<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0"> <base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0" bgcolor="#f5f5f5"><!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"><img id="header-avatar-image" class="image_fix" src="https://secure.gravatar.com/avatar/d5eb999af04e0930ec6738adcd7f57db?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FPS-0.png" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"></td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"><a class="user-hover" rel="5afecdc1eb3ffa0c596652c4" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_5afecdc1eb3ffa0c596652c4" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4"> Philip Smart </a> <strong>commented</strong> on <a href="https://shibboleth.atlassian.net/browse/JCOMOIDC-48?atlOrigin=eyJpIjoiODI2Mzg1YWRhNmRhNGI0YjkyOWQ5MmQ5MzIwMGRjNmMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-8ee77414-73ce-47a6-92bb-a34bbab3861e" height="16" width="16" border="0" align="absmiddle" alt="Improvement"> JCOMOIDC-48</a></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate">
<tbody>
<tr><!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td style="vertical-align: top;; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"><span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/JCOMOIDC-48?atlOrigin=eyJpIjoiODI2Mzg1YWRhNmRhNGI0YjkyOWQ5MmQ5MzIwMGRjNmMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">Re: Move OIDC.SSO profile bean to commons</a> </span></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0; border-collapse: collapse; padding: 0 0 10px"><p style="margin: 10px 0 0; margin-top: 0">I’ve made some progress with this. I added back the relying-party postconfig.xml to oidc-commons profile-api (removed from the RP). If I co-load the RP and OP (RP as the authn flow to the OP), it works, but spring is obviously replacing all the OIDC.SSO settings set on the OP with those on the RP (replaces the entire bean definition, not just any properties that overlap). So:</p>
<ul>
<li>I harmonized the AbstractOIDCProfile bean and, importantly, the default security configuration between the RP and OP. Notably:
<ul>
<li>They both now use the exact same security configuration.</li>
<li>They use the same key pairs for signing and encryption</li>
<li>The same algorithms and algorithm includes and excludes lists</li>
<li>The same credential resolvers. That is, a combination of those the RP used to fetch Provider metadata, and the OP used to fetch client information.
<ul>
<li>In the RP case, the client information resolver will not produce a result because it is not sent the client information criterion.</li>
<li>In the OP case, the provider metadata resolver will not produce a result because it is not sent the provider metadata criterion.</li>
<li>I think it is fine for them to co-exist for both OP and RP, and they can choose which criterion to input.</li>
</ul></li>
<li>As both use the same key pairs, they both use the same <tt>oidc-credentials</tt> file. That file, or another the RP installs, needs to include the default client_secret credential for the RP.</li>
</ul></li>
<li>Hamronized all the properties. They are now the more generic variant from the OP e.g. <tt>shibboleth.oidc.DefaultSecurityConfiguration</tt> as opposed to <tt>shibboleth.authn.rp.oidc.DefaultSecurityConfiguration</tt>.
<ul>
<li>Sometimes this affects the OP e.g. <tt>idp.oidc.rodecrypt.config</tt> → <tt>idp.oidc.decrypt.config</tt></li>
</ul></li>
<li>Between the OP and the RP, the OIDC.SSO and AbstractOIDCSSOProfile **beans only overlap in one property setting; <tt>tokenEndpointAuthMethods</tt> . The OP uses this to describe what it supports. The RP uses it to determine which token authentication method to use when talking to the upstream OP. The other properties do not overlap, so it seems feasible to be able to set both on the same bean.</li>
<li>Both RP and OP use the <em>OIDC.Keyset</em> profile. Given the default security config can be shared, these are identical in both cases.
<ul>
<li>Of interest, both the RP and OP expose a keyset flow at different locations <tt>profile/oidc/rp/keyset</tt> and <tt>profile/oidc/keyset</tt>. I am not sure there is much point in having them separate if they, by default, share the same keys.
<ul>
<li>I am not sure what happens if you created your own relying party security config override and use different keys. The keyset flow will still point to the global ones (I digress)</li>
<li>Given the security config and basic profiles are inside oidc-commons, maybe commons could supply the keyset flow? which is enabled by the OP or RP on install in some way.</li>
</ul></li>
</ul></li>
<li>It seems a good idea (as Scott suggested) to have a generic oidc properties file, and separate ones for the RP and OP. Maybe commons could install the generic OIDC properties file? (this properties file is not be used by DuoOIDC of course, so that would look a bit messy if you only installed commons with Duo).</li>
</ul></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff"><script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/JCOMOIDC-48?inbox=true&focusedCommentId=34266&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-34266",
"name": "View Comment"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"><a href="https://shibboleth.atlassian.net/browse/JCOMOIDC-48#add-comment?atlOrigin=eyJpIjoiODI2Mzg1YWRhNmRhNGI0YjkyOWQ5MmQ5MzIwMGRjNmMiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-5cb0d393-19ec-47c0-a8f2-e7ea6cf0bb00" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a></td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"><a href="https://shibboleth.atlassian.net/browse/JCOMOIDC-48#add-comment?atlOrigin=eyJpIjoiODI2Mzg1YWRhNmRhNGI0YjkyOWQ5MmQ5MzIwMGRjNmMiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr> <!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px">Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none">iOS</a>
<hr></td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px">This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100214-<span title="634fa42673934690da187fee8282087cff56d9ec" data-commit-id="634fa42673934690da187fee8282087cff56d9ec}">sha1:634fa42</span>)</span></td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150"><img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-788b5564-44d5-40d4-930d-6485f16e7402" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table>
</body>
</html>