[java-idp-plugin-oidc-op-oidfed] branch main updated: Harmonise properties related to automatic/explicit registration
Codeberg
noreply at shibboleth.net
Fri Sep 4 11:40:22 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/9fa006fa98a1073c1fa968e98781f7fa39303ae3
The following commit(s) were added to refs/heads/main by this push:
new 9fa006f Harmonise properties related to automatic/explicit registration
9fa006f is described below
commit 9fa006fa98a1073c1fa968e98781f7fa39303ae3
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 4 14:40:02 2026 +0300
Harmonise properties related to automatic/explicit registration
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 2 +-
.../oidfed/metadata-lookup-ext-oidfed-beans.xml | 24 +++++++--------
.../idp/flows/oidfed/register/register-beans.xml | 2 +-
.../idp/service/relying-party/postconfig.xml | 8 +++--
.../op/oidfed/conf/oidfed/oidfed-op.properties | 34 ++++++++++++----------
5 files changed, 37 insertions(+), 33 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 19f6e49..267276a 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -142,7 +142,7 @@
<util:list>
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainIDsClaimsSetDecorator"/>
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredClientInformationStoreClaimsSetDecorator"
- p:clientInformationManager-ref="#{'%{idp.oidfed.autoreg.clientInformationManager:shibboleth.oidc.ClientInformationManager}'.trim()}" />
+ p:clientInformationManager-ref="#{'%{idp.oidfed.op.automaticRegistration.clientInformationManager:shibboleth.oidc.ClientInformationManager}'.trim()}" />
</util:list>
</entry>
</util:map>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
index b98c175..0daf0a4 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
@@ -24,8 +24,8 @@
<bean id="ValidateProvidedTrustChain" class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.ValidateProvidedTrustChain"
scope="prototype"
- p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.autoregister.TrustChainMetadataPolicyMergingStrategy:DefaultTrustChainMetadataPolicyMergingStrategy}'.trim()}"
- p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.autoregister.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"
+ p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.op.automaticRegistration.TrustChainMetadataPolicyMergingStrategy:DefaultTrustChainMetadataPolicyMergingStrategy}'.trim()}"
+ p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.op.automaticRegistration.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"
p:arraysAsSpaceSeparatedList="%{idp.oidfed.policy.arraysAsSpaceSeparatedList:scope}"
p:metadataValidationCondition-ref="#{'%{idp.oidfed.MetadataValidationCondition:DefaultMetadataValidationCondition}'.trim()}"
p:federationPolicyConstraints-ref="%{idp.oidfed.FederationPolicyConstraints:shibboleth.oidfed.DefaultFederationPolicyConstraints}"
@@ -38,7 +38,7 @@
</property>
<property name="providedTrustChainValidationStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.logic.DefaultProvidedTrustChainValidationStrategy"
- p:metadataCache-ref="#{'%{idp.oidfed.autoregister.ProvidedTrustChainMetadataCache:DefaultAutoRegisterFetchThroughProvidedTrustChainMetadataCache}'.trim()}" />
+ p:metadataCache-ref="#{'%{idp.oidfed.op.automaticRegistration.ProvidedTrustChainMetadataCache:DefaultAutoRegisterFetchThroughProvidedTrustChainMetadataCache}'.trim()}" />
</property>
</bean>
@@ -61,7 +61,7 @@
</property>
<property name="metadataFilterStrategy">
<bean class="net.shibboleth.oidfed.metadata.cache.trustchain.DefaultTrustChainSignatureValidationFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.providedTrustChain.customFilterStrategies:}'.trim())}">
+ p:customFilterStrategies="#{getObject('%{idp.oidfed.op.automaticRegistration.cache.providedTrustChain.customFilterStrategies:}'.trim())}">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
@@ -96,16 +96,16 @@
<bean id="DefaultMetadataPolicyEnforcer"
class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
- p:metadataPolicyOperators-ref="#{'%{idp.oidfed.authorize.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
+ p:metadataPolicyOperators-ref="#{'%{idp.oidfed.op.automaticRegistration.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="DefaultTrustChainMetadataPolicyMergingStrategy"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustChainMetadataPolicyMergingStrategy"
- p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.authorize.MetadataPolicMergingyStrategy:MetadataPolicMergingyStrategy}'.trim()}"
- p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.authorize.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
+ p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.op.automaticRegistration.MetadataPolicyMergingStrategy:MetadataPolicyMergingStrategy}'.trim()}"
+ p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.op.automaticRegistration.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
- <bean id="MetadataPolicMergingyStrategy"
+ <bean id="MetadataPolicyMergingStrategy"
class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
- p:metadataPolicyOperators-ref="#{'%{idp.oidfed.authorize.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
+ p:metadataPolicyOperators-ref="#{'%{idp.oidfed.op.automaticRegistration.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="DefaultLocalMetadataPolicyStrategy"
parent="shibboleth.Functions.Constant">
@@ -149,7 +149,7 @@
<bean id="ResolveTrustMarks" class="net.shibboleth.oidfed.profile.impl.ResolveTrustMarks"
scope="prototype"
- p:trustChainCache-ref="#{'%{idp.oidfed.authorize.TrustChainMetadataCache:shibboleth.oidfed.TrustChainMetadataCache}'.trim()}"
+ p:trustChainCache-ref="#{'%{idp.oidfed.op.automaticRegistration.TrustChainMetadataCache:shibboleth.oidfed.TrustChainMetadataCache}'.trim()}"
p:trustMarkClaimsValidationLookupStrategy="#{getObject('shibboleth.oidfed.TrustMarkClaimsValidationLookupStrategy') ?: getObject('DefaultTrustMarkClaimsValidationLookupStrategy')}"
p:delegatedTrustMarkClaimsValidationLookupStrategy="#{getObject('shibboleth.oidfed.DelegatedTrustMarkClaimsValidationLookupStrategy') ?: getObject('DefaultDelegatedTrustMarkClaimsValidationLookupStrategy')}"
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
@@ -168,7 +168,7 @@
<bean id="ValidateTrustMarks" class="net.shibboleth.oidfed.profile.impl.ValidateTrustMarks"
scope="prototype"
- p:trustMarkStatusCache-ref="#{'%{idp.oidfed.authorize.TrustMarkStatusMetadataCache:shibboleth.oidfed.TrustMarkStatusMetadataCache}'.trim()}">
+ p:trustMarkStatusCache-ref="#{'%{idp.oidfed.op.automaticRegistration.TrustMarkStatusMetadataCache:shibboleth.oidfed.TrustMarkStatusMetadataCache}'.trim()}">
</bean>
<bean id="ValidateAutomaticRegistrationProfileConfiguration"
@@ -180,7 +180,7 @@
</property>
<property name="localMetadataPolicyMergingStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultLocalMetadataPolicyMergingStrategy"
- p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.authorize.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"/>
+ p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.op.automaticRegistration.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"/>
</property>
<property name="mandatoryTrustMarksLookupStrategy">
<bean class="net.shibboleth.oidfed.profile.config.navigate.MandatoryTrustMarksLookupFunction"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
index 87f37fa..c3340fc 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
@@ -358,7 +358,7 @@
<bean id="StoreClientInformation"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.StoreClientInformation" scope="prototype"
- p:clientInformationManager-ref="#{'%{idp.oidfed.expreg.clientInformationManager:shibboleth.oidc.ClientInformationManager}'.trim()}"
+ p:clientInformationManager-ref="#{'%{idp.oidfed.op.explicitRegistration.clientInformationManager:shibboleth.oidc.ClientInformationManager}'.trim()}"
p:replacementCondition-ref="shibboleth.Conditions.TRUE">
<property name="registrationValidityPeriodStrategy">
<bean parent="shibboleth.Functions.Expression"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index cddbee6..93e34e5 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -19,9 +19,11 @@
<bean id="OIDFED.AutomaticRegistration" parent="AbstractOIDFederationProfile" lazy-init="true"
class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationAutomaticRegistrationProfileConfiguration"
- p:mandatoryTrustMarks="%{idp.oidfed.automaticRegistration.mandatoryTrustMarks:}"
- p:defaultClaimsSetDecorationType="%{idp.oidfed.automaticRegistration.defaultClaimsSetDecorationType:}"
- p:providedChainClaimsSetDecorationType="%{idp.oidfed.automaticRegistration.providedClaimsSetDecorationType:store}">
+ p:mandatoryTrustMarks="%{idp.oidfed.op.automaticRegistration.mandatoryTrustMarks:}"
+ p:maximumTrustMarkLifetime="%{idp.oidfed.op.automaticRegistration.maximumTrustMarkLifetime:P365D}"
+ p:remoteTrustMarkValidation="%{idp.oidfed.op.automaticRegistration.remoteTrustMarkValidation:true}"
+ p:defaultClaimsSetDecorationType="%{idp.oidfed.op.automaticRegistration.defaultClaimsSetDecorationType:}"
+ p:providedChainClaimsSetDecorationType="%{idp.oidfed.op.automaticRegistration.providedClaimsSetDecorationType:store}">
<property name="localMetadataPolicyLookupStrategy">
<bean parent="shibboleth.Functions.Constant">
<constructor-arg name="target">
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
index b79520e..c8426fd 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
@@ -5,7 +5,14 @@ idp.oidfed.op.automaticRegistration.activationCondition.par = shibboleth.Conditi
idp.oidfed.op.automaticRegistration.activationCondition.userinfo = shibboleth.Conditions.FALSE
idp.oidfed.op.automaticRegistration.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
idp.oidfed.op.automaticRegistration.trustchain.resolver.fallbackToLocalCondition = shibboleth.Conditions.TRUE
+idp.oidfed.op.automaticRegistration.mandatoryTrustMarks =
+idp.oidfed.op.automaticRegistration.maximumTrustMarkLifetime = P365D
+idp.oidfed.op.automaticRegistration.remoteTrustMarkValidation = true
+idp.oidfed.op.automaticRegistration.defaultClaimsSetDecorationType =
+idp.oidfed.op.automaticRegistration.providedClaimsSetDecorationType = store
+idp.oidfed.op.automaticRegistration.clientInformationManager = shibboleth.oidc.ClientInformationManager
+idp.oidfed.explicitRegistration.mandatoryTrustMarks =
idp.oidfed.op.explicitRegistration.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
idp.oidfed.op.explicitRegistration.trustchain.resolver.fallbackToLocalCondition = shibboleth.Conditions.TRUE
@@ -14,17 +21,12 @@ idp.oidfed.op.metadata.maxRefreshDelay = PT4H
idp.oidfed.op.metadata.values = shibboleth.oidfed.configuration.DefaultDynamicValueResolvers
idp.oidfed.op.metadata.registrationTypesSupported = automatic,explicit
idp.oidfed.op.metadata.resolver = shibboleth.oidfed.DefaultOpenIdConfigurationResolver
-idp.oidfed.autoreg.clientInformationManager = shibboleth.oidc.ClientInformationManager
idp.oidfed.SignedKeysetMetadataCache = shibboleth.oidfed.SignedKeysetMetadataCache
idp.oidfed.cache.explicitRegistration.maxJwtLifetime = PT1M
idp.oidfed.cache.explicitRegistration.critClaims = %{idp.oidfed.cache.default.critClaims:}
idp.oidfed.resolve-entity.authn.flows = OAuth2Client
# relying-party/postconfig.xml
-idp.oidfed.automaticRegistration.mandatoryTrustMarks =
-idp.oidfed.automaticRegistration.defaultClaimsSetDecorationType =
-idp.oidfed.automaticRegistration.providedClaimsSetDecorationType = store
-idp.oidfed.explicitRegistration.mandatoryTrustMarks =
idp.oidfed.resolve-entity.endpointAuthMethods = private_key_jwt
idp.oidfed.resolve-entity.targetedEndpointAsJWTAudience = false
idp.oidfed.resolve-entity.requireSingleJWTAudience = true
@@ -49,7 +51,7 @@ idp.oidfed.register.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetada
idp.oidfed.expreg.defaultScope = openid profile email address phone offline_access
idp.oidfed.expreg.defaultSubjectType = public
idp.oidfed.expreg.validateRemoteJwks = shibboleth.Conditions.TRUE
-idp.oidfed.expreg.clientInformationManager = shibboleth.oidc.ClientInformationManager
+idp.oidfed.op.explicitRegistration.clientInformationManager = shibboleth.oidc.ClientInformationManager
# signed-keyset-beans
idp.service.logging.oidfedconfig = OIDFED.SignedKeyset
@@ -57,16 +59,16 @@ idp.oidfed.op.cache.signedKeyset.minRefreshDelay = PT1S
idp.oidfed.op.cache.signedKeyset.maxRefreshDelay = PT30S
# metadata-lookup-ext-oidfed-beans
-idp.oidfed.autoregister.TrustChainMetadataPolicyMergingStrategy = DefaultTrustChainMetadataPolicyMergingStrategy
-idp.oidfed.autoregister.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
-idp.oidfed.autoregister.ProvidedTrustChainMetadataCache = DefaultAutoRegisterFetchThroughProvidedTrustChainMetadataCache
-idp.oidfed.cache.providedTrustChain.customFilterStrategies =
-idp.oidfed.authorize.MetadataPolicyOperatorsy = shibboleth.oidfed.StandardMetadataPolicyOperators
-idp.oidfed.authorize.MetadataPolicMergingyStrategy = MetadataPolicMergingyStrategy
-idp.oidfed.authorize.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
-idp.oidfed.authorize.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
-idp.oidfed.authorize.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
-idp.oidfed.authorize.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
+idp.oidfed.op.automaticRegistration.TrustChainMetadataPolicyMergingStrategy = DefaultTrustChainMetadataPolicyMergingStrategy
+idp.oidfed.op.automaticRegistration.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
+idp.oidfed.op.automaticRegistration.ProvidedTrustChainMetadataCache = DefaultAutoRegisterFetchThroughProvidedTrustChainMetadataCache
+idp.oidfed.op.automaticRegistration.cache.providedTrustChain.customFilterStrategies =
+idp.oidfed.op.automaticRegistration.MetadataPolicyOperators = shibboleth.oidfed.StandardMetadataPolicyOperators
+idp.oidfed.op.automaticRegistration.MetadataPolicyMergingStrategy = MetadataPolicyMergingStrategy
+idp.oidfed.op.automaticRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
+idp.oidfed.op.automaticRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
+idp.oidfed.op.automaticRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
+idp.oidfed.op.automaticRegistration.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
# resolve-entity-beans, TODO: move these to oidfed-common once the feature is moved there
#idp.service.logging.oidfedresolve = OIDFED.ResolveEntity
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list