[java-idp-plugin-vci] branch main updated: Align nonce flow with OP info flows
Codeberg
noreply at shibboleth.net
Thu Oct 22 13:38:48 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/77047cb37efcf4948fe125ffe15130cc0588bdfa
The following commit(s) were added to refs/heads/main by this push:
new 77047cb Align nonce flow with OP info flows
77047cb is described below
commit 77047cb37efcf4948fe125ffe15130cc0588bdfa
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Thu Oct 22 16:38:32 2026 +0300
Align nonce flow with OP info flows
---
README.md | 1 +
.../impl/DefaultOpenIDVCINonceConfiguration.java | 3 +
...ctInitializeOutboundResponseMessageContext.java | 74 ----------------------
.../InitializeOutboundResponseMessageContext.java | 30 ---------
.../openid/vci/abstract-api/abstract-api-beans.xml | 2 +-
.../openid/vci/abstract-api/abstract-api-flow.xml | 7 +-
.../idp/flows/openid/vci/nonce/nonce-beans.xml | 16 ++---
.../idp/flows/openid/vci/nonce/nonce-flow.xml | 6 +-
8 files changed, 21 insertions(+), 118 deletions(-)
diff --git a/README.md b/README.md
index 07aeb74..13c56e0 100644
--- a/README.md
+++ b/README.md
@@ -4518,6 +4518,7 @@ Endpoint `/idp/profile/openid/vci/nonce`, profile ID `http://geant.org/ns/profil
| Name | Type | Default | Description |
|---|---|---|---|
| `proofNonceGenerator` | Function<ProfileRequestContext,String> | **openidvci.DefaultOpenIDVCINonceGenerator** | Generator of the nonce. Same as in **OpenID.VCI.Credentials**. |
+| `inboundInterceptorFlows` | List<String> | | Interceptor flows run before the nonce is formed. |
| `outboundInterceptorFlows` | List<String> | | Interceptor flows run before the response is sent, also for an error response. |
| `messageHandler` | Function<MessageContext,Exception> | | Of the OP plugin. Runs on the outbound message before encoding. |
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCINonceConfiguration.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCINonceConfiguration.java
index 47f3ceb..8751c21 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCINonceConfiguration.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/config/impl/DefaultOpenIDVCINonceConfiguration.java
@@ -21,6 +21,9 @@ import org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfigurati
/** Profile configuration for the Nonce endpoint. */
public class DefaultOpenIDVCINonceConfiguration extends AbstractOpenIDVCIConfiguration{
+ /** Nonce profile counter name. */
+ public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.openid.vci.nonce";
+
/** Constructor. */
public DefaultOpenIDVCINonceConfiguration() {
super(OpenIDVCIConfiguration.PROFILE_ID_NONCE);
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AbstractInitializeOutboundResponseMessageContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
deleted file mode 100644
index b419be6..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright (c) 2025, GÉANT
- *
- * Licensed under the Apache License, Version 2.0 (the “License”); you may not
- * use this file except in compliance with the License. You may obtain a copy
- * of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an “AS IS” BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.geant.shibboleth.plugin.openidvci.profile.impl;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.shared.logic.Constraint;
-
-import org.opensaml.messaging.context.BaseContext;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Action that adds an outbound {@link MessageContext} and related OIDC contexts to the {@link ProfileRequestContext}.
- *
- * <p>Derived from {@code AbstractInitializeOutboundResponseMessageContext} of the OpenID Connect Provider plugin,
- * in package {@code net.shibboleth.idp.plugin.oidc.op.profile.impl}. That class is marked for removal, so this
- * plugin carries its own rather than extending one that is going away.</p>
- *
- * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
- */
-public abstract class AbstractInitializeOutboundResponseMessageContext extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractInitializeOutboundResponseMessageContext.class);
-
- /** Type of subcontext to create. */
- @Nonnull private Class<? extends BaseContext> contextType;
-
- /** Constructor. */
- public AbstractInitializeOutboundResponseMessageContext() {
- contextType = OIDCAuthenticationResponseContext.class;
- }
-
- /**
- * Set the type of subcontext to create.
- *
- * @param claz context type
- */
- public void setContextType(@Nonnull final Class<? extends BaseContext> claz) {
- ifInitializedThrowUnmodifiabledComponentException();
-
- contextType = Constraint.isNotNull(claz, "Context type cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final MessageContext msgCtx = new MessageContext();
- profileRequestContext.setOutboundMessageContext(msgCtx);
- msgCtx.ensureSubcontext(contextType);
- log.debug("{} Initialized outbound message context", getLogPrefix());
- }
-
-}
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
deleted file mode 100644
index ac304d8..0000000
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/InitializeOutboundResponseMessageContext.java
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright (c) 2025, GÉANT
- *
- * Licensed under the Apache License, Version 2.0 (the “License”); you may not
- * use this file except in compliance with the License. You may obtain a copy
- * of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an “AS IS” BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.geant.shibboleth.plugin.openidvci.profile.impl;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/**
- * Action that adds an outbound {@link MessageContext} and related OIDC contexts
- * to the {@link ProfileRequestContext} not knowing the relying party yet.
- *
- * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
- */
-public class InitializeOutboundResponseMessageContext extends AbstractInitializeOutboundResponseMessageContext {
-
-}
\ No newline at end of file
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-beans.xml
index ac17241..1760d05 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-beans.xml
@@ -16,7 +16,7 @@
<bean id="InitializeRelyingPartyContext" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeRelyingPartyContext"
scope="prototype" p:clientIDLookupStrategy-ref="shibboleth.ClientIDLookupStrategy"/>
- <bean id="InitializeOutboundMessageContext" class="org.geant.shibboleth.plugin.openidvci.profile.impl.InitializeOutboundResponseMessageContext"
+ <bean id="InitializeOutboundMessageContext" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundResponseMessageContext"
scope="prototype"/>
</beans>
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml
index 27d71bd..e38c8f0 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/abstract-api/abstract-api-flow.xml
@@ -25,13 +25,16 @@
</action-state>
<decision-state id="CheckInboundInterceptContext">
+ <on-entry>
+ <evaluate expression="flowRequestContext.getFlowScope().get('transitionAfterInboundIntercept') != null ? flowRequestContext.getFlowScope().get('transitionAfterInboundIntercept') : 'AuthenticationSetup'" result="flowScope.postInboundInterceptTransition"/>
+ </on-entry>
<if test="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
- then="AuthenticationSetup" else="DoInboundInterceptSubflow"/>
+ then="#{postInboundInterceptTransition}" else="DoInboundInterceptSubflow"/>
</decision-state>
<subflow-state id="DoInboundInterceptSubflow" subflow="intercept">
<input name="calledAsSubflow" value="true"/>
- <transition on="proceed" to="AuthenticationSetup"/>
+ <transition on="proceed" to="#{postInboundInterceptTransition}"/>
</subflow-state>
<action-state id="AuthenticationSetup">
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-beans.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-beans.xml
index e937c8b..60fae60 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-beans.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-beans.xml
@@ -11,10 +11,13 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize" default-destroy-method="destroy">
- <bean id="openidvci.profileId" class="java.lang.String" c:_0="http://geant.org/ns/profiles/openid/vci/nonce"/>
+ <bean id="openidvci.profileId" class="java.lang.String"
+ c:_0="#{T(org.geant.shibboleth.plugin.openidvci.profile.config.OpenIDVCIConfiguration).PROFILE_ID_NONCE}"/>
<bean id="openidvci.loggingId" class="java.lang.String"
c:_0="%{openidvci.logging.nonce:OpenID.VCI.Nonce}"/>
-
+ <util:constant id="shibboleth.metrics.ProfileCounter"
+ static-field="org.geant.shibboleth.plugin.openidvci.profile.config.impl.DefaultOpenIDVCINonceConfiguration.PROFILE_COUNTER"/>
+
<bean id="InitializeUnverifiedRelyingPartyContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeUnverifiedRelyingPartyContext" scope="prototype" />
@@ -22,18 +25,11 @@
scope="prototype" />
<bean id="BuildErrorResponseFromEvent" class="net.shibboleth.oidc.profile.impl.BuildJSONErrorResponseFromEvent"
- scope="prototype" p:defaultStatusCode="400" p:defaultCode="invalid_request"
+ scope="prototype" p:defaultStatusCode="500" p:defaultCode="server_error"
p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier">
<property name="eventContextLookupStrategy">
<bean class="net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction" />
</property>
- <property name="mappedErrors">
- <map value-type="com.nimbusds.oauth2.sdk.ErrorObject">
- <!--
- ADD SOME
- -->
- </map>
- </property>
</bean>
diff --git a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-flow.xml b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-flow.xml
index 3e1ab2a..2593b8f 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-flow.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-flow.xml
@@ -5,6 +5,9 @@
parent="openid/vci/abstract-api">
<action-state id="InitializeMandatoryContexts">
+ <on-entry>
+ <set name="flowScope.transitionAfterInboundIntercept" value="'BuildResponseMessage'"/>
+ </on-entry>
<evaluate expression="InitializeProfileRequestContext"/>
<evaluate expression="PopulateMetricContext"/>
<evaluate expression="FlowStartPopulateAuditContext"/>
@@ -12,8 +15,9 @@
<evaluate expression="InitializeUnverifiedRelyingPartyContext" />
<evaluate expression="SelectRelyingPartyConfiguration" />
<evaluate expression="SelectProfileConfiguration" />
+ <evaluate expression="PopulateInboundInterceptContext"/>
<evaluate expression="'proceed'"/>
- <transition on="proceed" to="BuildResponseMessage"/>
+ <transition on="proceed" to="CheckInboundInterceptContext"/>
</action-state>
<bean-import resource="classpath:/META-INF/net/shibboleth/idp/flows/openid/vci/nonce/nonce-beans.xml"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list