[java-idp-plugin-oidc-config] branch main updated: JCOMOIDC-184 - Move OAuth2Client authentication flow from OP to oidc-common"
Codeberg
noreply at shibboleth.net
Tue Sep 22 14:40:45 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-config.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-config/commit/1cb4e159f23f19f526323cedb4099e171efc8fda
The following commit(s) were added to refs/heads/main by this push:
new 1cb4e15 JCOMOIDC-184 - Move OAuth2Client authentication flow from OP to oidc-common"
1cb4e15 is described below
commit 1cb4e159f23f19f526323cedb4099e171efc8fda
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Sep 22 17:39:34 2026 +0300
JCOMOIDC-184 - Move OAuth2Client authentication flow from OP to oidc-common"
https://shibboleth.atlassian.net/browse/JCOMOIDC-184
This reverts commit 32de2cb8ec449b9a1e12657fe5683f0a359435d1. The OAuth2Client authentication flow and its descriptor are located in a new oidc-common-conf-impl module in java-oidc-common.
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 20 --
.../authn/OAuth2Client/OAuth2Client-beans.xml | 295 ---------------------
.../flows/authn/OAuth2Client/OAuth2Client-flow.xml | 43 ---
3 files changed, 358 deletions(-)
diff --git a/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index f380843..20aa148 100644
--- a/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/oidc-config-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -44,24 +44,4 @@
</property>
</bean>
- <!-- OAuth2 login flow -->
- <bean p:id="authn/OAuth2Client" parent="shibboleth.AuthenticationFlow"
- p:order="%{idp.authn.OAuth2Client.order:1000}"
- p:nonBrowserSupported="true"
- p:passiveAuthenticationSupported="true"
- p:forcedAuthenticationSupported="true"
- p:proxyRestrictionsEnforced="true"
- p:proxyScopingEnforced="false"
- p:discoveryRequired="false"
- p:lifetime="PT60S"
- p:inactivityTimeout="PT60S"
- p:reuseCondition-ref="shibboleth.Conditions.FALSE"
- p:activationCondition-ref="#{'%{idp.authn.OAuth2Client.activationCondition:shibboleth.Conditions.TRUE}'.trim()}"
- p:subjectDecorator="#{getObject('%{idp.authn.OAuth2Client.subjectDecorator:}'.trim())}">
- <property name="supportedPrincipalsByString">
- <bean parent="shibboleth.CommaDelimStringArray"
- c:_0="#{'%{idp.authn.OAuth2Client.supportedPrincipals:}'.trim()}" />
- </property>
- </bean>
-
</beans>
diff --git a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
deleted file mode 100644
index c8f73eb..0000000
--- a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
+++ /dev/null
@@ -1,295 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!-- Default message map. -->
- <util:map id="shibboleth.authn.OAuth2Client.ClassifiedMessageMap">
- <entry key="RequestUnsupported">
- <list>
- <value>RequestUnsupported</value>
- </list>
- </entry>
- </util:map>
-
- <import resource="conditional:%{idp.home}/conf/authn/oauth2client-authn-config.xml" />
-
- <bean id="ExtractClientAuthenticationFromRequest"
- class="net.shibboleth.oidc.authn.impl.ExtractClientAuthenticationFromRequest" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
-
- <bean id="PopulateTokenEndpointJwtSignatureValidationParameters"
- class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureValidationParameters"
- scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Inbound">
- <property name="configurationLookupStrategy">
- <bean class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureValidationConfigurationLookupFunction" />
- </property>
- <property name="signatureValidationParametersResolver">
- <bean class="net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationParametersResolver" />
- </property>
-<!-- <property name="securityParametersContextLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.SecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
- </property>
- <property name="existingParametersContextLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.SecurityParameters"
- c:f-ref="shibboleth.MessageContextLookup.Outbound" />
- </property>-->
- </bean>
-
- <bean id="JWTAuthenticationCondition" parent="shibboleth.Conditions.Expression"
- c:expression="#input.ensureSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).ensureSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication() instanceof T(com.nimbusds.oauth2.sdk.auth.JWTAuthentication)" />
-
- <bean id="ValidateJWTSignature" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
- scope="prototype" c:executionDirection="INBOUND" p:activationCondition-ref="JWTAuthenticationCondition"
- p:errorEvent="#{T(net.shibboleth.idp.authn.AuthnEventIds).AUTHN_EXCEPTION}">
- <constructor-arg>
- <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
- <property name="handlers">
- <list>
- <bean class="net.shibboleth.oidc.security.impl.CheckClientJWTSignatureAlgorithmHandler"
- scope="prototype" p:defaultAlgorithmValue="">
- <property name="jwtTokenLookupStrategy">
- <bean
- class="net.shibboleth.profile.context.navigate.SpringExpressionContextLookupFunction"
- c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
- c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
- c:expression="#input.getParent().ensureSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).ensureSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication().getClientAssertion()" />
- </property>
- <property name="clientInformationLookupStrategy">
- <bean
- class="net.shibboleth.profile.context.navigate.SpringExpressionContextLookupFunction"
- c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
- c:expression="#input.ensureSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
- </property>
- <property name="signatureAlgorithmLookupStrategy">
- <bean
- class="net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction"
- c:keyName="token_endpoint_auth_signing_alg" />
- </property>
- </bean>
- <bean class="net.shibboleth.oidc.security.impl.JWTMessageSignatureSecurityHandler"
- scope="prototype">
- <property name="jwtTokenLookupStrategy">
- <bean
- class="net.shibboleth.profile.context.navigate.SpringExpressionContextLookupFunction"
- c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
- c:outputType="#{T(com.nimbusds.jwt.SignedJWT)}"
- c:expression="#input.getParent().ensureSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).ensureSubcontext(T(net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext)).getClientAuthentication().getClientAssertion()" />
- </property>
- <property name="clientInformationLookupStrategy">
- <bean
- class="net.shibboleth.profile.context.navigate.SpringExpressionContextLookupFunction"
- c:_0="#{ T(org.opensaml.messaging.context.MessageContext) }"
- c:expression="#input.ensureSubcontext(T(net.shibboleth.oidc.metadata.context.OIDCMetadataContext)).getClientInformation()" />
- </property>
- </bean>
- </list>
- </property>
- </bean>
- </constructor-arg>
- </bean>
-
-
- <bean id="ValidateClientAuthenticationType"
- class="net.shibboleth.oidc.authn.impl.ValidateClientAuthenticationType" scope="prototype" />
-
- <bean id="DefaultCleanupHook"
- class="net.shibboleth.idp.authn.impl.ValidateCredentials.UsernamePasswordCleanupHook" />
-
- <bean id="ValidateCredentials"
- class="net.shibboleth.idp.authn.impl.ValidateCredentials" scope="prototype"
- p:requireAll="%{idp.authn.OAuth2Client.requireAll:false}"
- p:validators="#{getObject('shibboleth.authn.OAuth2Client.Validators') ?: getObject('DefaultOAuth2ClientValidators')}"
- p:addDefaultPrincipals="%{idp.authn.OAuth2Client.addDefaultPrincipals:true}"
- p:supportedPrincipals="#{getObject('shibboleth.authn.OAuth2Client.PrincipalOverride')}"
- p:classifiedMessages="#{getObject('shibboleth.authn.OAuth2Client.ClassifiedMessageMap')}"
- p:cleanupHook="#{T(java.lang.Boolean).valueOf('%{idp.authn.OAuth2Client.removeAfterValidation:true}') ? getObject('DefaultCleanupHook') : null}"
- p:lockoutManager="#{getObject('shibboleth.authn.OAuth2Client.AccountLockoutManager')}"
- p:populateAuditContextAction="#{%{idp.authn.OAuth2Client.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('shibboleth.authn.OAuth2Client.PopulateAuditContext') : null}"
- p:writeAuditLogAction="#{%{idp.authn.OAuth2Client.audit.enabled:%{idp.authn.audit.enabled:false}} ? getObject('WriteAuthnAuditLog') : null}" />
-
- <bean id="PopulateSubjectCanonicalizationContext"
- class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
- p:availableFlows-ref="%{idp.authn.OAuth2Client.c14n.postLoginFlows:shibboleth.PostLoginSubjectCanonicalizationFlows}" />
-
- <!-- Default validators equivalent to previous versions. -->
-
- <util:list id="DefaultOAuth2ClientValidators">
- <ref bean="shibboleth.OIDCClientInfoValidator" />
- <ref bean="shibboleth.JWTValidator" />
- </util:list>
-
- <!-- Validator parent beans -->
-
- <bean id="shibboleth.CredentialValidator" abstract="true"
- p:savePasswordToCredentialSet="%{idp.authn.OAuth2Client.retainAsPrivateCredential:false}" />
-
- <bean id="shibboleth.OIDCClientInfoValidator" parent="shibboleth.CredentialValidator"
- class="net.shibboleth.oidc.authn.impl.OIDCClientInfoCredentialValidator"
- p:id="oauth2-clientinfo" />
-
- <bean id="shibboleth.JWTValidator" class="net.shibboleth.oidc.authn.impl.JWTCredentialValidator"
- p:id="oauth2-jwt" />
-
- <bean id="shibboleth.JAASValidator" parent="shibboleth.CredentialValidator"
- class="net.shibboleth.idp.authn.impl.JAASCredentialValidator" abstract="true"
- p:id="oauth2-jaas" />
-
- <bean id="shibboleth.KerberosValidator" parent="shibboleth.CredentialValidator"
- class="net.shibboleth.idp.authn.impl.KerberosCredentialValidator" abstract="true"
- p:id="oauth2-krb5" />
-
- <bean id="shibboleth.LDAPValidator" parent="shibboleth.CredentialValidator" lazy-init="true"
- class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator"
- p:id="oauth2-ldap"
- p:authenticator-ref="shibboleth.authn.OAuth2Client.LDAP.authenticator" />
-
- <bean id="shibboleth.HTPasswdValidator" abstract="true"
- class="net.shibboleth.idp.authn.impl.HTPasswdCredentialValidator"
- p:id="oauth2-htpasswd" />
-
- <bean id="shibboleth.X509Validator" abstract="true"
- class="net.shibboleth.idp.authn.impl.X509CertificateCredentialValidator"
- p:id="oauth2-x509" />
-
- <!-- Parent beans for custom ldaptive types. -->
-
- <bean id="shibboleth.authn.OAuth2Client.LDAP.authenticator" parent="shibboleth.LDAPAuthenticationFactory"
- lazy-init="true" />
-
- <bean id="shibboleth.X509ResourceCredentialConfig"
- class="net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig" abstract="true" />
- <bean id="shibboleth.KeystoreResourceCredentialConfig"
- class="net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig" abstract="true" />
-
- <bean id="shibboleth.authn.OAuth2Client.LDAP.trustCertificates" parent="shibboleth.X509ResourceCredentialConfig"
- p:trustCertificates="%{idp.authn.OAuth2Client.LDAP.trustCertificates:undefined}" />
- <bean id="shibboleth.authn.OAuth2Client.LDAP.truststore" parent="shibboleth.KeystoreResourceCredentialConfig"
- p:truststore="%{idp.authn.OAuth2Client.LDAP.trustStore:undefined}" />
-
- <bean id="shibboleth.LDAPAuthenticationFactory" abstract="true"
- class="net.shibboleth.idp.authn.config.LDAPAuthenticationFactoryBean"
- p:authenticatorType="#{'%{idp.authn.OAuth2Client.LDAP.authenticator:anonSearchAuthenticator}'.trim()}"
- p:trustType="#{'%{idp.authn.OAuth2Client.LDAP.sslConfig:certificateTrust}'.trim()}"
- p:connectionStrategyType="#{'%{idp.authn.OAuth2Client.LDAP.connectionStrategy:ACTIVE_PASSIVE}'.trim()}"
- p:ldapUrl="%{idp.authn.OAuth2Client.LDAP.ldapURL:ldap://localhost:10389}"
- p:useStartTLS="%{idp.authn.OAuth2Client.LDAP.useStartTLS:true}"
- p:startTLSTimeout="%{idp.authn.OAuth2Client.LDAP.startTLSTimeout:PT3S}"
- p:connectTimeout="%{idp.authn.OAuth2Client.LDAP.connectTimeout:PT3S}"
- p:responseTimeout="%{idp.authn.OAuth2Client.LDAP.responseTimeout:PT3S}"
- p:autoReconnect="%{idp.authn.OAuth2Client.LDAP.autoReconnect:true}"
- p:reconnectTimeout="%{idp.authn.OAuth2Client.LDAP.reconnectTimeout:PT10S}"
- p:trustCertificatesCredentialConfig-ref="shibboleth.authn.OAuth2Client.LDAP.trustCertificates"
- p:truststoreCredentialConfig-ref="shibboleth.authn.OAuth2Client.LDAP.truststore"
- p:disablePooling="%{idp.authn.OAuth2Client.LDAP.disablePooling:false}"
- p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
- p:minPoolSize="%{idp.pool.LDAP.minSize:3}"
- p:maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
- p:validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"
- p:validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
- p:validatePeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
- p:validateDn="#{'%{idp.pool.LDAP.validateDN:}'.trim()}"
- p:validateFilter="#{'%{idp.pool.LDAP.validateFilter:(objectClass=*)}'.trim()}"
- p:bindPoolPassivatorType="#{'%{idp.authn.OAuth2Client.LDAP.bindPoolPassivator:none}'.trim()}"
- p:prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
- p:idleTime="%{idp.pool.LDAP.idleTime:PT10M}"
- p:dnFormat="%{idp.authn.OAuth2Client.LDAP.dnFormat:undefined}"
- p:baseDn="#{'%{idp.authn.OAuth2Client.LDAP.baseDN:undefined}'.trim()}"
- p:userFilter="#{'%{idp.authn.OAuth2Client.LDAP.userFilter:undefined}'.trim()}"
- p:subtreeSearch="%{idp.authn.OAuth2Client.LDAP.subtreeSearch:false}"
- p:resolveEntryOnFailure="%{idp.authn.OAuth2Client.LDAP.resolveEntryOnFailure:false}"
- p:resolveEntryWithBindDn="%{idp.authn.OAuth2Client.LDAP.resolveEntryWithBindDN:false}"
- p:velocityEngine-ref="shibboleth.VelocityEngine"
- p:bindDn="#{'%{idp.authn.OAuth2Client.LDAP.bindDN:undefined}'.trim()}"
- p:bindDnCredential="%{idp.authn.OAuth2Client.LDAP.bindDNCredential:undefined}"
- p:usePasswordPolicy="%{idp.authn.OAuth2Client.LDAP.usePasswordPolicy:false}"
- p:usePasswordExpiration="%{idp.authn.OAuth2Client.LDAP.usePasswordExpiration:false}"
- p:activeDirectory="%{idp.authn.OAuth2Client.LDAP.activeDirectory:false}"
- p:freeIPA="%{idp.authn.OAuth2Client.LDAP.freeIPADirectory:false}"
- p:EDirectory="%{idp.authn.OAuth2Client.LDAP.eDirectory:false}"
- p:accountStateExpirationPeriod="%{idp.authn.OAuth2Client.LDAP.accountStateExpirationPeriod:#{null}}"
- p:accountStateWarningPeriod="%{idp.authn.OAuth2Client.LDAP.accountStateWarningPeriod:#{null}}"
- p:accountStateLoginFailures="%{idp.authn.OAuth2Client.LDAP.accountStateLoginFailures:0}" />
-
- <util:map id="shibboleth.authn.AuditFormattingMap">
- <entry key="#{'%{idp.authn.OAuth2Client.audit.category:Shibboleth-Audit.OAuth2Client}'.trim()}"
- value="#{'%{idp.authn.OAuth2Client.audit.format:%a|%T|%SP|%I|%s|%AF|%CV|%u|%tu|%AR|%UA}'.trim()}" />
- </util:map>
-
- <bean id="shibboleth.authn.OAuth2Client.PopulateAuditContext" parent="shibboleth.authn.AbstractPopulateAuditContext" lazy-init="true"
- p:fieldExtractors="#{getObject('shibboleth.authn.OAuth2Client.AuditExtractors') ?: getObject('shibboleth.authn.OAuth2Client.DefaultAuditExtractors')}"/>
-
- <bean id="shibboleth.authn.OAuth2Client.DefaultAuditExtractors" parent="shibboleth.authn.DefaultAuditExtractors" lazy-init="true"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map merge="true">
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.USERNAME"/>
- </key>
- <bean class="net.shibboleth.idp.authn.audit.impl.AttemptedUsernameAuditExtractor" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.authn.AuthnAuditFields.TRANSFORMED_USERNAME"/>
- </key>
- <bean class="net.shibboleth.idp.authn.audit.impl.TransformedUsernameAuditExtractor" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.REQUEST_ID"/>
- </key>
- <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
- c:key="jti" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.REQUEST_ISSUE_INSTANT"/>
- </key>
- <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
- c:key="iat" />
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.audit.AuditFields.AUDIENCE"/>
- </key>
- <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
- c:key="aud" />
- </entry>
- <entry key="iss">
- <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
- c:key="iss" />
- </entry>
- <entry key="sub">
- <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
- c:key="sub" />
- </entry>
- <entry key="exp">
- <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
- c:key="exp" />
- </entry>
- <entry key="iat">
- <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
- c:key="iat" />
- </entry>
- <entry key="typ">
- <bean class="net.shibboleth.oidc.authn.audit.impl.ClientAuthenticationJWTTypeHeaderAuditExtractor" />
- </entry>
- </map>
- </property>
- </bean>
-
-</beans>
diff --git a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml b/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
deleted file mode 100644
index a75eb60..0000000
--- a/oidc-config-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-flow.xml
+++ /dev/null
@@ -1,43 +0,0 @@
-<flow xmlns="http://www.springframework.org/schema/webflow"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="authn.abstract">
-
- <!--
- This is a login flow for handling OAuth2-defined client authentication mechanisms.
- The current implementation relies on Nimbus APIs but could be replaced in the future if necessary.
- -->
-
- <action-state id="OAuth2Client">
- <evaluate expression="PopulateTokenEndpointJwtSignatureValidationParameters"/>
- <evaluate expression="ExtractClientAuthenticationFromRequest" />
- <evaluate expression="ValidateClientAuthenticationType" />
- <evaluate expression="ValidateJWTSignature"/>
- <evaluate expression="ValidateCredentials" />
- <evaluate expression="PopulateSubjectCanonicalizationContext" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="CallSubjectCanonicalization" />
- </action-state>
-
- <!-- This runs a c14n step on the result of the authentication. -->
- <subflow-state id="CallSubjectCanonicalization" subflow="c14n">
- <input name="calledAsSubflow" value="true" />
- <transition on="proceed" to="proceed" />
-
- <!-- This shouldn't generally happen, but if c14n fails, it's allowable to fall through. -->
- <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
- </subflow-state>
-
- <!-- As a "fall-through" method, remap selected events to select a different flow. -->
- <global-transitions>
- <transition on="NoCredentials" to="ReselectFlow" />
- <transition on="InvalidCredentials" to="ReselectFlow" />
- <transition on="RequestUnsupported" to="ReselectFlow" />
- <transition on="UnknownUsername" to="ReselectFlow" />
- <transition on="AccessDenied" to="ReselectFlow" />
- </global-transitions>
-
- <bean-import resource="OAuth2Client-beans.xml" />
-
-</flow>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list