...
Acknowledgement to DAASI: their OIDC back-channel logout propagation plugin was used as a basis for this implementation.
Refresh token extensions
TODO
Policies for dynamic registration and unregistered clients
The https://shibboleth.atlassian.net/wiki/x/AoC_rw used in dynamic client registration and for unregistered clients can now be extended with custom operators. A new metadata policy operator bean provides flexible means for validating incoming requests via fully customisable set of beans. See https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2948497410/OPMetadataPolicies#Custom-operators-4.1 for details.
Metadata-driven claim naming
TODO
Identifier configuration
TODO
Message logging improvements
TODO
New configuration options
TODOWe have refactored the refresh token encoding and decoding code and it’s now fully customisable. This advanced feature is provided via two new properties idp.oauth2.refreshToken.serializationStrategies and idp.oauth2.refreshToken.deserializers: those can be used for injecting any new methods refresh token types. We demonstrate this new functionality by supporting a new JWT refresh token type.
Policies for dynamic registration and unregistered clients
The https://shibboleth.atlassian.net/wiki/x/AoC_rw used in dynamic client registration and for unregistered clients can now be extended with custom operators. A new metadata policy operator bean provides flexible means for validating incoming requests via fully customisable set of beans. See https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/2948497410/OPMetadataPolicies#Custom-operators-4.1 for details.
Metadata-driven claim naming
The RP-specific claim names can now be configured in the metadata-driven fashion. See https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879159/OPAttributeResolution#SAML-metadata-driven-claim-name for more details.
Identifier configuration
The identifier generation configuration has been harmonised: a new configuration property (idp.oidc.xmlSafeIdentifiers) can be used to control whether to generate XML ID safe identifiers, which was previously always the case. If the property is set to false (default is true), the identifiers (such as JWT token IDs) won’t contain the _-prefix anymore and OP can for instance create UUIDv4 compatible identifiers if desired.
Message logging improvements
The request and response messages containing JSON structures are now pretty-printed on TRACE level. Also the JWT token payloads produced by the OP plugin are pretty-printed to the protocol message logs on that level.
New configuration properties
idp.oauth2.refreshToken.serializationStrategies: a custom bean reference containing the map of refresh token serialisation strategies, key refers to the refresh token type.
idp.oauth2.refreshToken.deserializers: a custom bean reference containing the list of refresh token deserialisers.
idp.oauth2.responseModes: a comma-separated list of allowed response modes. Empty by default which refers to no restrictions.
idp.oidc.xmlSafeIdentifiers: a flag to signal if XML ID safe identifiers should be used when generating identifiers.
New configuration beans
shibboleth.oidc.RevokeConsentPredicate: A predicate to signal if prior consents should be revoked.
shibboleth.oidc.UnregisteredClientPolicyValidator: A validator bean used for validating the configured policy for unregistered clients.
shibboleth.oidc.UnregisteredClientPolicyEnforcer: An enforcer bean used for enforcing policy for unregistered clients.
shibboleth.oidc.dynreg.ClientIDGenerationStrategy: An identifier generation strategy used for generating client IDs in dynamic client registration.
shibboleth.oidc.dynreg.ClientSecretGenerationStrategy: An identifier generation strategy used for generating client secrets in dynamic client registration.
shibboleth.oidc.dynreg.MetadataPolicyValidator: A validator bean used for validating the configured metadata policy in dynamic client registration.
shibboleth.oidc.dynreg.MetadataPolicyEnforcer: An enforcer bean used for enforcing metadata policy in dynamic client registration.
4.0.0 (September 14, 2023)
...
See OPCustomFilterRegistration .
New configuration properties
idp.oidc.DefaultUnregisteredPolicyFile - it defaults to %{idp.home}/conf/oidc-unregistered-client-policy.json. An example file is included in the distribution.
...
idp.oidc.ResponseHeaderFilter: It was related to the now removed custom response header filter
idp.oidc.refreshToken.defaultLifetime: already deprecated in version 3.3.0, use idp.oidc.refreshToken.defaultTimeout instead
New configuration beans
shibboleth.oidc.Conditions.MetadataValueEquals: a utility bean to be used for instance with activation conditions to match if a specific metadata claim contains a specific value
shibboleth.oidc.PlainRequestObjectClaimsValidation: If defined, it will be used for the validation of unsigned request objects
shibboleth.oidc.SignedRequestObjectClaimsValidation: If defined, it will be used for the validation of signed request objects
...