[java-idp-oidc] 05/06: JOIDC-5 Code and javadoc improvements.
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Jun 26 13:31:04 UTC 2020
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch dev/JOIDC-5
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=b86f0d37150e7c20035d053f7f136817d5f0173c
commit b86f0d37150e7c20035d053f7f136817d5f0173c
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jun 26 16:29:47 2020 +0300
JOIDC-5 Code and javadoc improvements.
https://issues.shibboleth.net/jira/browse/JOIDC-5
---
.../impl/ClientInformationNodeProcessor.java | 187 +++++++++++++++++----
1 file changed, 155 insertions(+), 32 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessor.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessor.java
index f7036615..7058db8b 100644
--- a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessor.java
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/metadata/impl/ClientInformationNodeProcessor.java
@@ -19,10 +19,13 @@ package org.geant.idpextension.oidc.metadata.impl;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.ArrayList;
+import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.xml.namespace.QName;
import org.geant.idpextension.oidc.config.OIDCCoreProtocolConfiguration;
@@ -85,16 +88,15 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
private final Logger log = LoggerFactory.getLogger(ClientInformationNodeProcessor.class);
/** The {@link KeyInfoCredentialResolver} to be used for the resolution. */
- private KeyInfoCredentialResolver keyInfoCredentialResolver;
+ private final @Nonnull KeyInfoCredentialResolver keyInfoCredentialResolver;
/**
* Constructor.
*
* @param keyInfoProviders The list of key info providers.
*/
- public ClientInformationNodeProcessor(final List<KeyInfoProvider> keyInfoProviders) {
+ public ClientInformationNodeProcessor(@Nonnull final List<KeyInfoProvider> keyInfoProviders) {
keyInfoCredentialResolver = new BasicProviderKeyInfoCredentialResolver(keyInfoProviders);
-
}
/** {@inheritDoc} */
@@ -126,7 +128,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param roleDescriptor The {@link SPSSODescriptor} to be used as a source.
* @return The entityID value as {@link ClientID}.
*/
- protected ClientID parseClientID(final SPSSODescriptor roleDescriptor) {
+ protected @Nullable ClientID parseClientID(final @Nonnull SPSSODescriptor roleDescriptor) {
if (!roleDescriptor.hasParent() || !(roleDescriptor.getParent() instanceof EntityDescriptor)) {
log.warn("Unexpected structure, EntityDescriptor not as a parent for OAuthRPRoleDescriptor");
return null;
@@ -142,7 +144,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param credentials The source set of {@link Credential}s.
* @return The client secret as {@link Secret}.
*/
- protected Secret parseClientSecret(final Iterable<Credential> credentials) {
+ protected @Nullable Secret parseClientSecret(final @Nonnull Iterable<Credential> credentials) {
for (final Credential credential : credentials) {
log.trace("Processing credential type {}", credential.getCredentialType());
if (NimbusSecretCredential.class.isAssignableFrom(credential.getCredentialType())) {
@@ -163,8 +165,8 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param clientId The client ID.
* @return The {@link OIDCClientMetadata} parsed from the given parameters.
*/
- protected OIDCClientMetadata populateMetadata(final SPSSODescriptor roleDescriptor,
- final Iterable<Credential> credentials, final String clientId) {
+ protected @Nonnull OIDCClientMetadata populateMetadata(final @Nonnull SPSSODescriptor roleDescriptor,
+ final @Nonnull Iterable<Credential> credentials, final @Nonnull String clientId) {
final OIDCClientMetadata metadata = new OIDCClientMetadata();
final OAuthRPExtensions extensions = getOAuthRPExtensions(roleDescriptor);
if (extensions != null) {
@@ -209,11 +211,12 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
}
/**
+ * Get the {@link OAuthRPExtensions} from the given {@link SPSSODescriptor}, it it was found from its extensions.
*
- * @param roleDescriptor
- * @return
+ * @param roleDescriptor The role descriptor to get the extensions from.
+ * @return The extensions, if they were found from the role descriptor. <code>null</code> otherwise.
*/
- protected OAuthRPExtensions getOAuthRPExtensions(final SPSSODescriptor roleDescriptor) {
+ protected @Nullable OAuthRPExtensions getOAuthRPExtensions(final SPSSODescriptor roleDescriptor) {
final Extensions extensions = roleDescriptor.getExtensions();
if (extensions == null) {
log.debug("No extensions found from the given SPSSODescriptor");
@@ -235,11 +238,19 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return null;
}
- protected Iterable<Credential> resolveCredentials(final SPSSODescriptor roleDescriptor) {
+ /**
+ * Get all the credentials attached to the given {@link SPSSODescriptor}. They are resolved using the
+ * {@link #keyInfoCredentialResolver}.
+ *
+ * @param roleDescriptor The role descriptor to parse the credentials from.
+ * @return All the resolved credentials. Or empty set if none was found.
+ */
+ protected @Nonnull Iterable<Credential> resolveCredentials(final SPSSODescriptor roleDescriptor) {
final MetadataCredentialResolver credentialResolver = new MetadataCredentialResolver();
credentialResolver.setKeyInfoCredentialResolver(keyInfoCredentialResolver);
credentialResolver.setRoleDescriptorResolver(new RoleDescriptorResolver() {
+ /** {@inheritDoc} */
@Override
public Iterable<RoleDescriptor> resolve(CriteriaSet criteria) throws ResolverException {
final ArrayList<RoleDescriptor> result = new ArrayList<>();
@@ -247,21 +258,25 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return result;
}
+ /** {@inheritDoc} */
@Override
public RoleDescriptor resolveSingle(CriteriaSet criteria) throws ResolverException {
return roleDescriptor;
}
+ /** {@inheritDoc} */
@Override
public String getId() {
return "EmbeddedLocalRoleDescriptorResolver";
}
+ /** {@inheritDoc} */
@Override
public boolean isRequireValidMetadata() {
return false;
}
+ /** {@inheritDoc} */
@Override
public void setRequireValidMetadata(boolean requireValidMetadata) {
// no op
@@ -282,10 +297,18 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
} catch (ResolverException e) {
log.warn("Could not resolve credentials", e);
}
- return null;
+ return Collections.emptySet();
}
- protected JWKSet parseJwkSet(final Iterable<Credential> credentials, final String clientId) {
+ /**
+ * Convert the given credentials into the Nimbus {@link JWKSet}.
+ *
+ * @param credentials The set to be converted.
+ * @param clientId The client ID related to the credentials.
+ * @return The given credentials converted into a JWKSet.
+ */
+ protected @Nullable JWKSet parseJwkSet(final @Nonnull Iterable<Credential> credentials,
+ final @Nonnull String clientId) {
final List<JWK> jwks = new ArrayList<>();
for (final Credential credential : credentials) {
final JWK jwk = CredentialConversionUtil.credentialToKey(credential);
@@ -299,7 +322,15 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return jwks.isEmpty() ? null : new JWKSet(jwks);
}
- protected List<MetadataValueSAMLObject> getFromExtensions(final Extensions extension, final QName type) {
+ /**
+ * Get all objects of the given type from the given extensions.
+ *
+ * @param extension The extensions to get the object from.
+ * @param type The type of the objects to get.
+ * @return The list of objects of the given type.
+ */
+ protected @Nonnull List<MetadataValueSAMLObject> getFromExtensions(final @Nonnull Extensions extension,
+ final @Nonnull QName type) {
final List<XMLObject> list = extension.getUnknownXMLObjects(type);
final List<MetadataValueSAMLObject> result = new ArrayList<>();
for (final XMLObject object : list) {
@@ -310,7 +341,14 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return result;
}
- protected ClientAuthenticationMethod parseClientAuthenticationMethod(final OAuthRPExtensions extensions) {
+ /**
+ * Parse the {@link ClientAuthenticationMethod} from the given extensions.
+ *
+ * @param extensions The extensions to parse from.
+ * @return The client authentication method, or <code>null</code> it was not found.
+ */
+ protected @Nullable ClientAuthenticationMethod parseClientAuthenticationMethod(
+ final @Nonnull OAuthRPExtensions extensions) {
final String metadataValue = getSingleValue(extensions.getTokenEndpointAuthMethod());
if (metadataValue == null) {
return null;
@@ -318,7 +356,14 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return ClientAuthenticationMethod.parse(metadataValue);
}
- protected ApplicationType parseApplicationType(final OAuthRPExtensions extensions) {
+ /**
+ * Parse the {@link ApplicationType} from the given extensions.
+ *
+ * @param extensions The extensions to parse from.
+ * @return {@link ApplicationType#NATIVE} if it was defined in the extensions, {@link ApplicationType#WEB}
+ * otherwise.
+ */
+ protected @Nonnull ApplicationType parseApplicationType(final @Nonnull OAuthRPExtensions extensions) {
final String metadataValue = getSingleValue(extensions.getApplicationType());
if (ApplicationType.NATIVE.toString().equalsIgnoreCase(metadataValue)) {
return ApplicationType.NATIVE;
@@ -326,7 +371,15 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return ApplicationType.WEB;
}
- protected SubjectType parseSubjectType(final SPSSODescriptor roleDescriptor) {
+ /**
+ * Parse the {@link SubjectType} from the given role descriptor's name ID formats.
+ *
+ * @param roleDescriptor The role descriptor to parse from. Only the first nameID definition is taken into
+ * consideration.
+ * @return {@link SubjectType#PAIRWISE} if <code>pairwise</code> was defined as the name ID format.
+ * {@link SubjectType#PUBLIC} otherwise.
+ */
+ protected @Nonnull SubjectType parseSubjectType(final @Nonnull SPSSODescriptor roleDescriptor) {
final List<NameIDFormat> nameIdFormats = roleDescriptor.getNameIDFormats();
if (nameIdFormats == null || nameIdFormats.isEmpty()) {
log.warn("No NameIDFormat defined, using public");
@@ -342,7 +395,13 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return SubjectType.PUBLIC;
}
- protected List<ACR> parseDefaultAcrValues(final OAuthRPExtensions extensions) {
+ /**
+ * Parse the default {@link ACR} values from the given extensions.
+ *
+ * @param extensions The extensions to parse from.
+ * @return The list of ACR values that were found.
+ */
+ protected @Nonnull List<ACR> parseDefaultAcrValues(final @Nonnull OAuthRPExtensions extensions) {
final List<ACR> acrs = new ArrayList<>();
for (final DefaultAcrValue acr : extensions.getDefaultAcrValues()) {
final String value = getSingleValue(acr);
@@ -353,7 +412,13 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return acrs;
}
- protected Set<GrantType> parseGrantTypes(final OAuthRPExtensions extensions) {
+ /**
+ * Parse the {@link GrantType}s from the given extensions.
+ *
+ * @param extensions The extensions to parse from.
+ * @return The set of grant types that were found.
+ */
+ protected @Nonnull Set<GrantType> parseGrantTypes(final @Nonnull OAuthRPExtensions extensions) {
final Set<GrantType> grantTypes = new HashSet<>();
for (final net.shibboleth.idp.saml.oidc.xmlobject.GrantType grantType : extensions.getGrantTypes()) {
final String value = getSingleValue(grantType);
@@ -364,7 +429,13 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return grantTypes;
}
- protected Set<ResponseType> parseResponseTypes(final OAuthRPExtensions extensions) {
+ /**
+ * Parse the {@link ResponseType}s from the given extensions.
+ *
+ * @param extensions The extensions to parse from.
+ * @return The set of response types that were found.
+ */
+ protected @Nonnull Set<ResponseType> parseResponseTypes(final @Nonnull OAuthRPExtensions extensions) {
final Set<ResponseType> responseTypes = new HashSet<>();
for (final net.shibboleth.idp.saml.oidc.xmlobject.ResponseType responseType : extensions.getResponseTypes()) {
final String value = getSingleValue(responseType);
@@ -375,7 +446,13 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return responseTypes;
}
- protected Scope parseScope(final OAuthRPExtensions extensions) {
+ /**
+ * Parse the {@link Scope} from the given extensions.
+ *
+ * @param extensions The extensions to parse from.
+ * @return The scope that was found.
+ */
+ protected @Nonnull Scope parseScope(final @Nonnull OAuthRPExtensions extensions) {
final Scope scope = new Scope();
for (final net.shibboleth.idp.saml.oidc.xmlobject.Scope singleScope : extensions.getScopes()) {
final String value = getSingleValue(singleScope);
@@ -383,13 +460,16 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
scope.add(value);
}
}
- if (!scope.contains("openid")) {
- scope.add("openid");
- }
return scope;
}
- protected JWEAlgorithm parseJweAlgorithm(final MetadataValueSAMLObject metadataValue) {
+ /**
+ * Parse the {@link JWEAlgorithm} from the given metadata value.
+ *
+ * @param metadataValue The metadata value to parse from.
+ * @return The JWE algorithm, or <code>null</code> if no value was found.
+ */
+ protected @Nullable JWEAlgorithm parseJweAlgorithm(final @Nullable MetadataValueSAMLObject metadataValue) {
final String value = getSingleValue(metadataValue);
if (value != null) {
return new JWEAlgorithm(value);
@@ -397,7 +477,13 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return null;
}
- protected JWSAlgorithm parseJwsAlgorithm(final MetadataValueSAMLObject metadataValue) {
+ /**
+ * Parse the {@link JWSAlgorithm} from the given metadata value.
+ *
+ * @param metadataValue The metadata value to parse from.
+ * @return The JWS algorithm, or <code>null</code> if no value was found.
+ */
+ protected @Nullable JWSAlgorithm parseJwsAlgorithm(final @Nullable MetadataValueSAMLObject metadataValue) {
final String value = getSingleValue(metadataValue);
if (value != null) {
return new JWSAlgorithm(value);
@@ -405,7 +491,13 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return null;
}
- protected EncryptionMethod parseEncryptionMethod(final MetadataValueSAMLObject metadataValue) {
+ /**
+ * Parse the {@link EncryptionMethod} from the given metadata value.
+ *
+ * @param metadataValue The metadata value to parse from.
+ * @return The encryption method, or <code>null</code> if no value was found.
+ */
+ protected @Nullable EncryptionMethod parseEncryptionMethod(final @Nullable MetadataValueSAMLObject metadataValue) {
final String value = getSingleValue(metadataValue);
if (value != null) {
return new EncryptionMethod(value);
@@ -413,7 +505,14 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return null;
}
- protected Set<URI> parseRedirectUris(final SPSSODescriptor roleDescriptor) {
+ /**
+ * Parse the redirection URIs from the given role descriptor. Only the assertion consumer service URLs whose
+ * binding matches to {@link OIDCCoreProtocolConfiguration#PROFILE_ID} are taken into consideration.
+ *
+ * @param roleDescriptor The role descriptor to parse from.
+ * @return The set of redirection URIs that were successfully parsed.
+ */
+ protected @Nonnull Set<URI> parseRedirectUris(final @Nonnull SPSSODescriptor roleDescriptor) {
final Set<URI> uris = new HashSet<>();
for (final AssertionConsumerService acs : roleDescriptor.getAssertionConsumerServices()) {
if (OIDCCoreProtocolConfiguration.PROFILE_ID.equals(acs.getBinding())) {
@@ -426,7 +525,13 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return uris;
}
- protected Set<URI> parseUris(final List<? extends MetadataValueSAMLObject> listOfValues) {
+ /**
+ * Parse the URIs from the given list of metadata values.
+ *
+ * @param listOfValues The list to parse from.
+ * @return Set of URIs that were successfully parsed from the list.
+ */
+ protected @Nonnull Set<URI> parseUris(final @Nonnull List<? extends MetadataValueSAMLObject> listOfValues) {
final Set<URI> uris = new HashSet<>();
for (final MetadataValueSAMLObject value : listOfValues) {
final URI uri = getSingleURIValue(value);
@@ -437,18 +542,36 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return uris;
}
- protected String getSingleValue(final MetadataValueSAMLObject metadataValue) {
+ /**
+ * Gets the trimmed {@link String} value from the given metadata value object.
+ *
+ * @param metadataValue The object to get the value from.
+ * @return The value as trimmed value, or <code>null</code> if no value was found.
+ */
+ protected @Nullable String getSingleValue(final @Nullable MetadataValueSAMLObject metadataValue) {
if (metadataValue != null) {
return StringSupport.trimOrNull(metadataValue.getValue());
}
return null;
}
- protected URI getSingleURIValue(final MetadataValueSAMLObject metadataValue) {
+ /**
+ * Converts the metadata value object value into a {@link URI}.
+ *
+ * @param metadataValue The metadata object value to convert from.
+ * @return The value as URI if it was successfully parsed, <code>null</code> otherwise.
+ */
+ protected @Nullable URI getSingleURIValue(final @Nonnull MetadataValueSAMLObject metadataValue) {
return getSingleURIValue(getSingleValue(metadataValue));
}
- protected URI getSingleURIValue(final String value) {
+ /**
+ * Converts the given {@link String} into a {@link URI}.
+ *
+ * @param value The raw string value.
+ * @return The value as URI if it was successfully parsed, <code>null</code> otherwise.
+ */
+ protected @Nullable URI getSingleURIValue(final @Nullable String value) {
if (value != null) {
try {
return new URI(value);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list