[java-idp-oidc] 21/44: JOIDC-5 Initial version for find client secret value via keys.
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Oct 22 13:08:33 UTC 2020
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e36bb43fa02d52996ef8a51ee30bc742379fd92f
commit e36bb43fa02d52996ef8a51ee30bc742379fd92f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jun 5 16:42:34 2020 +0300
JOIDC-5 Initial version for find client secret value via keys.
https://issues.shibboleth.net/jira/browse/JOIDC-5
---
.../provider/ClientSecretReferenceProvider.java | 118 +++++++++++++++++++++
.../criterion/ClientSecretReferenceCriterion.java | 86 +++++++++++++++
2 files changed, 204 insertions(+)
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/keyinfo/ext/impl/provider/ClientSecretReferenceProvider.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/keyinfo/ext/impl/provider/ClientSecretReferenceProvider.java
new file mode 100644
index 00000000..1348c64d
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/keyinfo/ext/impl/provider/ClientSecretReferenceProvider.java
@@ -0,0 +1,118 @@
+/*
+ * Copyright (c) 2017 - 2020, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an “AS IS” BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.geant.idpextension.keyinfo.ext.impl.provider;
+
+import java.util.Collection;
+import java.util.Collections;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.geant.idpextension.oidc.criterion.ClientSecretReferenceCriterion;
+import org.geant.idpextension.oidc.metadata.resolver.ClientSecretValueResolver;
+import org.geant.security.jwk.BasicNimbusSecretCredential;
+import org.geant.security.jwk.NimbusSecretCredential;
+import org.opensaml.core.xml.XMLObject;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
+import org.opensaml.xmlsec.keyinfo.impl.KeyInfoResolutionContext;
+import org.opensaml.xmlsec.keyinfo.impl.provider.AbstractKeyInfoProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.oauth2.sdk.auth.Secret;
+
+import net.shibboleth.idp.saml.oidc.xmlobject.ClientSecretReferenceKey;
+import net.shibboleth.utilities.java.support.collection.LazySet;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * Implementation of {@link org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider} which provides basic support for
+ * extracting a {@link NimbusSecretCredential} child of KeyInfo. The values are resolved using the given
+ * collection of {@link ClientSecretValueResolver}s.
+ */
+public class ClientSecretReferenceProvider extends AbstractKeyInfoProvider {
+
+ /** Class logger. */
+ private final Logger log = LoggerFactory.getLogger(ClientSecretReferenceProvider.class);
+
+ /** The list of resolvers for resolving the values for client secrets. */
+ private Collection<ClientSecretValueResolver> clientSecretValueResolvers;
+
+ /**
+ * Constructor.
+ *
+ * @param valueResolvers The list of resolvers for resolving the values for client secrets.
+ */
+ public ClientSecretReferenceProvider(final Collection<ClientSecretValueResolver> valueResolvers) {
+ clientSecretValueResolvers =
+ Constraint.isNotEmpty(valueResolvers, "The client secret value resolvers cannot be empty");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Collection<Credential> process(KeyInfoCredentialResolver resolver, XMLObject keyInfoChild,
+ CriteriaSet criteriaSet, KeyInfoResolutionContext kiContext) throws SecurityException {
+ final ClientSecretReferenceKey clientSecretReference = getClientSecret(keyInfoChild);
+ if (clientSecretReference == null || StringSupport.trimOrNull(clientSecretReference.getValue()) == null) {
+ log.debug("No value found for the ClientSecretReferenceKey element");
+ return null;
+ }
+ final String secretReference = clientSecretReference.getValue();
+ for (final ClientSecretValueResolver valueResolver : clientSecretValueResolvers) {
+ log.trace("Attempting to resolve value for {} with {}", secretReference, valueResolver.getId());
+ final CriteriaSet criteria = new CriteriaSet(new ClientSecretReferenceCriterion(secretReference));
+ try {
+ final String value = valueResolver.resolveSingle(criteria);
+ if (value != null) {
+ log.debug("Found value for {} with {}", secretReference, valueResolver.getId());
+ final LazySet<Credential> credentials = new LazySet<>();
+ credentials.add(new BasicNimbusSecretCredential(new Secret(value)));
+ return credentials;
+ }
+ } catch (ResolverException e) {
+ log.warn("Client secret value resolution failed", e);
+ }
+ }
+ log.warn("No values could be resolved for the client secret reference {}", clientSecretReference.getValue());
+ return Collections.emptySet();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean handles(XMLObject keyInfoChild) {
+ return getClientSecret(keyInfoChild) != null;
+ }
+
+ /**
+ * Get the ClientSecretReferenceKey from the passed XML object.
+ *
+ * @param xmlObject an XML object, presumably a {@link ClientSecretReferenceKey}
+ * @return the ClientSecret which was found, or null if none
+ */
+ @Nullable protected ClientSecretReferenceKey getClientSecret(@Nonnull final XMLObject xmlObject) {
+
+ if (xmlObject instanceof ClientSecretReferenceKey) {
+ return (ClientSecretReferenceKey) xmlObject;
+ } else {
+ return null;
+ }
+ }
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/criterion/ClientSecretReferenceCriterion.java b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/criterion/ClientSecretReferenceCriterion.java
new file mode 100644
index 00000000..77cbb0bc
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/criterion/ClientSecretReferenceCriterion.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2017 - 2020, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an “AS IS” BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.geant.idpextension.oidc.criterion;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.Criterion;
+
+/**
+ * A {@link Criterion} representing a reference to a client secret.
+ */
+public class ClientSecretReferenceCriterion implements Criterion {
+
+ /** The client secret reference. */
+ @Nonnull @NotEmpty private final String secretReference;
+
+ /**
+ * Constructor.
+ *
+ * @param reference The client secret reference.
+ */
+ public ClientSecretReferenceCriterion(@Nonnull @NotEmpty final String reference) {
+ secretReference = Constraint.isNotEmpty(reference, "The client secret reference cannot be empty");
+ }
+
+ /**
+ * Get the client secret reference.
+ *
+ * @return The client secret reference.
+ */
+ @Nonnull @NotEmpty public String getSecretReference() {
+ return secretReference;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String toString() {
+ final StringBuilder builder = new StringBuilder();
+ builder.append("ClientSecretReferenceCriterion [secretReference=");
+ builder.append(secretReference);
+ builder.append("]");
+ return builder.toString();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int hashCode() {
+ return secretReference.hashCode();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean equals(final Object obj) {
+ if (this == obj) {
+ return true;
+ }
+
+ if (obj == null) {
+ return false;
+ }
+
+ if (obj instanceof String) {
+ return secretReference.equals((String) obj);
+ }
+
+ return false;
+ }
+
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list