[java-idp-plugin-oidc-op-oidfed] branch main updated: Harmonise the automatic and explicit registration configuration
Codeberg
noreply at shibboleth.net
Wed Sep 9 17:03:33 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/8ba9d7b0c02ef1c0601574aea7a1e4c1c9e4d4e6
The following commit(s) were added to refs/heads/main by this push:
new 8ba9d7b Harmonise the automatic and explicit registration configuration
8ba9d7b is described below
commit 8ba9d7b0c02ef1c0601574aea7a1e4c1c9e4d4e6
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Sep 9 20:03:11 2026 +0300
Harmonise the automatic and explicit registration configuration
- Adapt into current trust-chain-resolver bean naming of java-oidfed-common
- register and metadata-lookup-ext flow beans
- Default claims set decoration type to 'token' instead of empty/null
- Automatic registration properties prefix is 'idp.oidfed.op.automaticRegistration'
- Explicit registration properties prefix is 'idp.oidfed.op.explicitRegistration'
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 15 +++--
.../oidfed/metadata-lookup-ext-oidfed-beans.xml | 18 +++---
.../idp/flows/oidfed/register/register-beans.xml | 43 +++++++------
.../idp/service/relying-party/postconfig.xml | 4 +-
.../op/oidfed/conf/oidfed/oidfed-op.properties | 72 +++++++++++-----------
5 files changed, 76 insertions(+), 76 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 267276a..3f1d26f 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -133,7 +133,7 @@
</bean>
<util:map id="DefaultAutoRegisteredTokenClaimsSetDecorators" value-type="java.util.List">
- <entry key="#{null}">
+ <entry key="token">
<util:list>
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainIDsClaimsSetDecorator"/>
</util:list>
@@ -149,20 +149,19 @@
<bean id="AutoRegisteredTrustChainAuthorizationCodeClaimsSetDecorator"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainAuthorizationCodeClaimsSetDecorator"
- p:claimsSetDecorators-ref="DefaultAutoRegisteredTokenClaimsSetDecorators"/>
+ p:claimsSetDecorators-ref="%{idp.oidfed.op.automaticRegistration.AutoRegisteredTokenClaimsSetDecorators:DefaultAutoRegisteredTokenClaimsSetDecorators}"/>
<bean id="AutoRegisteredTrustChainAccessTokenClaimsSetDecorator"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainAccessTokenClaimsSetDecorator"
- p:claimsSetDecorators-ref="DefaultAutoRegisteredTokenClaimsSetDecorators"/>
+ p:claimsSetDecorators-ref="%{idp.oidfed.op.automaticRegistration.AutoRegisteredTokenClaimsSetDecorators:DefaultAutoRegisteredTokenClaimsSetDecorators}"/>
<bean id="AutoRegisteredTrustChainRefreshTokenClaimsSetDecorator"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainRefreshTokenClaimsSetDecorator"
- p:claimsSetDecorators-ref="DefaultAutoRegisteredTokenClaimsSetDecorators"/>
-
+ p:claimsSetDecorators-ref="%{idp.oidfed.op.automaticRegistration.AutoRegisteredTokenClaimsSetDecorators:DefaultAutoRegisteredTokenClaimsSetDecorators}"/>
<bean id="AutoRegisteredTrustChainRequestUriClaimsSetDecorator"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.AutoRegisteredTrustChainRequestUriClaimsSetDecorator"
- p:claimsSetDecorators-ref="DefaultAutoRegisteredTokenClaimsSetDecorators"/>
+ p:claimsSetDecorators-ref="%{idp.oidfed.op.automaticRegistration.AutoRegisteredTokenClaimsSetDecorators:DefaultAutoRegisteredTokenClaimsSetDecorators}"/>
<bean id="ClientInformationSignedKeysetJWKSetDecorator"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.ClientInformationSignedKeysetJWKSetDecorator"
@@ -365,10 +364,10 @@
</property>
</bean>
- <alias alias="shibboleth.oidfed.UseResolverApiCondition"
+ <alias alias="shibboleth.oidfed.trust-chain-resolver.UseResolverApiCondition"
name="%{idp.oidfed.op.automaticRegistration.trustchain.resolver.useResolverApiCondition:shibboleth.Conditions.FALSE}" />
- <alias alias="shibboleth.oidfed.FallbackToLocalResolutionCondition"
+ <alias alias="shibboleth.oidfed.trust-chain-resolver.FallbackToLocalResolutionCondition"
name="%{idp.oidfed.op.automaticRegistration.trustchain.resolver.fallbackToLocalCondition:shibboleth.Conditions.TRUE}" />
<bean id="shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
index 0daf0a4..37ee0f3 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
@@ -24,11 +24,11 @@
<bean id="ValidateProvidedTrustChain" class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.ValidateProvidedTrustChain"
scope="prototype"
- p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.op.automaticRegistration.TrustChainMetadataPolicyMergingStrategy:DefaultTrustChainMetadataPolicyMergingStrategy}'.trim()}"
- p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.op.automaticRegistration.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"
- p:arraysAsSpaceSeparatedList="%{idp.oidfed.policy.arraysAsSpaceSeparatedList:scope}"
- p:metadataValidationCondition-ref="#{'%{idp.oidfed.MetadataValidationCondition:DefaultMetadataValidationCondition}'.trim()}"
- p:federationPolicyConstraints-ref="%{idp.oidfed.FederationPolicyConstraints:shibboleth.oidfed.DefaultFederationPolicyConstraints}"
+ p:metadataPolicyMergingStrategy="#{getObject('shibboleth.oidfed.trust-chain-resolver.TrustChainMetadataPolicyMergingStrategy') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultTrustChainMetadataPolicyMergingStrategy')}"
+ p:metadataPolicyEnforcer="#{getObject('shibboleth.oidfed.trust-chain-resolver.MetadataPolicyEnforcer') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultMetadataPolicyEnforcer')}"
+ p:arraysAsSpaceSeparatedList="#{getObject('shibboleth.oidfed.trust-chain-resolver.ArrayAsSpaceSeparatedList') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultArrayAsSpaceSeparatedList')}"
+ p:metadataValidationCondition="#{getObject('shibboleth.oidfed.trust-chain-resolver.MetadataValidationCondition') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultMetadataValidationCondition')}"
+ p:federationPolicyConstraints-ref="%{idp.oidfed.automaticRegistration.FederationPolicyConstraints:shibboleth.oidfed.DefaultFederationPolicyConstraints}"
p:providedTrustChainResolver="#{getObject('shibboleth.oidfed.ProvidedTrustChainResolver') ?: getObject('shibboleth.oidfed.DefaultProvidedTrustChainResolver')}"
p:mandatoryProvidedTrustChainCondition-ref="shibboleth.Conditions.FALSE"
p:ignoreProvidedTrustChainCondition-ref="shibboleth.Conditions.FALSE"
@@ -94,12 +94,12 @@
<bean id="TrustChainCandidatesExist" parent="shibboleth.Conditions.Expression"
c:expression="#input.ensureInboundMessageContext().containsSubcontext(T(net.shibboleth.oidfed.profile.context.RelyingPartyTrustChainContext)) and #input.ensureInboundMessageContext().ensureSubcontext(T(net.shibboleth.oidfed.profile.context.RelyingPartyTrustChainContext)).getPolicyCompliantTrustChains() != null and #input.ensureInboundMessageContext().ensureSubcontext(T(net.shibboleth.oidfed.profile.context.RelyingPartyTrustChainContext)).getPolicyCompliantTrustChains().size() > 0"/>
- <bean id="DefaultMetadataPolicyEnforcer"
+ <bean id="shibboleth.oidfed.trust-chain-resolver.MetadataPolicyEnforcer"
class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
p:metadataPolicyOperators-ref="#{'%{idp.oidfed.op.automaticRegistration.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
- <bean id="DefaultTrustChainMetadataPolicyMergingStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustChainMetadataPolicyMergingStrategy"
+ <bean id="shibboleth.oidfed.trust-chain-resolver.TrustChainMetadataPolicyMergingStrategy"
+ class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainMetadataPolicyMergingStrategy"
p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.op.automaticRegistration.MetadataPolicyMergingStrategy:MetadataPolicyMergingStrategy}'.trim()}"
p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.op.automaticRegistration.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
@@ -180,7 +180,7 @@
</property>
<property name="localMetadataPolicyMergingStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultLocalMetadataPolicyMergingStrategy"
- p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.op.automaticRegistration.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"/>
+ p:metadataPolicyEnforcer="#{getObject('shibboleth.oidfed.trust-chain-resolver.MetadataPolicyEnforcer') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultMetadataPolicyEnforcer')}"/>
</property>
<property name="mandatoryTrustMarksLookupStrategy">
<bean class="net.shibboleth.oidfed.profile.config.navigate.MandatoryTrustMarksLookupFunction"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
index c3340fc..75c52d4 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
@@ -16,12 +16,15 @@
<bean id="shibboleth.oidc.loggingId" class="java.lang.String"
c:_0="%{idp.service.logging.oidfeddynreg:OIDFED.Registration}" />
- <alias alias="shibboleth.oidfed.UseResolverApiCondition"
+ <alias alias="shibboleth.oidfed.trust-chain-resolver.UseResolverApiCondition"
name="%{idp.oidfed.op.explicitRegistration.trustchain.resolver.useResolverApiCondition:shibboleth.Conditions.FALSE}" />
- <alias alias="shibboleth.oidfed.FallbackToLocalResolutionCondition"
+ <alias alias="shibboleth.oidfed.trust-chain-resolver.FallbackToLocalResolutionCondition"
name="%{idp.oidfed.op.explicitRegistration.trustchain.resolver.fallbackToLocalCondition:shibboleth.Conditions.TRUE}" />
+ <alias alias="shibboleth.oidfed.trust-chain-resolver.MetadataValidationCondition"
+ name="%{idp.oidfed.op.explicitRegistration.MetadataValidationCondition:shibboleth.oidfed.trust-chain-resolver.DefaultMetadataValidationCondition}" />
+
<bean id="shibboleth.ClientIDLookupStrategy"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.ExplicitClientRegistrationRequestClientIDLookupFunction" />
@@ -45,17 +48,17 @@
<bean id="ValidateProvidedTrustChain" class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.ValidateProvidedTrustChain"
scope="prototype"
- p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.register.TrustChainMetadataPolicyMergingStrategy:DefaultTrustChainMetadataPolicyMergingStrategy}'.trim()}"
- p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.register.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"
- p:arraysAsSpaceSeparatedList="%{idp.oidfed.policy.arraysAsSpaceSeparatedList:scope}"
+ p:metadataPolicyMergingStrategy="#{getObject('shibboleth.oidfed.trust-chain-resolver.TrustChainMetadataPolicyMergingStrategy') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultTrustChainMetadataPolicyMergingStrategy')}"
+ p:metadataPolicyEnforcer="#{getObject('shibboleth.oidfed.trust-chain-resolver.MetadataPolicyEnforcer') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultMetadataPolicyEnforcer')}"
+ p:arraysAsSpaceSeparatedList="#{getObject('shibboleth.oidfed.trust-chain-resolver.ArrayAsSpaceSeparatedList') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultArrayAsSpaceSeparatedList')}"
p:metadataLookupStrategy-ref="DefaultCombinedMetadataFromTrustChainLookupStrategy"
- p:metadataValidationCondition-ref="#{'%{idp.oidfed.MetadataValidationCondition:DefaultMetadataValidationCondition}'.trim()}"
- p:federationPolicyConstraints-ref="%{idp.oidfed.FederationPolicyConstraints:shibboleth.oidfed.DefaultFederationPolicyConstraints}"
+ p:metadataValidationCondition-ref="shibboleth.oidfed.trust-chain-resolver.MetadataValidationCondition"
+ p:federationPolicyConstraints-ref="%{idp.oidfed.op.explicitRegistration.FederationPolicyConstraints:shibboleth.oidfed.DefaultFederationPolicyConstraints}"
p:mandatoryProvidedTrustChainCondition-ref="shibboleth.Conditions.TRUE"
p:ignoreProvidedTrustChainCondition-ref="shibboleth.Conditions.FALSE">
<property name="providedTrustChainValidationStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.logic.DefaultProvidedTrustChainValidationStrategy"
- p:metadataCache-ref="#{'%{idp.oidfed.register.ProvidedTrustChainMetadataCache:DefaultFetchThroughProvidedTrustChainMetadataCache}'.trim()}" />
+ p:metadataCache-ref="#{'%{idp.oidfed.op.explicitRegistration.ProvidedTrustChainMetadataCache:DefaultFetchThroughProvidedTrustChainMetadataCache}'.trim()}" />
</property>
<property name="providedTrustChainResolver">
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.ExplicitClientRegistrationRequestTrustChainResolver" />
@@ -81,7 +84,7 @@
</property>
<property name="metadataFilterStrategy">
<bean class="net.shibboleth.oidfed.metadata.cache.trustchain.DefaultTrustChainSignatureValidationFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.explicitRegistration.trustChain.customFilterStrategies:}'.trim())}">
+ p:customFilterStrategies="#{getObject('%{idp.oidfed.op.explicitRegistration.cache.trustChain.customFilterStrategies:}'.trim())}">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
@@ -116,7 +119,7 @@
p:providedEntityConfigurationLookupStrategy-ref="shibboleth.oidfed.trust-chain-resolver.EntityConfigurationLookupStrategy">
<property name="providedEntityConfigurationValidationStrategy">
<bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.logic.DefaultProvidedEntityConfigurationValidationStrategy"
- p:metadataCache-ref="#{'%{idp.oidfed.register.ProvidedEntityConfigurationMetadataCache:FetchThroughProvidedEntityConfigurationMetadataCache}'.trim()}" />
+ p:metadataCache-ref="#{'%{idp.oidfed.op.explicitRegistration.ProvidedEntityConfigurationMetadataCache:FetchThroughProvidedEntityConfigurationMetadataCache}'.trim()}" />
</property>
</bean>
@@ -139,7 +142,7 @@
</property>
<property name="metadataFilterStrategy">
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.explicitRegistration.entityConfiguration.customFilterStrategies:}'.trim())}">
+ p:customFilterStrategies="#{getObject('%{idp.oidfed.op.explicitRegistration.cache.entityConfiguration.customFilterStrategies:}'.trim())}">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
@@ -149,7 +152,7 @@
</property>
</bean>
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
- p:claimsValidator-ref="%{idp.oidfed.cache.explicitRegistrationRequest.claimsValidator:shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator}"
+ p:claimsValidator-ref="%{idp.oidfed.op.explicitRegistration.cache.explicitRegistrationRequest.claimsValidator:shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
<property name="headerValidator">
<bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
@@ -210,12 +213,12 @@
<bean id="DefaultMetadataPolicyEnforcer"
class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
- p:metadataPolicyOperators-ref="#{'%{idp.oidfed.register.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
+ p:metadataPolicyOperators-ref="#{'%{idp.oidfed.op.explicitRegistration.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
- <bean id="DefaultTrustChainMetadataPolicyMergingStrategy"
+ <bean id="shibboleth.oidfed.trust-chain-resolver.TrustChainMetadataPolicyMergingStrategy"
class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainMetadataPolicyMergingStrategy"
- p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.register.MetadataPolicMergingyStrategy:MetadataPolicMergingyStrategy}'.trim()}"
- p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.register.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
+ p:metadataPolicyMergingStrategy-ref="#{'%{idp.oidfed.op.explicitRegistration.MetadataPolicyMergingStrategy:MetadataPolicMergingyStrategy}'.trim()}"
+ p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.op.explicitRegistration.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
<bean id="MetadataPolicMergingyStrategy"
class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
@@ -247,7 +250,7 @@
<bean id="ResolveTrustMarks" class="net.shibboleth.oidfed.profile.impl.ResolveTrustMarks"
scope="prototype"
- p:trustChainCache-ref="#{'%{idp.oidfed.register.TrustChainMetadataCache:shibboleth.oidfed.TrustChainMetadataCache}'.trim()}"
+ p:trustChainCache-ref="#{'%{idp.oidfed.op.explicitRegistration.TrustChainMetadataCache:shibboleth.oidfed.TrustChainMetadataCache}'.trim()}"
p:trustMarkClaimsValidationLookupStrategy="#{getObject('shibboleth.oidfed.TrustMarkClaimsValidationLookupStrategy') ?: getObject('DefaultTrustMarkClaimsValidationLookupStrategy')}"
p:delegatedTrustMarkClaimsValidationLookupStrategy="#{getObject('shibboleth.oidfed.DelegatedTrustMarkClaimsValidationLookupStrategy') ?: getObject('DefaultDelegatedTrustMarkClaimsValidationLookupStrategy')}"
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
@@ -338,14 +341,14 @@
<bean id="shibboleth.oidc.DefaultScope"
class="com.nimbusds.oauth2.sdk.Scope" factory-method="parse">
<constructor-arg type="java.lang.String"
- value="#{'%{idp.oidfed.expreg.defaultScope:openid profile email address phone offline_access}'.trim()}" />
+ value="#{'%{idp.oidfed.op.explicitRegistration.defaultScope:openid profile email address phone offline_access}'.trim()}" />
</bean>
<bean id="shibboleth.oidc.DefaultSubjectType"
class="com.nimbusds.openid.connect.sdk.SubjectType"
factory-method="parse">
<constructor-arg type="java.lang.String"
- value="#{'%{idp.oidfed.expreg.defaultSubjectType:public}'.trim()}" />
+ value="#{'%{idp.oidfed.op.explicitRegistration.defaultSubjectType:public}'.trim()}" />
</bean>
<bean id="AddJwksToClientMetadata"
@@ -354,7 +357,7 @@
p:httpClient="#{getObject('shibboleth.oidc.NonBrowser.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
p:httpClientSecurityParameters="#{getObject('shibboleth.oidc.NonBrowser.HttpClientSecurityParameters')}"
p:oidcInputMetadataLookupStrategy-ref="shibboleth.oidc.InputMetadataLookupStrategy"
- p:validateRemoteJwkSetPredicate-ref="%{idp.oidfed.expreg.validateRemoteJwks:shibboleth.Conditions.TRUE}"/>
+ p:validateRemoteJwkSetPredicate-ref="%{idp.oidfed.op.explicitRegistration.validateRemoteJwks:shibboleth.Conditions.TRUE}"/>
<bean id="StoreClientInformation"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.StoreClientInformation" scope="prototype"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 93e34e5..ac95938 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -22,7 +22,7 @@
p:mandatoryTrustMarks="%{idp.oidfed.op.automaticRegistration.mandatoryTrustMarks:}"
p:maximumTrustMarkLifetime="%{idp.oidfed.op.automaticRegistration.maximumTrustMarkLifetime:P365D}"
p:remoteTrustMarkValidation="%{idp.oidfed.op.automaticRegistration.remoteTrustMarkValidation:true}"
- p:defaultClaimsSetDecorationType="%{idp.oidfed.op.automaticRegistration.defaultClaimsSetDecorationType:}"
+ p:defaultClaimsSetDecorationType="%{idp.oidfed.op.automaticRegistration.defaultClaimsSetDecorationType:token}"
p:providedChainClaimsSetDecorationType="%{idp.oidfed.op.automaticRegistration.providedClaimsSetDecorationType:store}">
<property name="localMetadataPolicyLookupStrategy">
<bean parent="shibboleth.Functions.Constant">
@@ -43,7 +43,7 @@
<bean id="OIDFED.ExplicitRegistration" parent="AbstractOIDFederationProfile" lazy-init="true"
class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationExplicitRegistrationProfileConfiguration"
p:issuer-ref="shibboleth.oidc.issuer"
- p:mandatoryTrustMarks="%{idp.oidfed.explicitRegistration.mandatoryTrustMarks:}" />
+ p:mandatoryTrustMarks="%{idp.oidfed.op.explicitRegistration.mandatoryTrustMarks:}" />
<bean id="OIDFED.ResolveEntity" parent="AbstractOIDFederationProfile" lazy-init="true"
class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationResolveEntityProfileConfiguration"
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
index c8426fd..c6afbf8 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
@@ -8,11 +8,22 @@ idp.oidfed.op.automaticRegistration.trustchain.resolver.fallbackToLocalCondition
idp.oidfed.op.automaticRegistration.mandatoryTrustMarks =
idp.oidfed.op.automaticRegistration.maximumTrustMarkLifetime = P365D
idp.oidfed.op.automaticRegistration.remoteTrustMarkValidation = true
-idp.oidfed.op.automaticRegistration.defaultClaimsSetDecorationType =
+idp.oidfed.op.automaticRegistration.defaultClaimsSetDecorationType = token
idp.oidfed.op.automaticRegistration.providedClaimsSetDecorationType = store
idp.oidfed.op.automaticRegistration.clientInformationManager = shibboleth.oidc.ClientInformationManager
+idp.oidfed.op.automaticRegistration.FederationPolicyConstraints = shibboleth.oidfed.DefaultFederationPolicyConstraints
+idp.oidfed.op.automaticRegistration.AutoRegisteredTokenClaimsSetDecorators =
-idp.oidfed.explicitRegistration.mandatoryTrustMarks =
+# metadata-lookup-ext-oidfed-beans
+idp.oidfed.op.automaticRegistration.ProvidedTrustChainMetadataCache = DefaultAutoRegisterFetchThroughProvidedTrustChainMetadataCache
+idp.oidfed.op.automaticRegistration.cache.providedTrustChain.customFilterStrategies =
+idp.oidfed.op.automaticRegistration.MetadataPolicyOperators = shibboleth.oidfed.StandardMetadataPolicyOperators
+idp.oidfed.op.automaticRegistration.MetadataPolicyMergingStrategy = MetadataPolicyMergingStrategy
+idp.oidfed.op.automaticRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
+idp.oidfed.op.automaticRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
+idp.oidfed.op.automaticRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
+
+idp.oidfed.op.explicitRegistration.mandatoryTrustMarks =
idp.oidfed.op.explicitRegistration.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
idp.oidfed.op.explicitRegistration.trustchain.resolver.fallbackToLocalCondition = shibboleth.Conditions.TRUE
@@ -24,53 +35,35 @@ idp.oidfed.op.metadata.resolver = shibboleth.oidfed.DefaultOpenIdConfigurationRe
idp.oidfed.SignedKeysetMetadataCache = shibboleth.oidfed.SignedKeysetMetadataCache
idp.oidfed.cache.explicitRegistration.maxJwtLifetime = PT1M
idp.oidfed.cache.explicitRegistration.critClaims = %{idp.oidfed.cache.default.critClaims:}
-idp.oidfed.resolve-entity.authn.flows = OAuth2Client
-
-# relying-party/postconfig.xml
-idp.oidfed.resolve-entity.endpointAuthMethods = private_key_jwt
-idp.oidfed.resolve-entity.targetedEndpointAsJWTAudience = false
-idp.oidfed.resolve-entity.requireSingleJWTAudience = true
# register-beans
idp.service.logging.oidfeddynreg = OIDFED.Registration
idp.oidc.requestParser.FederationRegisterRequest =
-idp.oidfed.register.TrustChainMetadataPolicyMergingStrategy = DefaultTrustChainMetadataPolicyMergingStrategy
-idp.oidfed.register.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
-idp.oidfed.policy.arraysAsSpaceSeparatedList = scope
-idp.oidfed.MetadataValidationCondition = DefaultMetadataValidationCondition
-idp.oidfed.FederationPolicyConstraints = shibboleth.oidfed.DefaultFederationPolicyConstraints
-idp.oidfed.register.ProvidedTrustChainMetadataCache = DefaultFetchThroughProvidedTrustChainMetadataCache
-idp.oidfed.cache.explicitRegistration.trustChain.customFilterStrategies =
-idp.oidfed.register.ProvidedEntityConfigurationMetadataCache = FetchThroughProvidedEntityConfigurationMetadataCache
-idp.oidfed.cache.explicitRegistration.entityConfiguration.customFilterStrategies =
-idp.oidfed.cache.explicitRegistrationRequest.claimsValidator = shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator
-idp.oidfed.register.MetadataPolicyOperatorsy = shibboleth.oidfed.StandardMetadataPolicyOperators
-idp.oidfed.register.MetadataPolicMergingyStrategy = MetadataPolicMergingyStrategy
-idp.oidfed.register.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
-idp.oidfed.register.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
-idp.oidfed.expreg.defaultScope = openid profile email address phone offline_access
-idp.oidfed.expreg.defaultSubjectType = public
-idp.oidfed.expreg.validateRemoteJwks = shibboleth.Conditions.TRUE
+idp.oidfed.op.explicitRegistration.MetadataValidationCondition = DefaultMetadataValidationCondition
+idp.oidfed.op.explicitRegistration.ProvidedTrustChainMetadataCache = DefaultFetchThroughProvidedTrustChainMetadataCache
+idp.oidfed.op.explicitRegistration.cache.trustChain.customFilterStrategies =
+idp.oidfed.op.explicitRegistration.ProvidedEntityConfigurationMetadataCache = FetchThroughProvidedEntityConfigurationMetadataCache
+idp.oidfed.op.explicitRegistration.cache.entityConfiguration.customFilterStrategies =
+idp.oidfed.op.explicitRegistration.cache.explicitRegistrationRequest.claimsValidator = shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator
+idp.oidfed.op.explicitRegistration.MetadataPolicyOperators = shibboleth.oidfed.StandardMetadataPolicyOperators
+idp.oidfed.op.explicitRegistration.MetadataPolicyMergingStrategy = MetadataPolicMergingyStrategy
+idp.oidfed.op.explicitRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
+idp.oidfed.op.explicitRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
+idp.oidfed.op.explicitRegistration.defaultScope = openid profile email address phone offline_access
+idp.oidfed.op.explicitRegistration.defaultSubjectType = public
+idp.oidfed.op.explicitRegistration.validateRemoteJwks = shibboleth.Conditions.TRUE
idp.oidfed.op.explicitRegistration.clientInformationManager = shibboleth.oidc.ClientInformationManager
+idp.oidfed.op.explicitRegistration.FederationPolicyConstraints = shibboleth.oidfed.DefaultFederationPolicyConstraints
# signed-keyset-beans
idp.service.logging.oidfedconfig = OIDFED.SignedKeyset
idp.oidfed.op.cache.signedKeyset.minRefreshDelay = PT1S
idp.oidfed.op.cache.signedKeyset.maxRefreshDelay = PT30S
-# metadata-lookup-ext-oidfed-beans
-idp.oidfed.op.automaticRegistration.TrustChainMetadataPolicyMergingStrategy = DefaultTrustChainMetadataPolicyMergingStrategy
-idp.oidfed.op.automaticRegistration.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
-idp.oidfed.op.automaticRegistration.ProvidedTrustChainMetadataCache = DefaultAutoRegisterFetchThroughProvidedTrustChainMetadataCache
-idp.oidfed.op.automaticRegistration.cache.providedTrustChain.customFilterStrategies =
-idp.oidfed.op.automaticRegistration.MetadataPolicyOperators = shibboleth.oidfed.StandardMetadataPolicyOperators
-idp.oidfed.op.automaticRegistration.MetadataPolicyMergingStrategy = MetadataPolicyMergingStrategy
-idp.oidfed.op.automaticRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
-idp.oidfed.op.automaticRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
-idp.oidfed.op.automaticRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
-idp.oidfed.op.automaticRegistration.MetadataPolicyEnforcer = DefaultMetadataPolicyEnforcer
-
# resolve-entity-beans, TODO: move these to oidfed-common once the feature is moved there
+#idp.oidfed.resolve-entity.authn.flows = OAuth2Client
+
+
#idp.service.logging.oidfedresolve = OIDFED.ResolveEntity
#idp.oidfed.requestParser.ResolveEntityRequest =
#idp.oidfed.cache.resolveEntity.minRefreshDelay = PT1S
@@ -83,3 +76,8 @@ idp.oidfed.op.automaticRegistration.MetadataPolicyEnforcer = DefaultMetadataPoli
#idp.oidfed.resolve-entity.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
#idp.oidfed.entity.sigalg = RS256
#idp.oidfed.resolve-entity.automaticRegistrationCondition = shibboleth.Conditions.TRUE
+
+# relying-party/postconfig.xml
+#idp.oidfed.resolve-entity.endpointAuthMethods = private_key_jwt
+#idp.oidfed.resolve-entity.targetedEndpointAsJWTAudience = false
+#idp.oidfed.resolve-entity.requireSingleJWTAudience = true
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list