[java-idp-plugin-oidc-op-oidfed] branch main updated: Harmonise explicit registration property and bean naming.
Codeberg
noreply at shibboleth.net
Tue Sep 15 11:01:54 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/6830b84e29884b6f47ef11fd83cfc257b685704e
The following commit(s) were added to refs/heads/main by this push:
new 6830b84 Harmonise explicit registration property and bean naming.
6830b84 is described below
commit 6830b84e29884b6f47ef11fd83cfc257b685704e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Sep 15 14:01:25 2026 +0300
Harmonise explicit registration property and bean naming.
---
.../idp/flows/oidfed/register/register-beans.xml | 16 +++++++++++-----
.../idp/flows/oidfed/register/register-flow.xml | 1 +
.../shibboleth/idp/service/relying-party/postconfig.xml | 5 ++++-
.../oidc/op/oidfed/conf/oidfed/oidfed-op.properties | 5 +++--
4 files changed, 19 insertions(+), 8 deletions(-)
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
index 75c52d4..976bcbc 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
@@ -22,9 +22,6 @@
<alias alias="shibboleth.oidfed.trust-chain-resolver.FallbackToLocalResolutionCondition"
name="%{idp.oidfed.op.explicitRegistration.trustchain.resolver.fallbackToLocalCondition:shibboleth.Conditions.TRUE}" />
- <alias alias="shibboleth.oidfed.trust-chain-resolver.MetadataValidationCondition"
- name="%{idp.oidfed.op.explicitRegistration.MetadataValidationCondition:shibboleth.oidfed.trust-chain-resolver.DefaultMetadataValidationCondition}" />
-
<bean id="shibboleth.ClientIDLookupStrategy"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.ExplicitClientRegistrationRequestClientIDLookupFunction" />
@@ -52,7 +49,7 @@
p:metadataPolicyEnforcer="#{getObject('shibboleth.oidfed.trust-chain-resolver.MetadataPolicyEnforcer') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultMetadataPolicyEnforcer')}"
p:arraysAsSpaceSeparatedList="#{getObject('shibboleth.oidfed.trust-chain-resolver.ArrayAsSpaceSeparatedList') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultArrayAsSpaceSeparatedList')}"
p:metadataLookupStrategy-ref="DefaultCombinedMetadataFromTrustChainLookupStrategy"
- p:metadataValidationCondition-ref="shibboleth.oidfed.trust-chain-resolver.MetadataValidationCondition"
+ p:metadataValidationCondition="#{getObject('shibboleth.oidfed.trust-chain-resolver.MetadataValidationCondition') ?: getObject('shibboleth.oidfed.trust-chain-resolver.DefaultMetadataValidationCondition')}"
p:federationPolicyConstraints-ref="%{idp.oidfed.op.explicitRegistration.FederationPolicyConstraints:shibboleth.oidfed.DefaultFederationPolicyConstraints}"
p:mandatoryProvidedTrustChainCondition-ref="shibboleth.Conditions.TRUE"
p:ignoreProvidedTrustChainCondition-ref="shibboleth.Conditions.FALSE">
@@ -271,6 +268,11 @@
</property>
</bean>
+ <bean id="ValidateTrustMarks" class="net.shibboleth.oidfed.profile.impl.ValidateTrustMarks"
+ scope="prototype"
+ p:trustMarkStatusCache-ref="#{'%{idp.oidfed.op.explicitRegistration.TrustMarkStatusMetadataCache:shibboleth.oidfed.TrustMarkStatusMetadataCache}'.trim()}">
+ </bean>
+
<bean id="RelyingPartyTrustChainContextLookupStrategy" parent="shibboleth.Functions.Expression"
c:expression="#input.ensureInboundMessageContext().getSubcontext(T(net.shibboleth.oidfed.profile.context.RelyingPartyTrustChainContext))" />
@@ -361,7 +363,7 @@
<bean id="StoreClientInformation"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.StoreClientInformation" scope="prototype"
- p:clientInformationManager-ref="#{'%{idp.oidfed.op.explicitRegistration.clientInformationManager:shibboleth.oidc.ClientInformationManager}'.trim()}"
+ p:clientInformationManager-ref="#{'%{idp.oidfed.op.explicitRegistration.clientInformationManager:shibboleth.oidfed.ClientInformationManager}'.trim()}"
p:replacementCondition-ref="shibboleth.Conditions.TRUE">
<property name="registrationValidityPeriodStrategy">
<bean parent="shibboleth.Functions.Expression"
@@ -369,6 +371,10 @@
</property>
</bean>
+ <bean id="shibboleth.oidfed.ClientInformationManager"
+ class="net.shibboleth.oidc.metadata.impl.StorageServiceClientInformationManager" scope="prototype"
+ p:storageService-ref="#{'%{idp.oidfed.op.explicitRegistration.StorageService:shibboleth.StorageService}'.trim()}" />
+
<bean id="BuildErrorResponseFromEvent"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.BuildRegistrationErrorResponseFromEvent"
scope="prototype"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-flow.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-flow.xml
index 568fd0e..68b28f7 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-flow.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-flow.xml
@@ -38,6 +38,7 @@
<evaluate expression="ResolveTrustMarks" />
<evaluate expression="SelectExplicitRegistrationRelyingPartyConfiguration" />
<evaluate expression="SelectExplicitRegistrationProfileConfiguration" />
+ <evaluate expression="ValidateTrustMarks" />
<evaluate expression="ValidateExplicitRegistrationProfileConfiguration" />
<evaluate expression="PopulateInboundInterceptContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index ac95938..80ad2a6 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -43,7 +43,10 @@
<bean id="OIDFED.ExplicitRegistration" parent="AbstractOIDFederationProfile" lazy-init="true"
class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationExplicitRegistrationProfileConfiguration"
p:issuer-ref="shibboleth.oidc.issuer"
- p:mandatoryTrustMarks="%{idp.oidfed.op.explicitRegistration.mandatoryTrustMarks:}" />
+ p:mandatoryTrustMarks="%{idp.oidfed.op.explicitRegistration.mandatoryTrustMarks:}"
+ p:maximumTrustMarkLifetime="%{idp.oidfed.op.explicitRegistration.maximumTrustMarkLifetime:P365D}"
+ p:remoteTrustMarkValidation="%{idp.oidfed.op.explicitRegistration.remoteTrustMarkValidation:true}"
+ p:tokenEndpointAuthMethods="%{idp.oidfed.op.explicitRegistration.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}"/>
<bean id="OIDFED.ResolveEntity" parent="AbstractOIDFederationProfile" lazy-init="true"
class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationResolveEntityProfileConfiguration"
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
index c6afbf8..1d60480 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
@@ -26,7 +26,7 @@ idp.oidfed.op.automaticRegistration.TrustMarkStatusMetadataCache = shibboleth.oi
idp.oidfed.op.explicitRegistration.mandatoryTrustMarks =
idp.oidfed.op.explicitRegistration.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
idp.oidfed.op.explicitRegistration.trustchain.resolver.fallbackToLocalCondition = shibboleth.Conditions.TRUE
-
+idp.oidfed.op.explicitRegistration.tokenEndpointAuthMethods = client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt
idp.oidfed.op.metadata.minRefreshDelay = PT5M
idp.oidfed.op.metadata.maxRefreshDelay = PT4H
idp.oidfed.op.metadata.values = shibboleth.oidfed.configuration.DefaultDynamicValueResolvers
@@ -39,7 +39,6 @@ idp.oidfed.cache.explicitRegistration.critClaims = %{idp.oidfed.cache.default.cr
# register-beans
idp.service.logging.oidfeddynreg = OIDFED.Registration
idp.oidc.requestParser.FederationRegisterRequest =
-idp.oidfed.op.explicitRegistration.MetadataValidationCondition = DefaultMetadataValidationCondition
idp.oidfed.op.explicitRegistration.ProvidedTrustChainMetadataCache = DefaultFetchThroughProvidedTrustChainMetadataCache
idp.oidfed.op.explicitRegistration.cache.trustChain.customFilterStrategies =
idp.oidfed.op.explicitRegistration.ProvidedEntityConfigurationMetadataCache = FetchThroughProvidedEntityConfigurationMetadataCache
@@ -49,10 +48,12 @@ idp.oidfed.op.explicitRegistration.MetadataPolicyOperators = shibboleth.oidfed.S
idp.oidfed.op.explicitRegistration.MetadataPolicyMergingStrategy = MetadataPolicMergingyStrategy
idp.oidfed.op.explicitRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
idp.oidfed.op.explicitRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
+idp.oidfed.op.explicitRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
idp.oidfed.op.explicitRegistration.defaultScope = openid profile email address phone offline_access
idp.oidfed.op.explicitRegistration.defaultSubjectType = public
idp.oidfed.op.explicitRegistration.validateRemoteJwks = shibboleth.Conditions.TRUE
idp.oidfed.op.explicitRegistration.clientInformationManager = shibboleth.oidc.ClientInformationManager
+idp.oidfed.op.explicitRegistration.StorageService = shibboleth.StorageService
idp.oidfed.op.explicitRegistration.FederationPolicyConstraints = shibboleth.oidfed.DefaultFederationPolicyConstraints
# signed-keyset-beans
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list