[java-idp-plugin-oidc-op-oidfed] 01/03: Include the oidfed/oidfed-op.properties in the distribution package
Codeberg
noreply at shibboleth.net
Thu Oct 1 12:20:50 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/f4767fa3383d439d7d5b6e45a0915a17675ae794
commit f4767fa3383d439d7d5b6e45a0915a17675ae794
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Oct 1 15:17:42 2026 +0300
Include the oidfed/oidfed-op.properties in the distribution package
All properties still not documented in the file
---
.../idp/flows/oidfed/register/register-beans.xml | 12 +-
.../op/oidfed/conf/oidfed/oidfed-op.properties | 137 ++++++++++-----------
.../idp/plugin/oidc/op/oidfed/module.properties | 6 +-
3 files changed, 79 insertions(+), 76 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
index be98c16..d4390e0 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
@@ -295,18 +295,18 @@
</constructor-arg>
</bean>
- <bean id="DefaultMetadataPolicyEnforcer"
+ <bean id="shibboleth.oidfed.trust-chain-resolver.MetadataPolicyEnforcer"
class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
p:metadataPolicyOperators-ref="#{'%{idp.oidfed.op.explicitRegistration.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="shibboleth.oidfed.trust-chain-resolver.TrustChainMetadataPolicyMergingStrategy"
class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainMetadataPolicyMergingStrategy"
- p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.op.explicitRegistration.MetadataPolicyMergingStrategy:MetadataPolicMergingyStrategy}'.trim()}"
+ p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.op.explicitRegistration.MetadataPolicyMergingStrategy:MetadataPolicyMergingStrategy}'.trim()}"
p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.op.explicitRegistration.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
- <bean id="MetadataPolicMergingyStrategy"
+ <bean id="MetadataPolicyMergingStrategy"
class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
- p:metadataPolicyOperators-ref="#{'%{idp.oidfed.register.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
+ p:metadataPolicyOperators-ref="#{'%{idp.oidfed.op.explicitRegistration.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="DefaultLocalMetadataPolicyStrategy"
parent="shibboleth.Functions.Constant">
@@ -401,7 +401,7 @@
scope="prototype">
<property name="localMetadataPolicyMergingStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultLocalMetadataPolicyMergingStrategy"
- p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.register.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"/>
+ p:metadataPolicyEnforcer="#{getObject('shibboleth.oidfed.trust-chain-resolver.MetadataPolicyEnforcer') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultMetadataPolicyEnforcer')}"/>
</property>
<property name="mandatoryTrustMarksLookupStrategy">
<bean class="net.shibboleth.oidfed.profile.config.navigate.MandatoryTrustMarksLookupFunction"
@@ -412,7 +412,7 @@
<bean id="ValidateRegistrationRequestMetadata"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateRegistrationRequestMetadata"
scope="prototype"
- p:metadataPolicyEnforcer="#{getObject('shibboleth.oidc.dynreg.MetadataPolicyEnforcer') ?: getObject('shibboleth.oidc.dynreg.DefaultMetadataPolicyEnforcer')}"/>
+ p:metadataPolicyEnforcer="#{getObject('shibboleth.oidfed.trust-chain-resolver.MetadataPolicyEnforcer') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultMetadataPolicyEnforcer')}"/>
<bean id="CheckRedirectURIs"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.CheckRedirectURIs"
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
index e07b461..fe533d1 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
@@ -1,77 +1,76 @@
# postconfig.xml
-idp.oidfed.op.automaticRegistration.activationCondition.authorize = shibboleth.Conditions.FALSE
-idp.oidfed.op.automaticRegistration.activationCondition.token = shibboleth.Conditions.FALSE
-idp.oidfed.op.automaticRegistration.activationCondition.par = shibboleth.Conditions.FALSE
-idp.oidfed.op.automaticRegistration.activationCondition.userinfo = shibboleth.Conditions.FALSE
-idp.oidfed.op.automaticRegistration.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
-idp.oidfed.op.automaticRegistration.trustchain.resolver.fallbackToLocalCondition = shibboleth.Conditions.TRUE
-idp.oidfed.op.automaticRegistration.mandatoryTrustMarks =
-idp.oidfed.op.automaticRegistration.maximumTrustMarkLifetime = P365D
-idp.oidfed.op.automaticRegistration.remoteTrustMarkValidation = true
-idp.oidfed.op.automaticRegistration.defaultClaimsSetDecorationType = token
-idp.oidfed.op.automaticRegistration.providedClaimsSetDecorationType = store
-idp.oidfed.op.automaticRegistration.clientInformationManager = shibboleth.oidc.ClientInformationManager
-idp.oidfed.op.automaticRegistration.FederationPolicyConstraints = shibboleth.oidfed.DefaultFederationPolicyConstraints
-idp.oidfed.op.automaticRegistration.AutoRegisteredTokenClaimsSetDecorators =
-idp.oidfed.op.automaticRegistration.providedTrustChain.leaf.claimsValidator = shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator
-idp.oidfed.op.automaticRegistration.providedTrustChain.anchor.claimsValidator = shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator
-idp.oidfed.op.automaticRegistration.providedTrustChain.subordinate.claimsValidator = shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator
+#idp.oidfed.op.automaticRegistration.activationCondition.authorize = shibboleth.Conditions.FALSE
+#idp.oidfed.op.automaticRegistration.activationCondition.token = shibboleth.Conditions.FALSE
+#idp.oidfed.op.automaticRegistration.activationCondition.par = shibboleth.Conditions.FALSE
+#idp.oidfed.op.automaticRegistration.activationCondition.userinfo = shibboleth.Conditions.FALSE
+#idp.oidfed.op.automaticRegistration.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
+#idp.oidfed.op.automaticRegistration.trustchain.resolver.fallbackToLocalCondition = shibboleth.Conditions.TRUE
+#idp.oidfed.op.automaticRegistration.mandatoryTrustMarks =
+#idp.oidfed.op.automaticRegistration.maximumTrustMarkLifetime = P365D
+#idp.oidfed.op.automaticRegistration.remoteTrustMarkValidation = true
+#idp.oidfed.op.automaticRegistration.defaultClaimsSetDecorationType = token
+#idp.oidfed.op.automaticRegistration.providedClaimsSetDecorationType = store
+#idp.oidfed.op.automaticRegistration.clientInformationManager = shibboleth.oidc.ClientInformationManager
+#idp.oidfed.op.automaticRegistration.FederationPolicyConstraints = shibboleth.oidfed.DefaultFederationPolicyConstraints
+#idp.oidfed.op.automaticRegistration.AutoRegisteredTokenClaimsSetDecorators = DefaultAutoRegisteredTokenClaimsSetDecorator
+#idp.oidfed.op.automaticRegistration.providedTrustChain.leaf.claimsValidator = shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator
+#idp.oidfed.op.automaticRegistration.providedTrustChain.anchor.claimsValidator = shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator
+#idp.oidfed.op.automaticRegistration.providedTrustChain.subordinate.claimsValidator = shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator
# metadata-lookup-ext-oidfed-beans
-idp.oidfed.op.automaticRegistration.ProvidedTrustChainMetadataCache = DefaultAutoRegisterFetchThroughProvidedTrustChainMetadataCache
-idp.oidfed.op.automaticRegistration.cache.providedTrustChain.customFilterStrategies =
-idp.oidfed.op.automaticRegistration.MetadataPolicyOperators = shibboleth.oidfed.StandardMetadataPolicyOperators
-idp.oidfed.op.automaticRegistration.MetadataPolicyMergingStrategy = MetadataPolicyMergingStrategy
-idp.oidfed.op.automaticRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
-idp.oidfed.op.automaticRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
-idp.oidfed.op.automaticRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
-idp.oidfed.op.automaticRegistration.EntityConfigurationMetadataCache = shibboleth.oidfed.EntityConfigurationMetadataCache
-idp.oidfed.op.automaticRegistration.LocalTrustAnchorsMetadataCache = shibboleth.oidfed.LocalTrustAnchorsMetadataCache
-idp.oidfed.op.automaticRegistration.TrustedTrustMarkIssuersOnlyCondition = shibboleth.Conditions.TRUE
+#idp.oidfed.op.automaticRegistration.ProvidedTrustChainMetadataCache = DefaultAutoRegisterFetchThroughProvidedTrustChainMetadataCache
+#idp.oidfed.op.automaticRegistration.cache.providedTrustChain.customFilterStrategies =
+#idp.oidfed.op.automaticRegistration.MetadataPolicyOperators = shibboleth.oidfed.StandardMetadataPolicyOperators
+#idp.oidfed.op.automaticRegistration.MetadataPolicyMergingStrategy = MetadataPolicyMergingStrategy
+#idp.oidfed.op.automaticRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
+#idp.oidfed.op.automaticRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
+#idp.oidfed.op.automaticRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
+#idp.oidfed.op.automaticRegistration.EntityConfigurationMetadataCache = shibboleth.oidfed.EntityConfigurationMetadataCache
+#idp.oidfed.op.automaticRegistration.LocalTrustAnchorsMetadataCache = shibboleth.oidfed.LocalTrustAnchorsMetadataCache
+#idp.oidfed.op.automaticRegistration.TrustedTrustMarkIssuersOnlyCondition = shibboleth.Conditions.TRUE
-
-idp.oidfed.op.explicitRegistration.mandatoryTrustMarks =
-idp.oidfed.op.explicitRegistration.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
-idp.oidfed.op.explicitRegistration.trustchain.resolver.fallbackToLocalCondition = shibboleth.Conditions.TRUE
-idp.oidfed.op.explicitRegistration.tokenEndpointAuthMethods = client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt
-idp.oidfed.op.metadata.minRefreshDelay = PT5M
-idp.oidfed.op.metadata.maxRefreshDelay = PT4H
-idp.oidfed.op.metadata.values = shibboleth.oidfed.configuration.DefaultDynamicValueResolvers
-idp.oidfed.op.metadata.registrationTypesSupported = automatic,explicit
-idp.oidfed.op.metadata.resolver = shibboleth.oidfed.DefaultOpenIdConfigurationResolver
-idp.oidfed.SignedKeysetMetadataCache = shibboleth.oidfed.SignedKeysetMetadataCache
-idp.oidfed.cache.explicitRegistration.maxJwtLifetime = PT1M
-idp.oidfed.cache.explicitRegistration.critClaims = %{idp.oidfed.cache.default.critClaims:}
+#idp.oidfed.op.explicitRegistration.mandatoryTrustMarks =
+#idp.oidfed.op.explicitRegistration.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
+#idp.oidfed.op.explicitRegistration.trustchain.resolver.fallbackToLocalCondition = shibboleth.Conditions.TRUE
+#idp.oidfed.op.explicitRegistration.tokenEndpointAuthMethods = client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt
+#idp.oidfed.op.metadata.minRefreshDelay = PT5M
+#idp.oidfed.op.metadata.maxRefreshDelay = PT4H
+#idp.oidfed.op.metadata.values = shibboleth.oidfed.configuration.DefaultDynamicValueResolvers
+#idp.oidfed.op.metadata.registrationTypesSupported = automatic,explicit
+#idp.oidfed.op.metadata.resolver = shibboleth.oidfed.DefaultOpenIdConfigurationResolver
+#idp.oidfed.SignedKeysetMetadataCache = shibboleth.oidfed.SignedKeysetMetadataCache
+#idp.oidfed.cache.explicitRegistration.maxJwtLifetime = PT1M
+#idp.oidfed.cache.explicitRegistration.critClaims = %{idp.oidfed.cache.default.critClaims:}
# register-beans
-idp.service.logging.oidfeddynreg = OIDFED.Registration
-idp.oidc.requestParser.FederationRegisterRequest =
-idp.oidfed.op.explicitRegistration.ProvidedTrustChainMetadataCache = DefaultFetchThroughProvidedTrustChainMetadataCache
-idp.oidfed.op.explicitRegistration.cache.trustChain.customFilterStrategies =
-idp.oidfed.op.explicitRegistration.cache.trustChain.maximumChainLength = 5
-idp.oidfed.op.explicitRegistration.cache.trustChain.maximumAuthorityHints = 5
-idp.oidfed.op.explicitRegistration.ProvidedEntityConfigurationMetadataCache = FetchThroughProvidedEntityConfigurationMetadataCache
-idp.oidfed.op.explicitRegistration.cache.entityConfiguration.customFilterStrategies =
-idp.oidfed.op.explicitRegistration.cache.explicitRegistrationRequest.claimsValidator = shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator
-idp.oidfed.op.explicitRegistration.MetadataPolicyOperators = shibboleth.oidfed.StandardMetadataPolicyOperators
-idp.oidfed.op.explicitRegistration.MetadataPolicyMergingStrategy = MetadataPolicMergingyStrategy
-idp.oidfed.op.explicitRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
-idp.oidfed.op.explicitRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
-idp.oidfed.op.explicitRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
-idp.oidfed.op.explicitRegistration.EntityConfigurationMetadataCache = shibboleth.oidfed.EntityConfigurationMetadataCache
-idp.oidfed.op.explicitRegistration.LocalTrustAnchorsMetadataCache = shibboleth.oidfed.LocalTrustAnchorsMetadataCache
-idp.oidfed.op.explicitRegistration.TrustedTrustMarkIssuersOnlyCondition = shibboleth.Conditions.TRUE
-idp.oidfed.op.explicitRegistration.defaultScope = openid profile email address phone offline_access
-idp.oidfed.op.explicitRegistration.defaultSubjectType = public
-idp.oidfed.op.explicitRegistration.validateRemoteJwks = shibboleth.Conditions.TRUE
-idp.oidfed.op.explicitRegistration.clientInformationManager = shibboleth.oidc.ClientInformationManager
-idp.oidfed.op.explicitRegistration.StorageService = shibboleth.StorageService
-idp.oidfed.op.explicitRegistration.FederationPolicyConstraints = shibboleth.oidfed.DefaultFederationPolicyConstraints
-idp.oidfed.op.explicitRegistration.providedTrustChain.leaf.claimsValidator = shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator
-idp.oidfed.op.explicitRegistration.providedTrustChain.anchor.claimsValidator = shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator
-idp.oidfed.op.explicitRegistration.providedTrustChain.subordinate.claimsValidator = shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator
+#idp.service.logging.oidfeddynreg = OIDFED.Registration
+#idp.oidc.requestParser.FederationRegisterRequest =
+#idp.oidfed.op.explicitRegistration.ProvidedTrustChainMetadataCache = DefaultFetchThroughProvidedTrustChainMetadataCache
+#idp.oidfed.op.explicitRegistration.cache.trustChain.customFilterStrategies =
+#idp.oidfed.op.explicitRegistration.cache.trustChain.maximumChainLength = 5
+#idp.oidfed.op.explicitRegistration.cache.trustChain.maximumAuthorityHints = 5
+#idp.oidfed.op.explicitRegistration.ProvidedEntityConfigurationMetadataCache = FetchThroughProvidedEntityConfigurationMetadataCache
+#idp.oidfed.op.explicitRegistration.cache.entityConfiguration.customFilterStrategies =
+#idp.oidfed.op.explicitRegistration.cache.explicitRegistrationRequest.claimsValidator = shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator
+#idp.oidfed.op.explicitRegistration.MetadataPolicyOperators = shibboleth.oidfed.StandardMetadataPolicyOperators
+#idp.oidfed.op.explicitRegistration.MetadataPolicyMergingStrategy = MetadataPolicMergingyStrategy
+#idp.oidfed.op.explicitRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
+#idp.oidfed.op.explicitRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
+i#dp.oidfed.op.explicitRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
+i#dp.oidfed.op.explicitRegistration.EntityConfigurationMetadataCache = shibboleth.oidfed.EntityConfigurationMetadataCache
+i#dp.oidfed.op.explicitRegistration.LocalTrustAnchorsMetadataCache = shibboleth.oidfed.LocalTrustAnchorsMetadataCache
+i#dp.oidfed.op.explicitRegistration.TrustedTrustMarkIssuersOnlyCondition = shibboleth.Conditions.TRUE
+i#dp.oidfed.op.explicitRegistration.defaultScope = openid profile email address phone offline_access
+i#dp.oidfed.op.explicitRegistration.defaultSubjectType = public
+i#dp.oidfed.op.explicitRegistration.validateRemoteJwks = shibboleth.Conditions.TRUE
+i#dp.oidfed.op.explicitRegistration.clientInformationManager = shibboleth.oidc.ClientInformationManager
+i#dp.oidfed.op.explicitRegistration.StorageService = shibboleth.StorageService
+i#dp.oidfed.op.explicitRegistration.FederationPolicyConstraints = shibboleth.oidfed.DefaultFederationPolicyConstraints
+i#dp.oidfed.op.explicitRegistration.providedTrustChain.leaf.claimsValidator = shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator
+i#dp.oidfed.op.explicitRegistration.providedTrustChain.anchor.claimsValidator = shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator
+i#dp.oidfed.op.explicitRegistration.providedTrustChain.subordinate.claimsValidator = shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator
# signed-keyset-beans
-idp.service.logging.oidfedconfig = OIDFED.SignedKeyset
-idp.oidfed.op.cache.signedKeyset.minRefreshDelay = PT1S
-idp.oidfed.op.cache.signedKeyset.maxRefreshDelay = PT30S
+i#dp.service.logging.oidfedconfig = OIDFED.SignedKeyset
+i#dp.oidfed.op.cache.signedKeyset.minRefreshDelay = PT1S
+i#dp.oidfed.op.cache.signedKeyset.maxRefreshDelay = PT30S
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/module.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/module.properties
index d856797..89e6f39 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/module.properties
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/module.properties
@@ -6,4 +6,8 @@ idp.oidc.OP.oidfed.plugin = net.shibboleth.idp.plugin.oidc.op.oidfed
idp.oidc.OP.oidfed.name = OpenID Federation plugin for OP
idp.oidc.OP.oidfed.desc = OpenID Federation support for OP
-idp.oidc.OP.oidfed.url = /OIDFED
+idp.oidc.OP.oidfed.url = /OIDFEDOP
+
+idp.oidc.OP.oidfed.1.src = /net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
+idp.oidc.OP.oidfed.1.dest = conf/oidfed/oidfed-op.properties
+idp.oidc.OP.oidfed.1.replace = false
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list