[java-idp-plugin-oidc-op-oidfed] branch main updated: Wire a list of header validators instead of a single one.
Codeberg
noreply at shibboleth.net
Thu Oct 1 09:45:24 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/1138329b148b2321123debd2def309cc9f30f178
The following commit(s) were added to refs/heads/main by this push:
new 1138329 Wire a list of header validators instead of a single one.
1138329 is described below
commit 1138329b148b2321123debd2def309cc9f30f178
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Oct 1 12:44:49 2026 +0300
Wire a list of header validators instead of a single one.
Required now by java-oidfed-common
---
.../oidfed/metadata-lookup-ext-oidfed-beans.xml | 30 +++++++++++-----
.../idp/flows/oidfed/register/register-beans.xml | 41 +++++++++++++++-------
2 files changed, 50 insertions(+), 21 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
index 34e7b45..986aa5f 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
@@ -46,9 +46,13 @@
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.op.automaticRegistration.providedTrustChain.leaf.claimsValidator:shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ <property name="headerValidators">
+ <util:list value-type="java.util.function.BiPredicate">
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTypeHeaderValidationCondition"
+ p:requiredTypeHeader="entity-statement+jwt" />
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ </util:list>
</property>
<property name="containerIdValidationStrategy">
<bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
@@ -64,9 +68,13 @@
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.op.automaticRegistration.providedTrustChain.anchor.claimsValidator:shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ <property name="headerValidators">
+ <util:list value-type="java.util.function.BiPredicate">
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTypeHeaderValidationCondition"
+ p:requiredTypeHeader="entity-statement+jwt" />
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ </util:list>
</property>
<property name="containerIdValidationStrategy">
<bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
@@ -82,9 +90,13 @@
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.op.automaticRegistration.providedTrustChain.subordinate.claimsValidator:shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ <property name="headerValidators">
+ <util:list value-type="java.util.function.BiPredicate">
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTypeHeaderValidationCondition"
+ p:requiredTypeHeader="entity-statement+jwt" />
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ </util:list>
</property>
<property name="containerIdValidationStrategy">
<bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
index 00bdd9c..be98c16 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
@@ -63,9 +63,13 @@
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.op.explicitRegistration.providedTrustChain.leaf.claimsValidator:shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ <property name="headerValidators">
+ <util:list value-type="java.util.function.BiPredicate">
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTypeHeaderValidationCondition"
+ p:requiredTypeHeader="entity-statement+jwt" />
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ </util:list>
</property>
<property name="containerIdValidationStrategy">
<bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
@@ -81,9 +85,13 @@
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.op.explicitRegistration.providedTrustChain.anchor.claimsValidator:shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ <property name="headerValidators">
+ <util:list value-type="java.util.function.BiPredicate">
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTypeHeaderValidationCondition"
+ p:requiredTypeHeader="entity-statement+jwt" />
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ </util:list>
</property>
<property name="containerIdValidationStrategy">
<bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
@@ -99,9 +107,13 @@
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.op.explicitRegistration.providedTrustChain.subordinate.claimsValidator:shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ <property name="headerValidators">
+ <util:list value-type="java.util.function.BiPredicate">
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTypeHeaderValidationCondition"
+ p:requiredTypeHeader="entity-statement+jwt" />
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ </util:list>
</property>
<property name="containerIdValidationStrategy">
<bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
@@ -206,9 +218,14 @@
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.op.explicitRegistration.cache.explicitRegistrationRequest.claimsValidator:shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
+ <property name="headerValidators">
+ <util:list value-type="java.util.function.BiPredicate">
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTypeHeaderValidationCondition"
+ p:requiredTypeHeader="entity-statement+jwt" />
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"
+ p:allowTrustChainHeader="true" p:allowPeerTrustChainHeader="true" />
+ </util:list>
</property>
<property name="containerIdValidationStrategy">
<bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list