[java-oidc-common] branch main updated: Add missing profile configurations.
Scott Cantor
cantor.2 at osu.edu
Tue Dec 7 13:46:33 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=3df3c9e465873a40867678062708433a8a4a31cd
The following commit(s) were added to refs/heads/main by this push:
new 3df3c9e Add missing profile configurations.
3df3c9e is described below
commit 3df3c9e465873a40867678062708433a8a4a31cd
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 7 08:46:31 2021 -0500
Add missing profile configurations.
---
.../OIDCDynamicRegistrationConfiguration.java | 182 +++++++++++++++++++++
.../OIDCProviderInformationConfiguration.java | 88 ++++++++++
.../config/OIDCPublishKeySetConfiguration.java | 54 ++++++
.../profile/config/OIDCUserInfoConfiguration.java | 147 +++++++++++++++++
4 files changed, 471 insertions(+)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
new file mode 100644
index 0000000..c14e73b
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
@@ -0,0 +1,182 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import java.time.Duration;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+
+/**
+ * Profile configuration for the OpenID Connect dynamic client registration.
+ */
+public class OIDCDynamicRegistrationConfiguration extends AbstractOIDCFlowAwareProfileConfiguration
+ implements OverriddenIssuerProfileConfiguration {
+
+ /** OIDC base protocol URI. */
+ public static final String PROTOCOL_URI = "https://openid.net/specs/openid-connect-registration-1_0.html";
+
+ /** ID for this profile configuration. */
+ public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/registration";
+
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
+ /** Lookup function to supply registration validity period. */
+ @Nonnull private Function<ProfileRequestContext,Duration> registrationValidityPeriodLookupStrategy;
+
+ /** Lookup function to supply client secret expiration period. */
+ @Nullable private Function<ProfileRequestContext,Duration> secretExpirationPeriodLookupStrategy;
+
+ /**
+ * Constructor.
+ */
+ public OIDCDynamicRegistrationConfiguration() {
+ this(PROFILE_ID);
+ }
+
+ /**
+ * Creates a new configuration instance.
+ *
+ * @param profileId Unique profile identifier.
+ */
+ public OIDCDynamicRegistrationConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+ issuerLookupStrategy = FunctionSupport.constant(null);
+ setRegistrationValidityPeriod(Duration.ofHours(24));
+ setSecretExpirationPeriod(Duration.ofDays(365));
+ }
+
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set overridden issuer value.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ issuerLookupStrategy = FunctionSupport.constant(issuer);
+ }
+
+ /**
+ * Sets lookup strategy for overridden issuer value.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
+ /**
+ * Get dynamic registration validity period.
+ *
+ * <p>A null or 0 is interpreted as an unlimited period.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return dynamic registration validity period
+ */
+ @Nullable @NonNegative
+ public Duration getRegistrationValidityPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
+
+ final Duration period = registrationValidityPeriodLookupStrategy.apply(profileRequestContext);
+
+ Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
+ return period;
+ }
+
+ /**
+ * Sets the registration validity period.
+ *
+ * <p>A null or 0 is interpreted as an unlimited period.</p>
+ *
+ * @param period registration validity period
+ */
+ public void setRegistrationValidityPeriod(@Nullable @NonNegative final Duration period) {
+ Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
+
+ registrationValidityPeriodLookupStrategy = FunctionSupport.constant(period);
+ }
+
+ /**
+ * Set a lookup strategy for the registration validity period.
+ *
+ * <p>A null or 0 is interpreted as an unlimited period.</p>
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRegistrationValidityPeriodLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
+ registrationValidityPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Get client secret expiration period.
+ *
+ * <p>A null or 0 is interpreted as an unlimited period.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return client secret expiration period
+ */
+ @Nullable @NonNegative
+ public Duration getSecretExpirationPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Duration period = secretExpirationPeriodLookupStrategy.apply(profileRequestContext);
+
+ Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
+ return period;
+ }
+
+ /**
+ * Sets the client secret expiration period.
+ *
+ * <p>A null or 0 is interpreted as an unlimited period.</p>
+ *
+ * @param period registration validity period
+ */
+ public void setSecretExpirationPeriod(@Nullable @NonNegative final Duration period) {
+ Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
+
+ secretExpirationPeriodLookupStrategy = FunctionSupport.constant(period);
+ }
+
+ /**
+ * Set a lookup strategy for the client secret expiration period.
+ *
+ * <p>A null or 0 is interpreted as an unlimited period.</p>
+ *
+ * @param strategy lookup strategy
+ */
+ public void setSecretExpirationPeriodLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
+ secretExpirationPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
new file mode 100644
index 0000000..00eb158
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+
+/**
+ * Profile configuration for the OpenID Connect Provider Configuration.
+ */
+public class OIDCProviderInformationConfiguration extends AbstractConditionalProfileConfiguration
+ implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration {
+
+ /** OIDC base protocol URI. Section 4 is relevant. */
+ public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-discovery-1_0.html";
+
+ /** ID for this profile configuration. */
+ public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/configuration";
+
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
+ /**
+ * Constructor.
+ */
+ public OIDCProviderInformationConfiguration() {
+ this(PROFILE_ID);
+ }
+
+ /**
+ * Creates a new configuration instance.
+ *
+ * @param profileId Unique profile identifier.
+ */
+ public OIDCProviderInformationConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+ issuerLookupStrategy = FunctionSupport.constant(null);
+ }
+
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set overridden issuer value.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ issuerLookupStrategy = FunctionSupport.constant(issuer);
+ }
+
+ /**
+ * Sets lookup strategy for overridden issuer value.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
new file mode 100644
index 0000000..e7d0ba2
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Profile configuration for publishing OP key set.
+ */
+public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileConfiguration
+ implements OIDCProfileConfiguration{
+
+ /** OIDC base protocol URI. Section 3 jwks_uri is the relevant. */
+ public static final String PROTOCOL_URI =
+ "https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata";
+
+ /** ID for this profile configuration. */
+ public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/keyset";
+
+ /**
+ * Constructor.
+ */
+ public OIDCPublishKeySetConfiguration() {
+ this(PROFILE_ID);
+ }
+
+ /**
+ * Creates a new configuration instance.
+ *
+ * @param profileId Unique profile identifier.
+ */
+ public OIDCPublishKeySetConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
new file mode 100644
index 0000000..0c815f3
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
@@ -0,0 +1,147 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Set;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+
+/**
+ * Profile configuration for the OpenID Connect core protocol userinfo endpoint.
+ */
+public class OIDCUserInfoConfiguration extends AbstractConditionalProfileConfiguration
+ implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration {
+
+ /** OIDC base protocol URI. */
+ @Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/userinfo";
+
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
+ /** Lookup function to supply attribute IDs to omit from UserInfo token. */
+ @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
+
+ /**
+ * Constructor.
+ */
+ public OIDCUserInfoConfiguration() {
+ this(PROFILE_ID);
+ }
+
+ /**
+ * Creates a new configuration instance.
+ *
+ * @param profileId Unique profile identifier.
+ */
+ public OIDCUserInfoConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+
+ issuerLookupStrategy = FunctionSupport.constant(null);
+ deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
+ }
+
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set overridden issuer value.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ issuerLookupStrategy = FunctionSupport.constant(issuer);
+ }
+
+ /**
+ * Sets lookup strategy for overridden issuer value.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
+ /**
+ * Get the set of attribute IDs which should be omitted from the UserInfo token.
+ *
+ * <p>Default behavior is to include all claims, but omiited claims also affect the set that
+ * may need to be embedded for recovery into the access/refresh tokens.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the attribute IDs to omit from UserInfo token
+ */
+ @Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+
+ final Set<String> attributes = deniedUserInfoAttributesLookupStrategy.apply(profileRequestContext);
+ if (attributes != null) {
+ return Set.copyOf(attributes);
+ }
+ return Collections.emptySet();
+ }
+
+ /**
+ * Set the set of attribute IDs which should be omitted from the UserInfo token.
+ *
+ * <p>Default behavior is to include all claims, but omiited claims also affect the set that
+ * may need to be embedded for recovery into the access/refresh tokens.</p>
+ *
+ * @param attributes the attribute IDs to omit from UserInfo token
+ */
+ public void setDeniedUserInfoAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
+
+ if (attributes == null || attributes.isEmpty()) {
+ deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(
+ Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
+ }
+ }
+
+ /**
+ * Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setDeniedUserInfoAttributesLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
+ deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list