Page Comparison

You can reference a JWKS (as in the other JWKS example) remotely via a URI. This is analagous to a rarely used (because of security, obviously) technique of remotely referencing certificates.

<md:KeyDescriptor>
    <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:KeyName>mockJwkId</ds:KeyName>
        <oidcmd:JwksUri>https://example.org/jwks</oidcmd:JwksUri>
	</ds:KeyInfo>
</md:KeyDescriptor>

Support also exists for indirectly referencing client secrets and resolving them at runtime separately. The metadata syntax is simply:

<md:KeyDescriptor>
    <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <oidcmd:ClientSecretKeyReference>secretReference1</oidcmd:ClientSecretKeyReference>
	</ds:KeyInfo>
</md:KeyDescriptor>

The reference string is just a label that has to correspond to some external source.

Actually resolving secrets by reference requires one or more resolution beans be supplied in a list named shibboleth.oidc.ClientSecretValueResolvers, which does not exist by default.

There are two built-in types of resolvers.

Property-Based Resolution

Client secrets can be placed in a Java properties file (the keys are the labels used in the metadata reference and the values are the secrets). You can supply any number of such sources in the resolver list, generally in conf/global.xml. Each source is defined using a parent bean named shibboleth.oidc.PropertiesClientSecretValueResolver:

<util:list id="shibboleth.oidc.ClientSecretValueResolvers">
	<bean parent="shibboleth.oidc.PropertiesClientSecretValueResolver"
		p:resource="%{idp.home}/credentials/client-secrets.properties" />
</util:list>

Attribute Resolver Resolution

A "generic" solution to resolving secrets is provided by means of leveraging the AttributeResolver to resolve the secret. The parent bean named shibboleth.oidc.ResolverServiceClientSecretValueResolver along with a set of attribute IDs will invoke the resolver and attempt to find a string value amongst them to return. During the resolution process, the "principal" variable is populated with the client secret reference label.

<util:list id="shibboleth.oidc.ClientSecretValueResolvers">
	<bean parent="shibboleth.oidc.ResolverServiceClientSecretValueResolver"
		p:attributeIds="ClientSecretAttribute" />
</util:list>

To simplify the configuration of the resolver, you may conditionalize connectors by attaching a resolutionPhases attribute set to "ResolverServiceClientSecretValueResolver", causing them to run only during this special case. You can also set excludeResolutionPhases to invert the check for other connectors.