[java-idp-plugin-oidc-op-oidfed] branch main updated: Adapt into the new ResolveTrustMarks action from oidfed-common-impl

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-oidc-op-oidfed.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/4e4dced19df091b57f3750ef5a6aeeb7a174156e

The following commit(s) were added to refs/heads/main by this push:
     new 4e4dced  Adapt into the new ResolveTrustMarks action from oidfed-common-impl
4e4dced is described below

commit 4e4dced19df091b57f3750ef5a6aeeb7a174156e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Sep 23 20:33:39 2026 +0300

    Adapt into the new ResolveTrustMarks action from oidfed-common-impl
    
    Similarly to oidfed-common's flows, support custom wiring of metadata caches for automatic and explicit registration
    - idp.oidfed.op.automaticRegistration.EntityConfigurationMetadataCache
    - idp.oidfed.op.automaticRegistration.LocalTrustAnchorsMetadataCache
    - idp.oidfed.op.automaticRegistration.TrustedTrustMarkIssuersOnlyCondition
    - idp.oidfed.op.explicitRegistration.EntityConfigurationMetadataCache
    - idp.oidfed.op.explicitRegistration.LocalTrustAnchorsMetadataCache
    - idp.oidfed.op.explicitRegistration.TrustedTrustMarkIssuersOnlyCondition
---
 .../oidfed/metadata-lookup-ext-oidfed-beans.xml      | 20 +++++++++++++++++++-
 .../idp/flows/oidfed/register/register-beans.xml     | 20 +++++++++++++++++++-
 .../oidc/op/oidfed/conf/oidfed/oidfed-op.properties  |  7 +++++++
 3 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
index 37ee0f3..6264bf4 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
@@ -149,7 +149,7 @@
 
     <bean id="ResolveTrustMarks" class="net.shibboleth.oidfed.profile.impl.ResolveTrustMarks"
         scope="prototype"
-        p:trustChainCache-ref="#{'%{idp.oidfed.op.automaticRegistration.TrustChainMetadataCache:shibboleth.oidfed.TrustChainMetadataCache}'.trim()}"
+        p:trustedTrustMarkIssuersOnlyCondition-ref="#{'%{idp.oidfed.op.automaticRegistration.TrustedTrustMarkIssuersOnlyCondition:shibboleth.Conditions.TRUE}'.trim()}"
         p:trustMarkClaimsValidationLookupStrategy="#{getObject('shibboleth.oidfed.TrustMarkClaimsValidationLookupStrategy') ?: getObject('DefaultTrustMarkClaimsValidationLookupStrategy')}"
         p:delegatedTrustMarkClaimsValidationLookupStrategy="#{getObject('shibboleth.oidfed.DelegatedTrustMarkClaimsValidationLookupStrategy') ?: getObject('DefaultDelegatedTrustMarkClaimsValidationLookupStrategy')}"
         p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
@@ -164,6 +164,24 @@
         <property name="trustedTrustMarkOwnersLookupStrategy">
             <bean class="net.shibboleth.oidfed.profile.navigate.DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy"/>
         </property>
+        <property name="trustMarkIssuerConfigurationFetchingStrategy">
+            <bean class="net.shibboleth.oidfed.metadata.cache.trustmark.DefaultTrustMarkIssuerConfigurationFetchingStrategy"
+                p:trustChainCache-ref="#{'%{idp.oidfed.op.automaticRegistration.TrustChainMetadataCache:shibboleth.oidfed.TrustChainMetadataCache}'.trim()}"
+                p:entityConfigurationCache-ref="#{'%{idp.oidfed.op.automaticRegistration.EntityConfigurationMetadataCache:shibboleth.oidfed.EntityConfigurationMetadataCache}'.trim()}"
+                p:localTrustAnchorsCache-ref="#{'%{idp.oidfed.op.automaticRegistration.LocalTrustAnchorsMetadataCache:shibboleth.oidfed.LocalTrustAnchorsMetadataCache}'.trim()}">
+                <property name="trustEngine">
+                    <bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
+                        <constructor-arg index="0">
+                            <bean class="net.shibboleth.oidfed.security.credential.DefaultLocalTrustAnchorCredentialResolver"
+                                c:cache-ref="#{'%{idp.oidfed.op.automaticRegistration.LocalTrustAnchorsMetadataCache:shibboleth.oidfed.LocalTrustAnchorsMetadataCache}'.trim()}" />
+                        </constructor-arg>
+                        <constructor-arg index="1">
+                            <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+                        </constructor-arg>
+                    </bean>
+                </property>
+            </bean>
+        </property>
     </bean>
 
     <bean id="ValidateTrustMarks" class="net.shibboleth.oidfed.profile.impl.ValidateTrustMarks"
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
index f2e1897..935557b 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
@@ -262,7 +262,7 @@
 
     <bean id="ResolveTrustMarks" class="net.shibboleth.oidfed.profile.impl.ResolveTrustMarks"
         scope="prototype"
-        p:trustChainCache-ref="#{'%{idp.oidfed.op.explicitRegistration.TrustChainMetadataCache:shibboleth.oidfed.TrustChainMetadataCache}'.trim()}"
+        p:trustedTrustMarkIssuersOnlyCondition-ref="#{'%{idp.oidfed.op.explicitRegistration.TrustedTrustMarkIssuersOnlyCondition:shibboleth.Conditions.TRUE}'.trim()}"
         p:trustMarkClaimsValidationLookupStrategy="#{getObject('shibboleth.oidfed.TrustMarkClaimsValidationLookupStrategy') ?: getObject('DefaultTrustMarkClaimsValidationLookupStrategy')}"
         p:delegatedTrustMarkClaimsValidationLookupStrategy="#{getObject('shibboleth.oidfed.DelegatedTrustMarkClaimsValidationLookupStrategy') ?: getObject('DefaultDelegatedTrustMarkClaimsValidationLookupStrategy')}"
         p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
@@ -281,6 +281,24 @@
             <bean parent="shibboleth.Conditions.Expression"
                 c:expression="#input.ensureInboundMessageContext().containsSubcontext(T(net.shibboleth.oidfed.profile.context.RelyingPartyTrustChainContext))" />
         </property>
+        <property name="trustMarkIssuerConfigurationFetchingStrategy">
+            <bean class="net.shibboleth.oidfed.metadata.cache.trustmark.DefaultTrustMarkIssuerConfigurationFetchingStrategy"
+                p:trustChainCache-ref="#{'%{idp.oidfed.op.explicitRegistration.TrustChainMetadataCache:shibboleth.oidfed.TrustChainMetadataCache}'.trim()}"
+                p:entityConfigurationCache-ref="#{'%{idp.oidfed.op.explicitRegistration.EntityConfigurationMetadataCache:shibboleth.oidfed.EntityConfigurationMetadataCache}'.trim()}"
+                p:localTrustAnchorsCache-ref="#{'%{idp.oidfed.op.explicitRegistration.LocalTrustAnchorsMetadataCache:shibboleth.oidfed.LocalTrustAnchorsMetadataCache}'.trim()}">
+                <property name="trustEngine">
+                    <bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
+                        <constructor-arg index="0">
+                            <bean class="net.shibboleth.oidfed.security.credential.DefaultLocalTrustAnchorCredentialResolver"
+                                c:cache-ref="#{'%{idp.oidfed.op.explicitRegistration.LocalTrustAnchorsMetadataCache:shibboleth.oidfed.LocalTrustAnchorsMetadataCache}'.trim()}" />
+                        </constructor-arg>
+                        <constructor-arg index="1">
+                            <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+                        </constructor-arg>
+                    </bean>
+                </property>
+            </bean>
+        </property>
     </bean>
 
     <bean id="ValidateTrustMarks" class="net.shibboleth.oidfed.profile.impl.ValidateTrustMarks"
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
index 40f23fe..650088f 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-op.properties
@@ -22,6 +22,10 @@ idp.oidfed.op.automaticRegistration.MetadataPolicyMergingStrategy = MetadataPoli
 idp.oidfed.op.automaticRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
 idp.oidfed.op.automaticRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
 idp.oidfed.op.automaticRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
+idp.oidfed.op.automaticRegistration.EntityConfigurationMetadataCache = shibboleth.oidfed.EntityConfigurationMetadataCache
+idp.oidfed.op.automaticRegistration.LocalTrustAnchorsMetadataCache = shibboleth.oidfed.LocalTrustAnchorsMetadataCache
+idp.oidfed.op.automaticRegistration.TrustedTrustMarkIssuersOnlyCondition = shibboleth.Conditions.TRUE
+
 
 idp.oidfed.op.explicitRegistration.mandatoryTrustMarks =
 idp.oidfed.op.explicitRegistration.trustchain.resolver.useResolverApiCondition = shibboleth.Conditions.FALSE
@@ -51,6 +55,9 @@ idp.oidfed.op.explicitRegistration.MetadataPolicyMergingStrategy = MetadataPolic
 idp.oidfed.op.explicitRegistration.LocalMetadataPolicyStrategy = DefaultLocalMetadataPolicyStrategy
 idp.oidfed.op.explicitRegistration.TrustChainMetadataCache = shibboleth.oidfed.TrustChainMetadataCache
 idp.oidfed.op.explicitRegistration.TrustMarkStatusMetadataCache = shibboleth.oidfed.TrustMarkStatusMetadataCache
+idp.oidfed.op.explicitRegistration.EntityConfigurationMetadataCache = shibboleth.oidfed.EntityConfigurationMetadataCache
+idp.oidfed.op.explicitRegistration.LocalTrustAnchorsMetadataCache = shibboleth.oidfed.LocalTrustAnchorsMetadataCache
+idp.oidfed.op.explicitRegistration.TrustedTrustMarkIssuersOnlyCondition = shibboleth.Conditions.TRUE
 idp.oidfed.op.explicitRegistration.defaultScope = openid profile email address phone offline_access
 idp.oidfed.op.explicitRegistration.defaultSubjectType = public
 idp.oidfed.op.explicitRegistration.validateRemoteJwks = shibboleth.Conditions.TRUE

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.