This software is not yet released and this is preliminary documentaton subject to significant change. It should not be used in production or to protect important resources at this stage.
OIDCSettingsReference
Location: conf/sp/agents.xml, conf/sp/oidc.properties
The OIDC protocol plugin (“net.shibboleth.sp.shibd.oidc”) provides OIDC protocol support to the Hub. This is a full reference (with subtopics) to all the supplied features and how they may be referenced in the Hub configuration.
Most/all of these settings involve the various objects discussed in the AgentResolverServicedocumentation, with various global defaults established by properties in conf/sp/oidc.properties.
The plugin contributes Session Initiator and Token Consumer web flows plus supplemental web flows for other features and profiles, and OIDCProfileConfigurations for all the supported profiles implemented by them.
TODO; TOC
Web Flows
The following flows are provided.
Flow ID | Profile Config Bean | Description |
|---|---|---|
oidc/initiator/oidc | OIDC.SSO | Session Initiator flow for OIDC Browser SSO profile |
oidc/consumer/oidc/post | OIDC.SSO | Token Consumer flow for OIDC Browser SSO profile via the |
oidc/consumer/oidc/query | OIDC.SSO | Token Consumer flow for SAML 2 Browser SSO profile via the |
Customizing Flow Order
As with the SAML version, the relative precedence between plugins is controlled by an ordering property defined by each plugin, where lower values are evaluated first.
The OIDC property for this is sp.oidc.relativeOrder and defaults to 1.
Within the OIDC plugin, the default order of Token Consumers for Browser SSO is the order shown above in the table (post, query). While unlikely to be necessary, configuring or limiting this on an Agent/Application bean is supported via the tokenConsumers setting, and the values are specified after omitting the “sp/consumer/” prefix:
<bean p:id="localhost" parent="shibboleth.sp.Agent" p:tokenConsumers="#{{ 'oidc/post' }}" />Java Properties
The plugin adds conf/sp/oidc.properties to the configuration and the following properties are used to make global/default configuration of OIDC-enabled Agents easy to accomplish without XML. The properties are collected here into groups based on their general function and type.