Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
languagexml
titleconf/relying-party.xml
collapsetrue
<bean id="SpecialSecurityConfig" parent="shibboleth.oidc.DefaultSecurityConfiguration">
	<property name="signatureSigningConfiguration">
    	<bean parent="shibboleth.BasicSignatureSigningConfiguration"
			p:signingCredentials-ref="shibboleth.oidc.SpecialSigningCredential">
		        <property name="signatureAlgorithms">
        		    <list>
        		        <util:constant static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_512" />
		            </list>
        		</property>
	    </bean>
	</property>
</bean>

<bean parent="RelyingPartyByName" c:relyingPartyIds="https://needy.rp.example.org">
    <property name="profileConfigurations">
        <list>
            <bean parent="OIDC.SSO" p:securityConfiguration-ref="SpecialSecurityConfig" />
        </list>
    </property>
</bean>

Reference

Localtabgroup
Localtab
activetrue
Expand
titleProperties

Security-related properties in conf/oidc.properties:

NameTypeDefaultDescription
idp.signing.oidc.rs.keyJWK file pathname
JWK RSA signing keypair
idp.signing.oidc.es.keyJWK file pathname
JWK EC signing keypair
idp.signing.oidc.rsa.enc.keyJWK file pathname
JWK RSA decryption keypair
idp.oidc.signing.configBean IDshibboleth.oidc.SigningConfigurationAllows override of default signing configuration
idp.oidc.encryption.configBean IDshibboleth.oidc.EncryptionConfigurationAllows override of default encryption configuration
idp.oidc.rodecrypt.configBean IDshibboleth.oidc.requestObjectDecryptionConfigurationAllows override of default request decryption configuration
idp.oidc.rovalid.configBean IDshibboleth.oidc.requestObjectSignatureValidationConfigurationAllows override of default request signature validation configuration
idp.oidc.rovalid.configBean IDshibboleth.oidc.tokenEndpointJwtSignatureValidationConfigurationAllows override of default JWT token validation configuration
localtab



Expand
titleBeans

Beans defined in conf/oidc-credentials.xml or internally for use in conf/relying-party.xml:

Name / TypeDescription

shibboleth.JWKCredential

net.shibboleth.idp.plugin.oidc.op.profile.spring.factory.BasicJWKCredentialFactoryBean

Spring factory bean for easy definition of JWK-formatted credentials

shibboleth.oidc.DefaultRSSigningCredential

Credential

Default RSA signing keypair used with OIDC

shibboleth.oidc.DefaultESSigningCredential

Credential

Default EC signing keypair used with OIDC

shibboleth.oidc.DefaultRSAEncryptionCredential

Credential

Default RSA decryption keypair used with OIDC

shibboleth.oidc.SigningCredentials

List<Credential>

List of signing keys available for use with OIDC

shibboleth.oidc.EncryptionCredentials

List<Credential>

List of encryption keys available for use in decryption with OIDC

shibboleth.oidc.SigningCredentialsToPublish

List<Credential>

List of signing keys to publish to RPs with OIDC

shibboleth.oidc.EncryptionCredentialsToPublish

List<Credential>

List of encryption keys to publish to RPs with OIDC

shibboleth.oidc.DefaultSecurityConfiguration

SecurityConfiguration

Default security configuration used by all OIDC profile beans

shibboleth.oidc.SigningConfiguration

BasicSignatureSigningConfiguration

Default signing behavior for OIDC profiles, auto-wires default algorithms and signing keys

shibboleth.oidc.EncryptionConfiguration

EncryptionConfiguration

Default encryption behavior for OIDC profiles, auto-wires default algorithms

shibboleth.oidc.requestObjectDecryptionConfiguration

EncryptionConfiguration

Default decryption behavior for OIDC request decryption

shibboleth.oidc.requestObjectSignatureValidationConfiguration

BasicSignatureSigningConfiguration

Default signature validation behavior for OIDC request signatures

shibboleth.oidc.tokenEndpointJwtSignatureValidationConfiguration

BasicSignatureSigningConfiguration

Default signature validation behavior for validating JWTs used as endpoint credentials