[java-plugin-shibd-oidc] 10/13: Remove redundant test credentials file, add new JWKS resolver parent
Codeberg
noreply at shibboleth.net
Fri Oct 16 14:48:50 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/JSHIBDOIDC-31-cred-resolver
in repository java-plugin-shibd-oidc.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/e229cfcb3bb5866b4c11e523d8074f38bfb4a1d9
commit e229cfcb3bb5866b4c11e523d8074f38bfb4a1d9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Oct 5 14:34:46 2026 +0100
Remove redundant test credentials file, add new JWKS resolver parent
---
.../sp/service/credentials/postconfig.xml | 23 ++++++
.../idp/module/conf/sp/oidc-credentials.xml | 89 ----------------------
2 files changed, 23 insertions(+), 89 deletions(-)
diff --git a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml
index fcc1565..fc10fab 100644
--- a/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml
+++ b/sp-oidc-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/credentials/postconfig.xml
@@ -28,6 +28,12 @@
p:storageService-ref="shibboleth.sp.CredentialStorage.ReadOnly"
p:velocityEngine-ref="shibboleth.VelocityEngine"
p:contextTemplate="${protocol}" />
+
+ <bean id="shibboleth.sp.CredentialResolver.StorageBased.JWKS"
+ class="net.shibboleth.sp.jose.credential.impl.JWKCredentialStorageService" abstract="true"
+ p:storageService-ref="shibboleth.sp.CredentialStorage.ReadOnly"
+ p:velocityEngine-ref="shibboleth.VelocityEngine"
+ p:contextTemplate="${protocol}" />
<bean id="shibboleth.sp.oidc.CredentialResolver.StorageBased.JWK"
@@ -47,6 +53,23 @@
</property>
</bean>
+ <bean id="shibboleth.sp.oidc.CredentialResolver.StorageBased.JWKS"
+ parent="shibboleth.sp.CredentialResolver.StorageBased.JWKS" abstract="true">
+ <property name="protocols">
+ <util:constant static-field="net.shibboleth.oidc.saml.xmlobject.Constants.OIDC_PROTOCOL_URI" />
+ </property>
+ <property name="protocolMap">
+ <map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.oidc.saml.xmlobject.Constants.OIDC_PROTOCOL_URI" />
+ </key>
+ <value>oidc</value>
+ </entry>
+ </map>
+ </property>
+ </bean>
+
<!-- END -->
diff --git a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml b/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
deleted file mode 100644
index 955a893..0000000
--- a/sp-oidc-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/oidc-credentials.xml
+++ /dev/null
@@ -1,89 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!-- TODO: with changes to credential resolver, remove this!! -->
-
- <!--
- This file contains default OIDC signing and encryption credentials. This file should be imported into agents.xml.
- -->
-
- <!-- Uncomment these credentials for advanced signing and decryption operations -->
-
-
- <bean id="shibboleth.oidc.DefaultRSSigningCredential" parent="shibboleth.oidc.JWKCredential"
- p:resource="%{sp.oidc.signing.rs.key:#{null}}" p:throwIfNull="false" />
-
- <bean id="shibboleth.oidc.DefaultESSigningCredential" parent="shibboleth.oidc.JWKCredential"
- p:resource="%{sp.oidc.signing.es.key:#{null}}" p:throwIfNull="false" />
-
- <bean id="shibboleth.oidc.DefaultRSAEncryptionCredential" parent="shibboleth.oidc.JWKCredential"
- p:resource="%{sp.oidc.encryption.rsa.key:#{null}}" p:throwIfNull="false" />
-
-
- <!--
- Lists ALL of your RP's signing credentials for the default security configuration.
- If you define additional signing credentials make sure to include them within this list.
- -->
- <util:list id="shibboleth.oidc.SigningCredentials">
-
- <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
- <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
-
- </util:list>
-
- <!--
- Lists ALL of your RP's token decryption credentials for the default security configuration.
- If you define additional decryption credentials make sure to include them within this list.
- -->
- <util:list id="shibboleth.oidc.EncryptionCredentials">
-
- <ref bean="shibboleth.oidc.DefaultRSAEncryptionCredential" />
-
- </util:list>
-
- <!--
- If you need to publish a key set different from shibboleth.oidc.EncryptionCredentials, define
- a list bean named "shibboleth.oidc.EncryptionCredentialsToPublish".
- -->
-
- <!-- Example of two active encryption credentials, but only publishing the second before removing from use. -->
- <!--
- <util:list id="shibboleth.oidc.EncryptionCredentialsToPublish">
- <ref bean="shibboleth.oidc.OnlyNewDefaultRSAEncryptionCredential" />
- </util:list>
- -->
-
- <!--
- If you need to publish a key set different from shibboleth.oidc.SigningCredentials, define
- a list bean named "shibboleth.oidc.SigningCredentialsToPublish".
- -->
-
- <!-- Example of publishing two signing credentials, before active use. -->
- <!--
- <util:list id="shibboleth.oidc.SigningCredentialsToPublish">
- <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
- <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
- <ref bean="shibboleth.oidc.UpcomingDefaultRSSigningCredential" />
- </util:list>
- -->
-
- <!--
- This file contains the default credential based on the client_secret, which will be the only used credential in
- most cases for the RP-Proxy. This file should be imported into credentials.xml.
- -->
-
- <bean id="shibboleth.oidc.DefaultCredential" parent="shibboleth.oidc.ClientSecretCredential"
- p:secret="%{sp.oidc.defaultClientSecret:#{null}}"/>
-
-</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list