[java-oidfed-common] branch main updated: New profile configuration option 'requireRemoteTrustMarkValidation'
Codeberg
noreply at shibboleth.net
Sun Oct 11 14:01:31 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-oidfed-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/544e5964d161377c00d320c2bd988f549f904686
The following commit(s) were added to refs/heads/main by this push:
new 544e596 New profile configuration option 'requireRemoteTrustMarkValidation'
544e596 is described below
commit 544e5964d161377c00d320c2bd988f549f904686
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Sun Oct 11 17:00:46 2026 +0300
New profile configuration option 'requireRemoteTrustMarkValidation'
- If true (default), requires remote trust mark validation
- Also requires trust mark issuers to provide status endpoint
- Wire flags to resolve-entity
- idp.oidfed.resolveEntity.remoteTrustMarkValidation (was missing previously)
- idp.oidfed.resolveEntity.requireRemoteTrustMarkValidation
---
...ionTrustMarkValidatingProfileConfiguration.java | 10 +++++
.../RequireRemoteTrustMarkValidationPredicate.java | 43 +++++++++++++++++++
.../test-trust-chain-resolution-beans.xml | 5 +++
.../idp/service/relying-party/postconfig.xml | 2 +
.../cli/TestTrustChainResolutionArguments.java | 11 +++++
...FederationRegistrationProfileConfiguration.java | 49 ++++++++++++++++-----
...ederationResolveEntityProfileConfiguration.java | 50 +++++++++++++++++-----
.../oidfed/profile/impl/ResolveTrustMarks.java | 4 +-
.../oidfed/profile/impl/ValidateTrustMarks.java | 32 +++++++++++++-
.../oidfed/conf/oidfed/oidfed.properties | 2 +
10 files changed, 184 insertions(+), 24 deletions(-)
diff --git a/oidfed-common-api/src/main/java/net/shibboleth/oidfed/profile/config/OIDFederationTrustMarkValidatingProfileConfiguration.java b/oidfed-common-api/src/main/java/net/shibboleth/oidfed/profile/config/OIDFederationTrustMarkValidatingProfileConfiguration.java
index 7a6dbfc..d425d5b 100644
--- a/oidfed-common-api/src/main/java/net/shibboleth/oidfed/profile/config/OIDFederationTrustMarkValidatingProfileConfiguration.java
+++ b/oidfed-common-api/src/main/java/net/shibboleth/oidfed/profile/config/OIDFederationTrustMarkValidatingProfileConfiguration.java
@@ -71,4 +71,14 @@ public interface OIDFederationTrustMarkValidatingProfileConfiguration extends OA
@ConfigurationSetting(name="remoteTrustMarkValidation")
boolean isRemoteTrustMarkValidation(@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get whether remote validation of trust marks is required. Trust mark will be accepted only if the remote
+ * validation is performed successfully. The trust mark issuer must provide means to perform it.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether trust marks are required to be remotely validated
+ */
+ @ConfigurationSetting(name="requireRemoteTrustMarkValidation")
+ boolean isRequireRemoteTrustMarkValidation(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidfed-common-api/src/main/java/net/shibboleth/oidfed/profile/config/navigate/RequireRemoteTrustMarkValidationPredicate.java b/oidfed-common-api/src/main/java/net/shibboleth/oidfed/profile/config/navigate/RequireRemoteTrustMarkValidationPredicate.java
new file mode 100644
index 0000000..d2bd770
--- /dev/null
+++ b/oidfed-common-api/src/main/java/net/shibboleth/oidfed/profile/config/navigate/RequireRemoteTrustMarkValidationPredicate.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidfed.profile.config.navigate;
+
+import java.util.Optional;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidfed.profile.config.OIDFederationTrustMarkValidatingProfileConfiguration;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OIDFederationTrustMarkValidatingProfileConfiguration#isRequireRemoteTrustMarkValidation(ProfileRequestContext)},
+ * defaults to true.
+ */
+public class RequireRemoteTrustMarkValidationPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ return Optional.ofNullable(getRelyingPartyContextLookupStrategy().apply(input))
+ .map(rpc -> rpc.getProfileConfig())
+ .filter(OIDFederationTrustMarkValidatingProfileConfiguration.class::isInstance)
+ .map(OIDFederationTrustMarkValidatingProfileConfiguration.class::cast)
+ .map(pc -> pc.isRequireRemoteTrustMarkValidation(input))
+ .orElse(true);
+ }
+}
diff --git a/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidfed/test-trust-chain-resolution/test-trust-chain-resolution-beans.xml b/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidfed/test-trust-chain-resolution/test-trust-chain-resolution-beans.xml
index c2f0bc5..0e9db67 100644
--- a/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidfed/test-trust-chain-resolution/test-trust-chain-resolution-beans.xml
+++ b/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/oidfed/test-trust-chain-resolution/test-trust-chain-resolution-beans.xml
@@ -98,6 +98,11 @@
c:expression="'true'.equalsIgnoreCase(#custom.get().getParameter('remoteTrustMarkValidation'))"
p:customObject-ref="shibboleth.HttpServletRequestSupplier" />
</property>
+ <property name="requireRemoteTrustMarkValidationCondition">
+ <bean parent="shibboleth.Conditions.Expression"
+ c:expression="'true'.equalsIgnoreCase(#custom.get().getParameter('requireRemoteTrustMarkValidation'))"
+ p:customObject-ref="shibboleth.HttpServletRequestSupplier" />
+ </property>
</bean>
<bean id="oidc.messageEncoderFactory"
diff --git a/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index b657cf4..9744d6d 100644
--- a/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/oidfed-common-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -24,6 +24,8 @@
p:issuer-ref="shibboleth.oidfed.entityId"
p:tokenEndpointAuthMethods="%{idp.oidfed.resolveEntity.endpointAuthMethods:private_key_jwt}"
p:useTargetedEndpointAsJWTAudience="%{idp.oidfed.resolveEntity.targetedEndpointAsJWTAudience:true}"
+ p:remoteTrustMarkValidation="%{idp.oidfed.resolveEntity.remoteTrustMarkValidation:true}"
+ p:requireRemoteTrustMarkValidation="%{idp.oidfed.resolveEntity.requireRemoteTrustMarkValidation:true}"
p:requireSingleJWTAudience="%{idp.oidfed.resolveEntity.requireSingleJWTAudience:true}">
<property name="claimsValidator">
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator">
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/cli/TestTrustChainResolutionArguments.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/cli/TestTrustChainResolutionArguments.java
index a78208c..32eda96 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/cli/TestTrustChainResolutionArguments.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/cli/TestTrustChainResolutionArguments.java
@@ -54,6 +54,9 @@ public class TestTrustChainResolutionArguments extends AbstractCommandLineArgume
/** The URL parameter name for the flag to signal remote trust mark validation. */
public static final String URL_PARAM_REMOTE_TRUST_MARK_VALIDATION = "remoteTrustMarkValidation";
+ /** The URL parameter name for the flag to signal required remote trust mark validation. */
+ public static final String URL_PARAM_REQUIRE_REMOTE_TRUST_MARK_VALIDATION = "requireRemoteTrustMarkValidation";
+
/** Metadata policy to embed in the token. */
@Parameter(names = {"-id", "--entityID"}, required = false, description = "Entity ID to be resolved")
@Nullable private String entityId;
@@ -88,6 +91,11 @@ public class TestTrustChainResolutionArguments extends AbstractCommandLineArgume
description = "Flag to do remote trust mark validation")
private boolean remoteTrustMarkValidation;
+ /** Flag to signal required remote trust mark validation. */
+ @Parameter(names = {"-requireTrustMarkValidation", "--requireRemoteTrustMarkValidation"}, required = false,
+ description = "Flag to require remote trust mark validation")
+ private boolean requireRemoteTrustMarkValidation;
+
/** {@inheritDoc} */
@Override
public void validate() {
@@ -127,6 +135,9 @@ public class TestTrustChainResolutionArguments extends AbstractCommandLineArgume
if (remoteTrustMarkValidation) {
builder.append("&" + URL_PARAM_REMOTE_TRUST_MARK_VALIDATION + "=true");
}
+ if (requireRemoteTrustMarkValidation) {
+ builder.append("&" + URL_PARAM_REQUIRE_REMOTE_TRUST_MARK_VALIDATION + "=true");
+ }
} catch (final UnsupportedEncodingException e) {
// UTF-8 is a required encoding.
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/config/impl/AbstractOIDFederationRegistrationProfileConfiguration.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/config/impl/AbstractOIDFederationRegistrationProfileConfiguration.java
index 4d758dd..5399b73 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/config/impl/AbstractOIDFederationRegistrationProfileConfiguration.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/config/impl/AbstractOIDFederationRegistrationProfileConfiguration.java
@@ -57,6 +57,9 @@ public class AbstractOIDFederationRegistrationProfileConfiguration extends Abstr
/** Whether trust marks should be remotely validated. */
@Nonnull private Predicate<ProfileRequestContext> remoteTrustMarkValidationCondition;
+ /** Whether remote validation of trust marks is required. */
+ @Nonnull private Predicate<ProfileRequestContext> requireRemoteTrustMarkValidationCondition;
+
/**
* Constructor.
*
@@ -69,6 +72,7 @@ public class AbstractOIDFederationRegistrationProfileConfiguration extends Abstr
mandatoryTrustMarksLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
maximumTrustMarkLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofDays(365));
remoteTrustMarkValidationCondition = PredicateSupport.alwaysTrue();
+ requireRemoteTrustMarkValidationCondition = PredicateSupport.alwaysTrue();
}
/** {@inheritDoc} */
@@ -174,23 +178,48 @@ public class AbstractOIDFederationRegistrationProfileConfiguration extends Abstr
return remoteTrustMarkValidationCondition.test(profileRequestContext);
}
- /**
- * Set whether trust marks should be remotely validated.
- *
- * @param flag flag to set
- */
+ /**
+ * Set whether trust marks should be remotely validated.
+ *
+ * @param flag flag to set
+ */
public void setRemoteTrustMarkValidation(final boolean flag) {
remoteTrustMarkValidationCondition = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
- /**
- * Set condition for whether trust marks should be remotely validated.
- *
- * @param condition condition to set
- */
+ /**
+ * Set condition for whether trust marks should be remotely validated.
+ *
+ * @param condition condition to set
+ */
public void setRemoteTrustMarkValidationPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
remoteTrustMarkValidationCondition = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ public boolean isRequireRemoteTrustMarkValidation(@Nullable final ProfileRequestContext profileRequestContext) {
+ return requireRemoteTrustMarkValidationCondition.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether remote validation of trust marks is required.
+ *
+ * @param flag flag to set
+ */
+ public void setRequireRemoteTrustMarkValidation(final boolean flag) {
+ requireRemoteTrustMarkValidationCondition = flag ?
+ PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether remote validation of trust marks is required.
+ *
+ * @param condition condition to set
+ */
+ public void setRequireRemoteTrustMarkValidationPredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ requireRemoteTrustMarkValidationCondition = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
}
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/config/impl/DefaultOIDFederationResolveEntityProfileConfiguration.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/config/impl/DefaultOIDFederationResolveEntityProfileConfiguration.java
index e45f1b6..3833a32 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/config/impl/DefaultOIDFederationResolveEntityProfileConfiguration.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/config/impl/DefaultOIDFederationResolveEntityProfileConfiguration.java
@@ -64,6 +64,9 @@ public class DefaultOIDFederationResolveEntityProfileConfiguration
/** Whether trust marks should be remotely validated. */
@Nonnull private Predicate<ProfileRequestContext> remoteTrustMarkValidationCondition;
+ /** Whether remote validation of trust marks is required. */
+ @Nonnull private Predicate<ProfileRequestContext> requireRemoteTrustMarkValidationCondition;
+
/**
* Constructor.
*/
@@ -84,6 +87,7 @@ public class DefaultOIDFederationResolveEntityProfileConfiguration
mandatoryTrustMarksLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
maximumTrustMarkLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofDays(365));
remoteTrustMarkValidationCondition = PredicateSupport.alwaysTrue();
+ requireRemoteTrustMarkValidationCondition = PredicateSupport.alwaysTrue();
}
/** {@inheritDoc} */
@@ -253,22 +257,48 @@ public class DefaultOIDFederationResolveEntityProfileConfiguration
return remoteTrustMarkValidationCondition.test(profileRequestContext);
}
- /**
- * Set whether trust marks should be remotely validated.
- *
- * @param flag flag to set
- */
+ /**
+ * Set whether trust marks should be remotely validated.
+ *
+ * @param flag flag to set
+ */
public void setRemoteTrustMarkValidation(final boolean flag) {
remoteTrustMarkValidationCondition = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
- /**
- * Set condition for whether trust marks should be remotely validated.
- *
- * @param condition condition to set
- */
+ /**
+ * Set condition for whether trust marks should be remotely validated.
+ *
+ * @param condition condition to set
+ */
public void setRemoteTrustMarkValidationPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
remoteTrustMarkValidationCondition = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ public boolean isRequireRemoteTrustMarkValidation(@Nullable final ProfileRequestContext profileRequestContext) {
+ return requireRemoteTrustMarkValidationCondition.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether remote validation of trust marks is required.
+ *
+ * @param flag flag to set
+ */
+ public void setRequireRemoteTrustMarkValidation(final boolean flag) {
+ requireRemoteTrustMarkValidationCondition = flag ?
+ PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether remote validation of trust marks is required.
+ *
+ * @param condition condition to set
+ */
+ public void setRequireRemoteTrustMarkValidationPredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ requireRemoteTrustMarkValidationCondition = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/ResolveTrustMarks.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/ResolveTrustMarks.java
index ab35a52..b4f7a4e 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/ResolveTrustMarks.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/ResolveTrustMarks.java
@@ -363,8 +363,8 @@ public class ResolveTrustMarks extends AbstractProfileAction {
final Map<String, List<TrustMark>> verifiedTrustMarks = new HashMap<>();
for (final EntityStatement<?> statement : selectedTrustChain) {
final List<TrustMark> trustMarks = chainTrustMarks.get(statement.getSubject());
- if (trustMarks == null || trustMarks.isEmpty()) {
- break;
+ if (trustMarks == null || trustMarks.isEmpty() || verifiedTrustMarks.containsKey(statement.getSubject())) {
+ continue;
}
verifiedTrustMarks.put(
statement.getSubject(),
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/ValidateTrustMarks.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/ValidateTrustMarks.java
index 8958349..5abf641 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/ValidateTrustMarks.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/profile/impl/ValidateTrustMarks.java
@@ -40,6 +40,7 @@ import net.shibboleth.oidfed.metadata.TrustMark;
import net.shibboleth.oidfed.metadata.cache.trustmark.TrustMarkStatusCacheIdentifier;
import net.shibboleth.oidfed.metadata.cache.trustmark.TrustMarkStatusContainer;
import net.shibboleth.oidfed.metadata.cache.trustmark.TrustMarkStatusIdentifierCriterion;
+import net.shibboleth.oidfed.profile.config.navigate.RequireRemoteTrustMarkValidationPredicate;
import net.shibboleth.oidfed.profile.config.navigate.RemoteTrustMarkValidationPredicate;
import net.shibboleth.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.oidfed.profile.context.VerifiedTrustChain;
@@ -54,6 +55,9 @@ import net.shibboleth.shared.resolver.CriteriaSet;
/**
* Validates the trust marks for the selected trust chain and updates the info to {@link RelyingPartyTrustChainContext}.
+ * Note that solely the trust chain subject's trust marks are validated, even though the data structure on
+ * {@link RelyingPartyTrustChainContext#getVerifiedTrustMarks()} may contain trust marks for the other entities in the
+ * trust chain.
*
* @event {@link EventIds#PROCEED_EVENT_ID}
* @event {@link EventIds#INVALID_MSG_CTX}
@@ -73,6 +77,9 @@ public class ValidateTrustMarks extends AbstractProfileAction {
/** Condition for whether trust marks should be remotely validated. */
@Nonnull private Predicate<ProfileRequestContext> remoteTrustMarkValidationCondition;
+ /** Condition for whether trust marks are required to be remotely validated. */
+ @Nonnull private Predicate<ProfileRequestContext> requireRemoteTrustMarkValidationCondition;
+
/** Trust chain context to operate on. */
@NonnullBeforeExec private RelyingPartyTrustChainContext trustChainContext;
@@ -89,6 +96,7 @@ public class ValidateTrustMarks extends AbstractProfileAction {
assert tcls != null;
trustChainContextLookupStrategy = tcls;
remoteTrustMarkValidationCondition = new RemoteTrustMarkValidationPredicate();
+ requireRemoteTrustMarkValidationCondition = new RequireRemoteTrustMarkValidationPredicate();
}
/**
@@ -118,10 +126,22 @@ public class ValidateTrustMarks extends AbstractProfileAction {
*
* @param condition condition to set
*/
- public void setRemoteTrustMarkValidationCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ public void setRemoteTrustMarkValidationCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
remoteTrustMarkValidationCondition = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /**
+ * Set condition for whether trust marks are required to be remotely validated. Trust mark will be accepted only
+ * if the remote validation is performed successfully. The trust mark issuer must provide means to perform it.
+ * The {@link #remoteTrustMarkValidationCondition} must also return true.
+ *
+ * @param condition condition to set
+ */
+ public void setRequireRemoteTrustMarkValidationCondition(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ requireRemoteTrustMarkValidationCondition = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -202,7 +222,15 @@ public class ValidateTrustMarks extends AbstractProfileAction {
.map(value -> StringSupport.trimOrNull(value))
.orElse(null);
if (uri == null) {
- log.debug("{} No trust mark status endpoint defined for {}, nothing to do", getLogPrefix(), issuer);
+ if (requireRemoteTrustMarkValidationCondition.test(profileRequestContext)) {
+ log.warn("{} No status endpoint defined for {}, removing trust mark {} for {}",
+ getLogPrefix(), issuer, trustMarkType, trustMarkSubject);
+ subjectTrustMarks.remove(trustMark);
+ subjectTrustMarkIds.remove(trustMarkType);
+ } else {
+ log.debug("{} No status endpoint defined for {}, skipping validation of trust mark {} for {}",
+ getLogPrefix(), issuer, trustMarkType, trustMarkSubject);
+ }
continue;
}
final TrustMarkStatusCacheIdentifier cacheIdentifier =
diff --git a/oidfed-common-impl/src/main/resources/net/shibboleth/oidfed/conf/oidfed/oidfed.properties b/oidfed-common-impl/src/main/resources/net/shibboleth/oidfed/conf/oidfed/oidfed.properties
index 5f10d61..677e450 100644
--- a/oidfed-common-impl/src/main/resources/net/shibboleth/oidfed/conf/oidfed/oidfed.properties
+++ b/oidfed-common-impl/src/main/resources/net/shibboleth/oidfed/conf/oidfed/oidfed.properties
@@ -149,3 +149,5 @@
#idp.oidfed.resolveEntity.TrustedTrustMarkIssuersOnlyCondition = shibboleth.Conditions.TRUE
#idp.oidfed.resolveEntity.minRefreshDelay = PT1M
#idp.oidfed.resolveEntity.maxRefreshDelay = PT30M
+#idp.oidfed.resolveEntity.remoteTrustMarkValidation = true
+#idp.oidfed.resolveEntity.requireRemoteTrustMarkValidation = true
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list