{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"4481edcb-c88e-466a-894c-1a87e3c22a0a"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"80ca381b-083f-4eb7-91a7-d92095300b31"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The \"basics\" of configuring security are covered under the ","type":"text"},{"text":"initial setup","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976#OIDCOP-KeyGeneration"}}]},{"text":" tab, with the generation of JWK keys to use and the import of ","type":"text"},{"text":"conf/oidc-credentials.xml","type":"text","marks":[{"type":"em"}]},{"text":" into ","type":"text"},{"text":"conf/credentials.xml","type":"text","marks":[{"type":"em"}]},{"text":" to auto-configure the new keys based on a set of properties.","type":"text"}]},{"type":"paragraph","content":[{"text":"The imported file configures the individual RSA and EC signing keys and an RSA decryption key in JWK format and creates a set of default beans that expose these keys to the rest of the system. The main feature of the XML file that would require editing is to support splitting the keys available to the OP from the keys actually published by the OP's discovery support. Much like in SAML, this allows keys to be rotated by publishing them ahead of use or supporting them ahead of publishing them, for signing and encryption respectively.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that while the JWK format includes certain required JSON fields such as a cryptographic algorithm to use with the credential, this is a broken design that Shibboleth ignores; the key is the key but the algorithm(s) used depend on other factors at runtime and there are usually multiple algorithms that can be used with a particular key.","type":"text"}]},{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"paragraph","content":[{"text":"Note that in most cases you MAY utilize the same keys for SAML and OIDC if you choose, and even mix and match the formats. The various list beans are what the underlying system runtime uses to identify keys, so it's possible to adjust those lists in the two XML files to rely on a single set of credential beans.","type":"text"}]},{"type":"paragraph","content":[{"text":"We don't particularly recommend this and default to separating them simply because the operational aspects of the two protocols are so different and the implications of a compromise so different that separating them is the safer course.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"The three properties (in ","type":"text"},{"text":"conf/oidc.properties","type":"text","marks":[{"type":"em"}]},{"text":") that load the default keys and their default values are:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.signing.oidc.rs.key","type":"text","marks":[{"type":"strong"}]},{"text":" - %{idp.home}/credentials/idp-signing-rs.jwk","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.signing.oidc.es.key","type":"text","marks":[{"type":"strong"}]},{"text":" -%{idp.home}/credentials/idp-signing-es.jwk","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.signing.oidc.rsa.enc.key","type":"text","marks":[{"type":"strong"}]},{"text":" - %{idp.home}/credentials/idp-encryption-rsa.jwk","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"You will find these properties used in ","type":"text"},{"text":"conf/oidc-credentials.xml","type":"text","marks":[{"type":"em"}]},{"text":" along with additional beans that reference these credentials in the various lists and additional commented beans that allow the use/publish distinction. In most cases you won't need to touch this very much.","type":"text"}]},{"type":"paragraph","content":[{"text":"The truly essential beans are:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.SigningCredentials","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.EncryptionCredentials","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"paragraph","content":[{"text":"These are lists that enumerate the actual keys the system will try to use at runtime.","type":"text"}]},{"type":"paragraph","content":[{"text":"In turn, you MAY define lists:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.EncryptionCredentialsToPublish","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.SigningCredentialsToPublish","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"paragraph","content":[{"text":"These control what discovery requests to the OP will see.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Advanced Examples","type":"text"}]},{"type":"paragraph","content":[{"text":"At a very high level there's a lot of overlap between the way security behavior can be customized for OIDC and the original IdP documentation on ","type":"text"},{"text":"SecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.shibboleth.net/confluence/display/IDP4/SecurityConfiguration"}}]},{"text":". However because the algorithms used are somewhat different, there are different underlying default beans used to control the behavior of the OIDC profile flows.","type":"text"}]},{"type":"paragraph","content":[{"text":"As an advanced example, the documentation and built-in defaults expect the EC key to be a 256-bit key that supports only a subset of possible signing algorithms. If you had a RP that required the ES512 algorith, a P-521 key would be needed, which you would need to generate and define in ","type":"text"},{"text":"conf/oidc-credentials.xml","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"conf/oidc-credentials.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"","type":"text"}]},{"type":"paragraph","content":[{"text":"Then you would need to define a new configuration bean and apply it to a RP profile in ","type":"text"},{"text":"conf/relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"conf/relying-party.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n \t\n\t\t \n \t\t \n \t\t \n\t\t \n \t\t\n\t \n\t\n\n\n\n \n \n \n \n \n","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Properties"},"marks":[{"type":"breakout","attrs":{"mode":"wide"}}],"content":[{"type":"paragraph","content":[{"text":"Security-related properties in ","type":"text"},{"text":"conf/oidc.properties","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"8dfd29ef-c8c6-44a4-a37f-c58a89820a7d"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[413.0]},"content":[{"type":"paragraph","content":[{"text":"Name / Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[141.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[427.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[413.0]},"content":[{"type":"paragraph","content":[{"text":"idp.signing.oidc.rs.key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[141.0]},"content":[{"type":"paragraph","content":[{"text":"JWK file pathname","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[427.0]},"content":[{"type":"paragraph","content":[{"text":"JWK RSA signing keypair","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[413.0]},"content":[{"type":"paragraph","content":[{"text":"idp.signing.oidc.es","type":"text","marks":[{"type":"link","attrs":{"href":"http://idp.signing.oidc.es"}}]},{"text":".key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[141.0]},"content":[{"type":"paragraph","content":[{"text":"JWK file pathname","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[427.0]},"content":[{"type":"paragraph","content":[{"text":"JWK EC signing keypair","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[413.0]},"content":[{"type":"paragraph","content":[{"text":"idp.signing.oidc.rsa.enc.key","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[141.0]},"content":[{"type":"paragraph","content":[{"text":"JWK file pathname","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[427.0]},"content":[{"type":"paragraph","content":[{"text":"JWK RSA decryption keypair","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[413.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.signing.config","type":"text"}]},{"type":"paragraph","content":[{"text":"shibboleth.oidc.SigningConfiguration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[141.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[427.0]},"content":[{"type":"paragraph","content":[{"text":"Allows override of default signing configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[413.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.encryption.config","type":"text"}]},{"type":"paragraph","content":[{"text":"shibboleth.oidc.EncryptionConfiguration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[141.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[427.0]},"content":[{"type":"paragraph","content":[{"text":"Allows override of default encryption configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[413.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.decryption.config","type":"text"}]},{"type":"paragraph","content":[{"text":"shibboleth.oidc.DecryptionConfiguration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[141.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[427.0]},"content":[{"type":"paragraph","content":[{"text":"Allows override of default decryption configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[413.0]},"content":[{"type":"paragraph","content":[{"text":"idp.oidc.validation.config","type":"text"}]},{"type":"paragraph","content":[{"text":"shibboleth.oidc.SignatureValidationConfiguration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[141.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[427.0]},"content":[{"type":"paragraph","content":[{"text":"Allows override of default signature validation configuration","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Beans"},"marks":[{"type":"breakout","attrs":{"mode":"wide"}}],"content":[{"type":"paragraph","content":[{"text":"Beans defined in ","type":"text"},{"text":"conf/oidc-credentials.xml","type":"text","marks":[{"type":"em"}]},{"text":" or internally for use in ","type":"text"},{"text":"conf/relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"2a59492a-37ff-4a52-acd9-f2e7894c01c7"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"Name / Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.JWKCredential","type":"text"}]},{"type":"paragraph","content":[{"text":"BasicJWKCredentialFactoryBean","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-op.cgi/net.shibboleth.idp.plugin.oidc.op.profile.spring.factory.BasicJWKCredentialFactoryBean"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Spring factory bean for easy definition of JWK-formatted credentials","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.DefaultRSSigningCredential","type":"text"}]},{"type":"paragraph","content":[{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Default RSA signing keypair used with OIDC","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.DefaultESSigningCredential","type":"text"}]},{"type":"paragraph","content":[{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Default EC signing keypair used with OIDC","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.DefaultRSAEncryptionCredential","type":"text"}]},{"type":"paragraph","content":[{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Default RSA decryption keypair used with OIDC","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.SigningCredentials","type":"text"}]},{"type":"paragraph","content":[{"text":"List","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List"}}]},{"text":"<","type":"text"},{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"List of signing keys available for use with OIDC","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.EncryptionCredentials","type":"text"}]},{"type":"paragraph","content":[{"text":"List","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List"}}]},{"text":"<","type":"text"},{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"List of encryption keys available for use in decryption with OIDC","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.SigningCredentialsToPublish","type":"text"}]},{"type":"paragraph","content":[{"text":"List","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List"}}]},{"text":"<","type":"text"},{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"List of signing keys to publish to RPs with OIDC","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.EncryptionCredentialsToPublish","type":"text"}]},{"type":"paragraph","content":[{"text":"List","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List"}}]},{"text":"<","type":"text"},{"text":"Credential","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.security.credential.Credential"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"List of encryption keys to publish to RPs with OIDC","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.DefaultSecurityConfiguration","type":"text"}]},{"type":"paragraph","content":[{"text":"JSONSecurityConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.oidc.profile.config.JSONSecurityConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Default security configuration used by all OIDC profile beans","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.SigningConfiguration","type":"text"}]},{"type":"paragraph","content":[{"text":"BasicSignatureSigningConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-oidc.cgi/net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Default signing behavior for OIDC profiles, auto-wires default algorithms and signing keys","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.SignatureValidationConfiguration","type":"text"}]},{"type":"paragraph","content":[{"text":"BasicSignatureValidationConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-oidc.cgi/net.shibboleth.oidc.security.jose.impl.BasicSignatureValidationConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Default signature validation behavior for validating JWTs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.EncryptionConfiguration","type":"text"}]},{"type":"paragraph","content":[{"text":"BasicEncryptionConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-oidc.cgi/net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Default encryption behavior for OIDC profiles, auto-wires default algorithms","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[518.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.oidc.DecryptionConfiguration","type":"text"}]},{"type":"paragraph","content":[{"text":"BasicDecryptionConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-oidc.cgi/net.shibboleth.oidc.security.jose.impl.BasicDecryptionConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[463.0]},"content":[{"type":"paragraph","content":[{"text":"Default decryption behavior for OIDC profiles","type":"text"}]}]}]}]}]},{"type":"paragraph"}],"version":1}

Browser not supported