[java-idp-plugin-oidc-config] branch main updated: JCOMOIDC-184 - Move OAuth2Client authentication flow from OP to oidc-common
Codeberg
noreply at shibboleth.net
Fri Sep 18 14:22:06 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-config.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-config/commit/32de2cb8ec449b9a1e12657fe5683f0a359435d1
The following commit(s) were added to refs/heads/main by this push:
new 32de2cb JCOMOIDC-184 - Move OAuth2Client authentication flow from OP to oidc-common
32de2cb is described below
commit 32de2cb8ec449b9a1e12657fe5683f0a359435d1
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 18 16:32:29 2026 +0300
JCOMOIDC-184 - Move OAuth2Client authentication flow from OP to oidc-common
https://shibboleth.atlassian.net/browse/JCOMOIDC-184
Move the authn/OAuth2Client flow and its descriptor from OP. The referred java classes are located in oidc-common-crypto-impl.
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 20 ++
.../authn/OAuth2Client/OAuth2Client-beans.xml | 295 +++++++++++++++++++++
.../flows/authn/OAuth2Client/OAuth2Client-flow.xml | 43 +++
3 files changed, 358 insertions(+)
diff --git a/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 20aa148..f380843 100644
--- a/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -44,4 +44,24 @@
</property>
</bean>
+ <!-- OAuth2 login flow -->
+ <bean p:id="authn/OAuth2Client" parent="shibboleth.AuthenticationFlow"
+ p:order="%{idp.authn.OAuth2Client.order:1000}"
+ p:nonBrowserSupported="true"
+ p:passiveAuthenticationSupported="true"
+ p:forcedAuthenticationSupported="true"
+ p:proxyRestrictionsEnforced="true"
+ p:proxyScopingEnforced="false"
+ p:discoveryRequired="false"
+ p:lifetime="PT60S"
+ p:inactivityTimeout="PT60S"
+ p:reuseCondition-ref="shibboleth.Conditions.FALSE"
+ p:activationCondition-ref="#{'%{idp.authn.OAuth2Client.activationCondition:shibboleth.Conditions.TRUE}'.trim()}"
+ p:subjectDecorator="#{getObject('%{idp.authn.OAuth2Client.subjectDecorator:}'.trim())}">
+ <property name="supportedPrincipalsByString">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.authn.OAuth2Client.supportedPrincipals:}'.trim()}" />
+ </property>
+ </bean>
+
</beans>
diff --git a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
new file mode 100644
index 0000000..c8f73eb
--- /dev/null
+++ b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
@@ -0,0 +1,295 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- Default message map. -->
+ <util:map id="shibboleth.authn.OAuth2Client.ClassifiedMessageMap">
+ <entry key="RequestUnsupported">
+ <list>
+ <value>RequestUnsupported</value>
+ </list>
+ </entry>
+ </util:map>
+
+ <import resource="conditional:%{idp.home}/conf/authn/oauth2client-authn-config.xml" />
+
+ <bean id="ExtractClientAuthenticationFromRequest"
+ class="net.shibboleth.oidc.authn.impl.ExtractClientAuthenticationFromRequest" scope="prototype"
+ p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
+
+ <bean id="PopulateTokenEndpointJwtSignatureValidationParameters"
+ class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureValidationParameters"
+ scope="prototype"
+ c:strategy-ref="shibboleth.MessageContextLookup.Inbound">
+ <property name="configurationLookupStrategy">
+ <bean class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureValidationConfigurationLookupFunction" />
+ </property>
+ <property name="signatureValidationParametersResolver">
+ <bean class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationParametersResolver" />
+ </property>
+<!-- <property name="securityParametersContextLookupStrategy">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
+ c:f-ref="shibboleth.ChildLookup.RelyingParty" />
+ </property>
+ <property name="existingParametersContextLookupStrategy">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookup.SecurityParameters"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </property>-->
+ </bean>
+
+ <bean id="JWTAuthenticationCondition" parent="shibboleth.Conditions.Expression"
+ c:expression="#input.ensureSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).ensureSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication() instanceof T(com.nimbusds.oauth2.sdk.auth.JWTAuthentication)" />
+
+ <bean id="ValidateJWTSignature" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
+ scope="prototype" c:executionDirection="INBOUND" p:activationCondition-ref="JWTAuthenticationCondition"
+ p:errorEvent="#{T(net.shibboleth.idp.authn.AuthnEventIds).AUTHN_EXCEPTION}">
+ <constructor-arg>
+ <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
+ <property name="handlers">
+ <list>
+ <bean class="net.shibboleth.oidc.security.impl.CheckClientJWTSignatureAlgorithmHandler"
+ scope="prototype" p:defaultAlgorithmValue="">
+ <property name="jwtTokenLookupStrategy">
+ <bean
+ class="net.shibboleth.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
+ c:expression="#input.getParent().ensureSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).ensureSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication().getClientAssertion()" />
+ </property>
+ <property name="clientInformationLookupStrategy">
+ <bean
+ class="net.shibboleth.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:expression="#input.ensureSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ </property>
+ <property name="signatureAlgorithmLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
+ c:keyName="token_endpoint_auth_signing_alg" />
+ </property>
+ </bean>
+ <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
+ scope="prototype">
+ <property name="jwtTokenLookupStrategy">
+ <bean
+ class="net.shibboleth.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
+ c:expression="#input.getParent().ensureSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).ensureSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication().getClientAssertion()" />
+ </property>
+ <property name="clientInformationLookupStrategy">
+ <bean
+ class="net.shibboleth.profile.context.navigate.SpringExpressionContextLookupFunction"
+ c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
+ c:expression="#input.ensureSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
+ </property>
+ </bean>
+ </list>
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
+
+
+ <bean id="ValidateClientAuthenticationType"
+ class="net.shibboleth.oidc.authn.impl.ValidateClientAuthenticationType" scope="prototype" />
+
+ <bean id="DefaultCleanupHook"
+ class="net.shibboleth.idp.authn.impl.ValidateCredentials.UsernamePasswordCleanupHook" />
+
+ <bean id="ValidateCredentials"
+ class="net.shibboleth.idp.authn.impl.ValidateCredentials" scope="prototype"
+ p:requireAll="%{idp.authn.OAuth2Client.requireAll:false}"
+ p:validators="#{getObject('shibboleth.authn.OAuth2Client.Validators') ?: getObject('DefaultOAuth2ClientValidators')}"
+ p:addDefaultPrincipals="%{idp.authn.OAuth2Client.addDefaultPrincipals:true}"
+ p:supportedPrincipals="#{getObject('shibboleth.authn.OAuth2Client.PrincipalOverride')}"
+ p:classifiedMessages="#{getObject('shibboleth.authn.OAuth2Client.ClassifiedMessageMap')}"
+ p:cleanupHook="#{T(java.lang.Boolean).valueOf('%{idp.authn.OAuth2Client.removeAfterValidation:true}') ? getObject('DefaultCleanupHook') : null}"
+ p:lockoutManager="#{getObject('shibboleth.authn.OAuth2Client.AccountLockoutManager')}"
+ p:populateAuditContextAction="#{%{idp.authn.OAuth2Client.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('shibboleth.authn.OAuth2Client.PopulateAuditContext') : null}"
+ p:writeAuditLogAction="#{%{idp.authn.OAuth2Client.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuthnAuditLog') : null}" />
+
+ <bean id="PopulateSubjectCanonicalizationContext"
+ class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
+ p:availableFlows-ref="%{idp.authn.OAuth2Client.c14n.postLoginFlows:shibboleth.PostLoginSubjectCanonicalizationFlows}" />
+
+ <!-- Default validators equivalent to previous versions. -->
+
+ <util:list id="DefaultOAuth2ClientValidators">
+ <ref bean="shibboleth.OIDCClientInfoValidator" />
+ <ref bean="shibboleth.JWTValidator" />
+ </util:list>
+
+ <!-- Validator parent beans -->
+
+ <bean id="shibboleth.CredentialValidator" abstract="true"
+ p:savePasswordToCredentialSet="%{idp.authn.OAuth2Client.retainAsPrivateCredential:false}" />
+
+ <bean id="shibboleth.OIDCClientInfoValidator" parent="shibboleth.CredentialValidator"
+ class="net.shibboleth.oidc.authn.impl.OIDCClientInfoCredentialValidator"
+ p:id="oauth2-clientinfo" />
+
+ <bean id="shibboleth.JWTValidator" class="net.shibboleth.oidc.authn.impl.JWTCredentialValidator"
+ p:id="oauth2-jwt" />
+
+ <bean id="shibboleth.JAASValidator" parent="shibboleth.CredentialValidator"
+ class="net.shibboleth.idp.authn.impl.JAASCredentialValidator" abstract="true"
+ p:id="oauth2-jaas" />
+
+ <bean id="shibboleth.KerberosValidator" parent="shibboleth.CredentialValidator"
+ class="net.shibboleth.idp.authn.impl.KerberosCredentialValidator" abstract="true"
+ p:id="oauth2-krb5" />
+
+ <bean id="shibboleth.LDAPValidator" parent="shibboleth.CredentialValidator" lazy-init="true"
+ class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator"
+ p:id="oauth2-ldap"
+ p:authenticator-ref="shibboleth.authn.OAuth2Client.LDAP.authenticator" />
+
+ <bean id="shibboleth.HTPasswdValidator" abstract="true"
+ class="net.shibboleth.idp.authn.impl.HTPasswdCredentialValidator"
+ p:id="oauth2-htpasswd" />
+
+ <bean id="shibboleth.X509Validator" abstract="true"
+ class="net.shibboleth.idp.authn.impl.X509CertificateCredentialValidator"
+ p:id="oauth2-x509" />
+
+ <!-- Parent beans for custom ldaptive types. -->
+
+ <bean id="shibboleth.authn.OAuth2Client.LDAP.authenticator" parent="shibboleth.LDAPAuthenticationFactory"
+ lazy-init="true" />
+
+ <bean id="shibboleth.X509ResourceCredentialConfig"
+ class="net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig" abstract="true" />
+ <bean id="shibboleth.KeystoreResourceCredentialConfig"
+ class="net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig" abstract="true" />
+
+ <bean id="shibboleth.authn.OAuth2Client.LDAP.trustCertificates" parent="shibboleth.X509ResourceCredentialConfig"
+ p:trustCertificates="%{idp.authn.OAuth2Client.LDAP.trustCertificates:undefined}" />
+ <bean id="shibboleth.authn.OAuth2Client.LDAP.truststore" parent="shibboleth.KeystoreResourceCredentialConfig"
+ p:truststore="%{idp.authn.OAuth2Client.LDAP.trustStore:undefined}" />
+
+ <bean id="shibboleth.LDAPAuthenticationFactory" abstract="true"
+ class="net.shibboleth.idp.authn.config.LDAPAuthenticationFactoryBean"
+ p:authenticatorType="#{'%{idp.authn.OAuth2Client.LDAP.authenticator:anonSearchAuthenticator}'.trim()}"
+ p:trustType="#{'%{idp.authn.OAuth2Client.LDAP.sslConfig:certificateTrust}'.trim()}"
+ p:connectionStrategyType="#{'%{idp.authn.OAuth2Client.LDAP.connectionStrategy:ACTIVE_PASSIVE}'.trim()}"
+ p:ldapUrl="%{idp.authn.OAuth2Client.LDAP.ldapURL:ldap://localhost:10389}"
+ p:useStartTLS="%{idp.authn.OAuth2Client.LDAP.useStartTLS:true}"
+ p:startTLSTimeout="%{idp.authn.OAuth2Client.LDAP.startTLSTimeout:PT3S}"
+ p:connectTimeout="%{idp.authn.OAuth2Client.LDAP.connectTimeout:PT3S}"
+ p:responseTimeout="%{idp.authn.OAuth2Client.LDAP.responseTimeout:PT3S}"
+ p:autoReconnect="%{idp.authn.OAuth2Client.LDAP.autoReconnect:true}"
+ p:reconnectTimeout="%{idp.authn.OAuth2Client.LDAP.reconnectTimeout:PT10S}"
+ p:trustCertificatesCredentialConfig-ref="shibboleth.authn.OAuth2Client.LDAP.trustCertificates"
+ p:truststoreCredentialConfig-ref="shibboleth.authn.OAuth2Client.LDAP.truststore"
+ p:disablePooling="%{idp.authn.OAuth2Client.LDAP.disablePooling:false}"
+ p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
+ p:minPoolSize="%{idp.pool.LDAP.minSize:3}"
+ p:maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
+ p:validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"
+ p:validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
+ p:validatePeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
+ p:validateDn="#{'%{idp.pool.LDAP.validateDN:}'.trim()}"
+ p:validateFilter="#{'%{idp.pool.LDAP.validateFilter:(objectClass=*)}'.trim()}"
+ p:bindPoolPassivatorType="#{'%{idp.authn.OAuth2Client.LDAP.bindPoolPassivator:none}'.trim()}"
+ p:prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
+ p:idleTime="%{idp.pool.LDAP.idleTime:PT10M}"
+ p:dnFormat="%{idp.authn.OAuth2Client.LDAP.dnFormat:undefined}"
+ p:baseDn="#{'%{idp.authn.OAuth2Client.LDAP.baseDN:undefined}'.trim()}"
+ p:userFilter="#{'%{idp.authn.OAuth2Client.LDAP.userFilter:undefined}'.trim()}"
+ p:subtreeSearch="%{idp.authn.OAuth2Client.LDAP.subtreeSearch:false}"
+ p:resolveEntryOnFailure="%{idp.authn.OAuth2Client.LDAP.resolveEntryOnFailure:false}"
+ p:resolveEntryWithBindDn="%{idp.authn.OAuth2Client.LDAP.resolveEntryWithBindDN:false}"
+ p:velocityEngine-ref="shibboleth.VelocityEngine"
+ p:bindDn="#{'%{idp.authn.OAuth2Client.LDAP.bindDN:undefined}'.trim()}"
+ p:bindDnCredential="%{idp.authn.OAuth2Client.LDAP.bindDNCredential:undefined}"
+ p:usePasswordPolicy="%{idp.authn.OAuth2Client.LDAP.usePasswordPolicy:false}"
+ p:usePasswordExpiration="%{idp.authn.OAuth2Client.LDAP.usePasswordExpiration:false}"
+ p:activeDirectory="%{idp.authn.OAuth2Client.LDAP.activeDirectory:false}"
+ p:freeIPA="%{idp.authn.OAuth2Client.LDAP.freeIPADirectory:false}"
+ p:EDirectory="%{idp.authn.OAuth2Client.LDAP.eDirectory:false}"
+ p:accountStateExpirationPeriod="%{idp.authn.OAuth2Client.LDAP.accountStateExpirationPeriod:#{null}}"
+ p:accountStateWarningPeriod="%{idp.authn.OAuth2Client.LDAP.accountStateWarningPeriod:#{null}}"
+ p:accountStateLoginFailures="%{idp.authn.OAuth2Client.LDAP.accountStateLoginFailures:0}" />
+
+ <util:map id="shibboleth.authn.AuditFormattingMap">
+ <entry key="#{'%{idp.authn.OAuth2Client.audit.category:Shibboleth-Audit.OAuth2Client}'.trim()}"
+ value="#{'%{idp.authn.OAuth2Client.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%tu|%AR|%UA}'.trim()}" />
+ </util:map>
+
+ <bean id="shibboleth.authn.OAuth2Client.PopulateAuditContext" parent="shibboleth.authn.AbstractPopulateAuditContext" lazy-init="true"
+ p:fieldExtractors="#{getObject('shibboleth.authn.OAuth2Client.AuditExtractors') ?: getObject('shibboleth.authn.OAuth2Client.DefaultAuditExtractors')}"/>
+
+ <bean id="shibboleth.authn.OAuth2Client.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map merge="true">
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.USERNAME"/>
+ </key>
+ <bean class="net.shibboleth.idp.authn.audit.impl.AttemptedUsernameAuditExtractor" />
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.authn.AuthnAuditFields.TRANSFORMED_USERNAME"/>
+ </key>
+ <bean class="net.shibboleth.idp.authn.audit.impl.TransformedUsernameAuditExtractor" />
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.REQUEST_ID"/>
+ </key>
+ <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="jti" />
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.REQUEST_ISSUE_INSTANT"/>
+ </key>
+ <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="iat" />
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.audit.AuditFields.AUDIENCE"/>
+ </key>
+ <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="aud" />
+ </entry>
+ <entry key="iss">
+ <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="iss" />
+ </entry>
+ <entry key="sub">
+ <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="sub" />
+ </entry>
+ <entry key="exp">
+ <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="exp" />
+ </entry>
+ <entry key="iat">
+ <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="iat" />
+ </entry>
+ <entry key="typ">
+ <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTTypeHeaderAuditExtractor" />
+ </entry>
+ </map>
+ </property>
+ </bean>
+
+</beans>
diff --git a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
new file mode 100644
index 0000000..a75eb60
--- /dev/null
+++ b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
@@ -0,0 +1,43 @@
+<flow xmlns="http://www.springframework.org/schema/webflow"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
+ parent="authn.abstract">
+
+ <!--
+ This is a login flow for handling OAuth2-defined client authentication mechanisms.
+ The current implementation relies on Nimbus APIs but could be replaced in the future if necessary.
+ -->
+
+ <action-state id="OAuth2Client">
+ <evaluate expression="PopulateTokenEndpointJwtSignatureValidationParameters"/>
+ <evaluate expression="ExtractClientAuthenticationFromRequest" />
+ <evaluate expression="ValidateClientAuthenticationType" />
+ <evaluate expression="ValidateJWTSignature"/>
+ <evaluate expression="ValidateCredentials" />
+ <evaluate expression="PopulateSubjectCanonicalizationContext" />
+ <evaluate expression="'proceed'" />
+
+ <transition on="proceed" to="CallSubjectCanonicalization" />
+ </action-state>
+
+ <!-- This runs a c14n step on the result of the authentication. -->
+ <subflow-state id="CallSubjectCanonicalization" subflow="c14n">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="proceed" />
+
+ <!-- This shouldn't generally happen, but if c14n fails, it's allowable to fall through. -->
+ <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
+ </subflow-state>
+
+ <!-- As a "fall-through" method, remap selected events to select a different flow. -->
+ <global-transitions>
+ <transition on="NoCredentials" to="ReselectFlow" />
+ <transition on="InvalidCredentials" to="ReselectFlow" />
+ <transition on="RequestUnsupported" to="ReselectFlow" />
+ <transition on="UnknownUsername" to="ReselectFlow" />
+ <transition on="AccessDenied" to="ReselectFlow" />
+ </global-transitions>
+
+ <bean-import resource="OAuth2Client-beans.xml" />
+
+</flow>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list