"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map value-type="com.nimbusds.oauth2.sdk.ErrorObject">
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.NO_TRUST_CHAINS_RESOLVED"/>
- </key>
- <bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_client" c:_1="No acceptable trust chains could be resolved for the client" c:_2="401" />
- </entry>
- </map>
- </property>
- </bean>
-
<bean id="DefaultTrustMarkClaimsValidationLookupStrategy" parent="shibboleth.Functions.Constant"
c:target-ref="shibboleth.oidfed.DefaultTrustMarkClaimsValidator" />
@@ -1078,326 +1032,23 @@
</constructor-arg>
</bean>
-
- <bean id="shibboleth.oidfed.DefaultPreSelectedTrustChainIDsLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultPreSelectedTrustChainIDsLookupStrategy">
- <property name="profileIdLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultMetadataLookupExtensionContextProfileIDLookupFunction"/>
- </property>
- <property name="profileSpecificStrategies">
- <util:map value-type="java.util.function.Function">
- <entry key="#{T(net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration).PROFILE_ID}">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultAuthorizePreSelectedTrustChainIDsLookupStrategy"/>
- </entry>
- </util:map>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultProvidedTrustChainResolver"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.DefaultProvidedTrustChainResolver">
- <property name="profileIdLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultMetadataLookupExtensionContextProfileIDLookupFunction"/>
- </property>
- <property name="profileSpecificResolvers">
- <util:map value-type="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.ProvidedTrustChainResolver">
- <entry key="#{T(net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration).PROFILE_ID}">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultAuthorizationRequestObjectProvidedTrustChainResolver"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
- </entry>
- <entry key="#{T(net.shibboleth.oidc.profile.oauth2.config.OAuth2PushedAuthorizationRequestConfiguration).PROFILE_ID}">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultPushedAuthorizationRequestObjectProvidedTrustChainResolver"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
- </entry>
- </util:map>
- </property>
- </bean>
-
- <util:map id="DefaultAutoRegisteredTokenClaimsSetDecorators" value-type="java.util.List">
- <entry key="#{null}">
- <util:list>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainIDsClaimsSetDecorator"/>
- </util:list>
- </entry>
- <entry key="store">
- <util:list>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainIDsClaimsSetDecorator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredClientInformationStoreClaimsSetDecorator"
- p:clientInformationManager-ref="#{'%{idp.oidfed.autoreg.clientInformationManager:shibboleth.oidc.ClientInformationManager}'.trim()}" />
- </util:list>
- </entry>
- </util:map>
-
- <bean id="AutoRegisteredTrustChainAuthorizationCodeClaimsSetDecorator"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainAuthorizationCodeClaimsSetDecorator"
- p:claimsSetDecorators-ref="DefaultAutoRegisteredTokenClaimsSetDecorators"/>
-
- <bean id="AutoRegisteredTrustChainAccessTokenClaimsSetDecorator"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainAccessTokenClaimsSetDecorator"
- p:claimsSetDecorators-ref="DefaultAutoRegisteredTokenClaimsSetDecorators"/>
-
- <bean id="AutoRegisteredTrustChainRefreshTokenClaimsSetDecorator"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainRefreshTokenClaimsSetDecorator"
- p:claimsSetDecorators-ref="DefaultAutoRegisteredTokenClaimsSetDecorators"/>
-
-
- <bean id="AutoRegisteredTrustChainRequestUriClaimsSetDecorator"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainRequestUriClaimsSetDecorator"
- p:claimsSetDecorators-ref="DefaultAutoRegisteredTokenClaimsSetDecorators"/>
-
- <bean id="ClientInformationSignedKeysetJWKSetDecorator"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.ClientInformationSignedKeysetJWKSetDecorator"
- p:signedKeysetCache-ref="#{'%{idp.oidfed.SignedKeysetMetadataCache:shibboleth.oidfed.SignedKeysetMetadataCache}'.trim()}" />
-
- <bean id="AutomaticRegistrationCondition"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.logic.DefaultAutomaticRegistrationActivationCondition">
- <property name="profileIdLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultMetadataLookupExtensionContextProfileIDLookupFunction"/>
- </property>
- <property name="profileConditions">
- <util:map value-type="java.util.function.Predicate">
- <entry key="#{T(net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration).PROFILE_ID}">
- <ref bean="shibboleth.oidfed.authorize.DefaultAutomaticRegistrationCondition"/>
- </entry>
- <entry key="#{T(net.shibboleth.oidc.profile.oauth2.config.OAuth2PushedAuthorizationRequestConfiguration).PROFILE_ID}">
- <ref bean="shibboleth.oidfed.par.DefaultAutomaticRegistrationCondition"/>
- </entry>
- <entry key="#{T(net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration).PROFILE_ID}">
- <ref bean="shibboleth.oidfed.token.DefaultAutomaticRegistrationCondition"/>
- </entry>
- <entry key="#{T(net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration).PROFILE_ID}">
- <ref bean="shibboleth.oidfed.userinfo.DefaultAutomaticRegistrationCondition"/>
- </entry>
- <entry key="#{T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationResolveEntityProfileConfiguration).PROFILE_ID}">
- <ref bean="shibboleth.oidfed.resolve-entity.DefaultAutomaticRegistrationCondition"/>
- </entry>
- </util:map>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.authorize.DefaultAutomaticRegistrationCondition" parent="shibboleth.Conditions.AND">
- <constructor-arg>
- <list>
- <ref bean="%{idp.oidfed.authorize.automaticRegistrationCondition:shibboleth.Conditions.FALSE}"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureInboundMessageContext().getMessage() instanceof T(com.nimbusds.oauth2.sdk.AuthorizationRequest) and #input.ensureInboundMessageContext().getMessage().specifiesRequestObject()" />
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="!(#input.ensureInboundMessageContext().getMessage().getRequestObject() instanceof T(com.nimbusds.jwt.PlainJWT))" />
- <bean parent="shibboleth.Conditions.OR">
- <constructor-arg>
- <list>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="!(#input.ensureInboundMessageContext().getMessage().getRequestObject() instanceof T(com.nimbusds.jwt.SignedJWT))" />
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureInboundMessageContext().getMessage().getClientID().getValue().equals(#input.ensureInboundMessageContext().getMessage().getRequestObject().getJWTClaimsSet().getClaim('client_id'))" />
- </list>
- </constructor-arg>
- </bean>
- </list>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.token.DefaultAutomaticRegistrationCondition" parent="shibboleth.Conditions.AND">
- <constructor-arg>
- <list>
- <ref bean="%{idp.oidfed.token.automaticRegistrationCondition:shibboleth.Conditions.FALSE}"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureInboundMessageContext().getMessage() instanceof T(com.nimbusds.oauth2.sdk.TokenRequest)" />
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.getOutboundMessageContext() != null"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureOutboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)) != null"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureOutboundMessageContext().ensureSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getAuthorizationGrantClaimsSet() != null"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureOutboundMessageContext().ensureSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getAuthorizationGrantClaimsSet().getClaimsSet().getClaim(T(net.shibboleth.idp.plugin.oidc.op.oidfed.support.ClaimsSetExtensionSupport).KEY_AUTO_REGISTERED_TRUST_CHAIN) != null"/>
- </list>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.par.DefaultAutomaticRegistrationCondition" parent="shibboleth.Conditions.AND">
- <constructor-arg>
- <list>
- <ref bean="%{idp.oidfed.par.automaticRegistrationCondition:shibboleth.Conditions.FALSE}"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureInboundMessageContext().getMessage() instanceof T(com.nimbusds.oauth2.sdk.PushedAuthorizationRequest)" />
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="!(#input.ensureInboundMessageContext().getMessage().getAuthorizationRequest().getRequestObject() instanceof T(com.nimbusds.jwt.PlainJWT))" />
- <bean parent="shibboleth.Conditions.OR">
- <constructor-arg>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureInboundMessageContext().getMessage().getAuthorizationRequest().specifiesRequestObject()" />
- </constructor-arg>
- <constructor-arg>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureInboundMessageContext().getMessage().getClientAuthentication() != null and #input.ensureInboundMessageContext().getMessage().getClientAuthentication().getMethod().equals(T(com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod).PRIVATE_KEY_JWT)" />
- </constructor-arg>
- </bean>
- <bean parent="shibboleth.Conditions.OR">
- <constructor-arg>
- <list>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="!(#input.ensureInboundMessageContext().getMessage().getAuthorizationRequest().getRequestObject() instanceof T(com.nimbusds.jwt.SignedJWT))" />
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureInboundMessageContext().getMessage().getAuthorizationRequest().getClientID().getValue().equals(#input.ensureInboundMessageContext().getMessage().getAuthorizationRequest().getRequestObject().getJWTClaimsSet().getClaim('client_id'))" />
- </list>
- </constructor-arg>
- </bean>
- </list>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.userinfo.DefaultAutomaticRegistrationCondition" parent="shibboleth.Conditions.AND">
- <constructor-arg>
- <list>
- <ref bean="%{idp.oidfed.userinfo.automaticRegistrationCondition:shibboleth.Conditions.FALSE}"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureInboundMessageContext().getMessage() instanceof T(com.nimbusds.openid.connect.sdk.UserInfoRequest)" />
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.getOutboundMessageContext() != null"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureOutboundMessageContext().getSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)) != null"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureOutboundMessageContext().ensureSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getAuthorizationGrantClaimsSet() != null"/>
- <bean parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureOutboundMessageContext().ensureSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getAuthorizationGrantClaimsSet().getClaimsSet().getClaim(T(net.shibboleth.idp.plugin.oidc.op.oidfed.support.ClaimsSetExtensionSupport).KEY_AUTO_REGISTERED_TRUST_CHAIN) != null"/>
- </list>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.resolve-entity.DefaultAutomaticRegistrationCondition" parent="shibboleth.Conditions.AND">
- <constructor-arg>
- <list>
- <ref bean="%{idp.oidfed.resolve-entity.automaticRegistrationCondition:shibboleth.Conditions.TRUE}"/>
- </list>
- </constructor-arg>
- </bean>
-
- <bean class="net.shibboleth.idp.plugin.oidc.op.security.jwt.claims.RequestObjectClaimsValidator">
- <constructor-arg>
- <bean id="shibboleth.oidfed.DefaultRequestObjectClaimsValidation"
- class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator"
- p:claimValidators-ref="FederationClaimsValidators" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.RequestObjectValidationCondition"
- parent="shibboleth.BiConditions.Expression"
- c:expression="#input1.ensureInboundMessageContext().containsSubcontext(T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext)) and #input1.ensureInboundMessageContext().ensureSubcontext(T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext)).getSelectedTrustChain() != null"/>
-
- <util:list id="FederationClaimsValidators" value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator"
- p:extraAudienceValidation="true"
- p:activationCondition-ref="shibboleth.oidfed.RequestObjectValidationCondition">
- <property name="audienceLookupStrategy">
- <bean parent="shibboleth.BiFunctions.Expression"
- c:expression="#custom.apply(#input1)"
- p:customObject-ref="shibboleth.ResponderIdLookup.Simple" />
- </property>
- </bean>
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.JWTIdentifierClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}"
- p:activationCondition-ref="shibboleth.oidfed.RequestObjectValidationCondition"
- p:replayCache-ref="shibboleth.ReplayCache" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:activationCondition-ref="shibboleth.oidfed.RequestObjectValidationCondition"
- p:requiredClaims="exp" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:activationCondition-ref="shibboleth.oidfed.RequestObjectValidationCondition"
- p:prohibitedClaims="sub" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator"
- p:activationCondition-ref="shibboleth.oidfed.RequestObjectValidationCondition"
- p:claimName="client_id">
- <property name="valueToMatchLookupStrategy">
- <bean parent="shibboleth.BiFunctions.Expression"
- c:expression="#custom.apply(#input1.getInboundMessageContext()) == null ? null : #custom.apply(#input1.getInboundMessageContext()).toString()">
- <property name="customObject">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultMetadataLookupExtensionContextClientIDLookupFunction" />
- </property>
- </bean>
- </property>
- </bean>
- </util:list>
-
- <bean parent="shibboleth.oidc.PushedAuthorizationErrorMapping">
- <property name="eventId">
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_METADATA_POLICY"/>
- </property>
- <property name="errorObject">
- <bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_metadata" c:_1="Merged metadata policy is invalid" c:_2="400" />
- </property>
- </bean>
-
- <bean parent="shibboleth.oidc.PushedAuthorizationErrorMapping">
- <property name="eventId">
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_METADATA_AGAINST_POLICY"/>
- </property>
- <property name="errorObject">
- <bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_metadata" c:_1="Requested metadata is not compliant with the merged policy" c:_2="400" />
- </property>
- </bean>
-
- <bean parent="shibboleth.oidc.PushedAuthorizationErrorMapping">
- <property name="eventId">
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.NO_TRUST_CHAINS_RESOLVED"/>
- </property>
- <property name="errorObject">
- <bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_client" c:_1="No acceptable trust chains could be resolved for the client" c:_2="401" />
- </property>
- </bean>
-
- <alias alias="UseResolverApiCondition" name="%{idp.oidfed.trustchain.resolver.useResolverApiCondition:shibboleth.Conditions.FALSE}" />
- <alias alias="FallbackToLocalResolutionCondition" name="%{idp.oidfed.trustchain.resolver.fallbackToLocalCondition:shibboleth.Conditions.TRUE}" />
-
<bean id="shibboleth.oidfed.RemoteTrustMark" abstract="true"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.DefaultTrustMarkFromMetadataCacheFetchingFunction"
- p:subject-ref="shibboleth.oidc.issuer"
+ class="net.shibboleth.oidfed.profile.impl.DefaultTrustMarkFromMetadataCacheFetchingFunction"
+ p:subject-ref="shibboleth.oidfed.entityId"
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"
p:trustMarkCache-ref="shibboleth.oidfed.TrustMarkMetadataCache"/>
- <bean id="shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator"
- class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator">
- <property name="claimValidators">
- <util:list value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}"
- p:messageLifetime="%{idp.oidfed.cache.explicitRegistration.maxJwtLifetime:PT1M}"
- p:requiredRule="true" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="iss" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="sub" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="jwks" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.AudienceClaimsValidator">
- <property name="audienceLookupStrategy">
- <bean parent="shibboleth.BiFunctions.Constant"
- c:target-ref="shibboleth.oidc.issuer" />
- </property>
- </bean>
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="metadata_policy" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="metadata_policy_crit" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="constraints" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="source_endpoint" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.CritClaimsValidator"
- p:recognizedClaims="%{idp.oidfed.cache.explicitRegistration.critClaims:%{idp.oidfed.cache.default.critClaims:}}" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="authority_hints" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.NonEmptyStringArrayClaimsValidator"
- p:nonEmptyArrayClaims="authority_hints,trust_anchor_hints" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.TrustMarksClaimsValidator" />
- </util:list>
+ <bean id="shibboleth.oidfed.DefaultPostResponseAuditExtractors"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ </map>
</property>
</bean>
- <!-- Property-based definition of login flows for the resolve-entity endpoint. -->
- <bean id="shibboleth.oidfed.resolver.PotentialFlows" class="org.springframework.beans.factory.config.ListFactoryBean"
- p:sourceList="#{getObject('shibboleth.AuthenticationFlowDescriptorManager').getComponents().?[id matches 'authn/(' + '%{idp.oidfed.resolve-entity.authn.flows:OAuth2Client}'.trim() + ')']}" />
+ <bean id="DefaultTrustAnchorHintsLookupStrategy"
+ class="net.shibboleth.oidfed.profile.navigate.DefaultTrustAnchorHintsLookupStrategy"
+ p:trustAnchorsCache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache"/>
<import resource="${idp.home}/conf/oidfed/oidfed-trustchain-resolver.xml"/>
diff --git a/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
new file mode 100644
index 0000000..a877910
--- /dev/null
+++ b/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -0,0 +1,108 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy">
+
+ <bean id="AbstractOIDFederationProfile" abstract="true"
+ p:securityConfiguration-ref="shibboleth.oidfed.DefaultSecurityConfiguration" />
+
+ <bean id="OIDFED.Configuration" parent="AbstractOIDFederationProfile" lazy-init="true"
+ class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationEntityConfigurationProfileConfiguration"
+ p:issuer-ref="shibboleth.oidfed.entityId"
+ p:authorityHints="%{idp.oidfed.entity.authorityHints:https://example.org}"
+ p:optionalClaimsLookupStrategies-ref="shibboleth.oidfed.EntityConfigurationClaimsLookupStrategies" />
+
+ <bean id="shibboleth.oidfed.SigningConfiguration"
+ parent="shibboleth.oidfed.BasicSignatureSigningConfiguration"
+ p:signingCredentials-ref="shibboleth.oidfed.SigningCredentialsFactory">
+ <property name="signatureAlgorithms">
+ <list>
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_512" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_PS_256" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_PS_384" />
+ <util:constant
+ static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_PS_512" />
+ </list>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidfed.SigningCredentialsFactory"
+ class="net.shibboleth.oidc.profile.config.CredentialsListFactory"
+ c:_0="#{getObject('shibboleth.oidfed.SigningCredentials') ?: getObject('shibboleth.oidc.SigningCredentials')}" />
+
+ <bean id="shibboleth.oidfed.SignatureValidationConfiguration"
+ parent="shibboleth.oidfed.BasicSignatureValidationConfiguration">
+ <property name="signatureTrustEngine">
+ <bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
+ <constructor-arg name="JOSEObjectResolver">
+ <bean class="net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver" />
+ </constructor-arg>
+ <constructor-arg name="resolver">
+ <bean id="defaultSignedJWTFedTrustedCredentialResolver"
+ class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
+ <constructor-arg>
+ <list>
+ <bean class="net.shibboleth.oidfed.security.credential.ClientInformationFederationEntityCredentialResolver"
+ c:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
+ <constructor-arg name="entityConfigurationCredentialResolver">
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultEntityConfigurationCredentialResolver" />
+ </constructor-arg>
+ </bean>
+ </list>
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidfed.DefaultSecurityConfiguration"
+ class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration" c:clockSkew="%{idp.policy.clockSkew:PT1M}">
+ <constructor-arg name="idGenerator">
+ <bean class="net.shibboleth.shared.security.IdentifierGenerationStrategy" factory-method="getInstance">
+ <constructor-arg>
+ <util:constant
+ static-field="net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType.SECURE" />
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ <property name="jwtSignatureSigningConfiguration">
+ <ref bean="#{'%{idp.oidfed.signing.config:shibboleth.oidfed.SigningConfiguration}'.trim()}" />
+ </property>
+ <property name="jwtSignatureValidationConfiguration">
+ <ref bean="#{'%{idp.oidfed.validation.config:shibboleth.oidfed.SignatureValidationConfiguration}'.trim()}" />
+ </property>
+ </bean>
+
+ <bean id="shibboleth.oidfed.BasicSignatureValidationConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidfed.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidfed.ExcludedSignatureAlgorithms')}" />
+
+ <bean id="shibboleth.oidfed.BasicSignatureSigningConfiguration" abstract="true"
+ class="net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration"
+ p:includedAlgorithms="#{getObject('shibboleth.oidfed.IncludedSignatureAlgorithms')}"
+ p:excludedAlgorithms="#{getObject('shibboleth.oidfed.ExcludedSignatureAlgorithms')}" />
+
+ <import resource="${idp.home}/conf/oidfed/oidfed-entity-configuration-claims.xml"/>
+
+</beans>
diff --git a/pom.xml b/pom.xml
index f66d436..07b43b3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -44,6 +44,7 @@
<modules>
<module>oidfed-common-api</module>
<module>oidfed-common-impl</module>
+ <module>oidfed-common-conf-impl</module>
<module>oidfed-common-dist</module>
</modules>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list