[java-idp-oidc] branch main updated: JCOMOIDC-21 - Move net.shibboleth.idp.plugin.oidc.op.config into commons
Scott Cantor
cantor.2 at osu.edu
Tue Dec 7 18:58:06 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=c5ad62326242b063eb7333ba011d6e71da51ae41
The following commit(s) were added to refs/heads/main by this push:
new c5ad6232 JCOMOIDC-21 - Move net.shibboleth.idp.plugin.oidc.op.config into commons
c5ad6232 is described below
commit c5ad62326242b063eb7333ba011d6e71da51ae41
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 7 13:58:02 2021 -0500
JCOMOIDC-21 - Move net.shibboleth.idp.plugin.oidc.op.config into commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-21
Remove old profile config material and refactor.
---
.../profile/config/OIDCProfileConfiguration.java | 27 -
.../profile/config/OIDCSecurityConfiguration.java | 102 ---
.../oidc/op/profile/config/package-info.java | 22 -
.../config/OIDCSecurityConfigurationTest.java | 56 --
idp-oidc-extension-impl/pom.xml | 5 +
...thenticationContextClassReferencePrincipal.java | 98 ---
.../oidc/op/authn/principal/package-info.java | 21 -
...IDCClientAuthenticableProfileConfiguration.java | 110 ---
.../AbstractOIDCFlowAwareProfileConfiguration.java | 183 -----
.../op/config/OIDCCoreProtocolConfiguration.java | 839 ---------------------
.../OIDCDynamicRegistrationConfiguration.java | 182 -----
.../OIDCProviderInformationConfiguration.java | 89 ---
.../op/config/OIDCPublishKeySetConfiguration.java | 55 --
.../oidc/op/config/OIDCUserInfoConfiguration.java | 148 ----
.../AttributeConsentFlowEnabledPredicate.java | 38 -
.../AuthorizationCodeFlowEnabledPredicate.java | 46 --
.../config/logic/HybridFlowEnabledPredicate.java | 47 --
.../config/logic/ImplicitFlowEnabledPredicate.java | 47 --
.../logic/RefreshTokensEnabledPredicate.java | 47 --
.../plugin/oidc/op/config/logic/package-info.java | 21 -
.../AcrClaimAlwaysEssentialLookupFunction.java | 53 --
.../AlwaysIncludedAttributesLookupFunction.java | 55 --
.../AudienceRestrictionsLookupFunction.java | 74 --
.../DataEncryptionAlgorithmsLookupFunction.java | 56 --
.../DeniedUserInfoAttributesLookupFunction.java | 59 --
.../navigate/EncodedAttributesLookupFunction.java | 55 --
...ransportEncryptionAlgorithmsLookupFunction.java | 56 --
.../RegistrationValidityPeriodLookupFunction.java | 54 --
...bjectDecryptionConfigurationLookupFunction.java | 89 ---
...atureValidationConfigurationLookupFunction.java | 90 ---
.../SecretExpirationPeriodLookupFunction.java | 54 --
.../SignatureAlgorithmsLookupFunction.java | 56 --
.../TokenEndpointAuthMethodLookupFunction.java | 69 --
...atureValidationConfigurationLookupFunction.java | 89 ---
.../oidc/op/config/navigate/package-info.java | 21 -
.../idp/plugin/oidc/op/config/package-info.java | 21 -
.../OAuth2TokenIntrospectionConfiguration.java | 52 --
.../config/OAuth2TokenRevocationConfiguration.java | 53 --
.../plugin/oidc/op/oauth2/config/package-info.java | 21 -
.../op/profile/impl/AddAttributesToClaimsSet.java | 4 +-
.../profile/impl/AddGrantTypeToClientMetadata.java | 6 +-
.../oidc/op/profile/impl/AddIDTokenShell.java | 91 +--
...bjectSecurityConfigurationToClientMetadata.java | 6 +-
.../impl/AddResponseTypesToClientMetadata.java | 4 +-
.../AddSecurityConfigurationToClientMetadata.java | 6 +-
...ddTokenEndpointAuthMethodsToClientMetadata.java | 2 +-
.../impl/FormOutboundKeySetResponseMessage.java | 2 +-
.../profile/impl/ProcessRequestedAuthnContext.java | 4 +-
.../impl/SetAccessTokenToResponseContext.java | 58 +-
...tionContextClassReferenceToResponseContext.java | 2 +-
.../SetAuthorizationCodeToResponseContext.java | 67 +-
.../profile/impl/SetConsentToResponseContext.java | 75 +-
.../impl/SetRefreshTokenToResponseContext.java | 52 +-
...etTokenDeliveryAttributesToResponseContext.java | 6 +-
.../impl/ValidateEndpointAuthentication.java | 2 +-
.../plugin/oidc/op/profile/impl/ValidatePKCE.java | 66 +-
...uteConsentEnabledInTokenClaimsSetPredicate.java | 2 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 6 +-
.../oauth2/introspection/introspection-beans.xml | 2 +-
.../flows/oauth2/revocation/revocation-beans.xml | 2 +-
.../idp/flows/oidc/authorize/authorize-beans.xml | 19 +-
.../oidc/configuration/configuration-beans.xml | 2 +-
.../oidc/consent-lookup/consent-lookup-beans.xml | 2 +-
.../idp/flows/oidc/keyset/keyset-beans.xml | 2 +-
.../idp/flows/oidc/register/register-beans.xml | 6 +-
.../idp/flows/oidc/token/token-beans.xml | 13 +-
.../idp/flows/oidc/userinfo/userinfo-beans.xml | 4 +-
.../idp/service/relying-party/postconfig.xml | 34 +-
...b-key-generator-0.8.2-jar-with-dependencies.jar | Bin 9044200 -> 0 bytes
...ticationContextClassReferencePrincipalTest.java | 54 --
.../config/OIDCCoreProtocolConfigurationTest.java | 131 ----
.../impl/CredentialMetadataValueResolverTest.java | 2 +-
.../OAuth2TokenRevocationConfigurationTest.java | 46 --
.../profile/impl/AddAttributesToClaimsSetTest.java | 2 +-
.../oidc/op/profile/impl/AddIDTokenShellTest.java | 2 +-
.../profile/impl/BaseOIDCResponseActionTest.java | 2 +-
.../FormOutboundKeySetResponseMessageTest.java | 26 +-
.../impl/ProcessRequestedAuthnContextTest.java | 2 +-
.../impl/SetAccessTokenToResponseContextTest.java | 2 +-
...ContextClassReferenceToResponseContextTest.java | 2 +-
.../SetAuthorizationCodeToResponseContextTest.java | 2 +-
.../impl/SetConsentToResponseContextTest.java | 2 +-
.../impl/SetRefreshTokenToResponseContextTest.java | 2 +-
...kenDeliveryAttributesToResponseContextTest.java | 2 +-
.../oidc/op/profile/impl/ValidatePKCETest.java | 2 +-
pom.xml | 2 +-
86 files changed, 269 insertions(+), 3821 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/config/OIDCProfileConfiguration.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/config/OIDCProfileConfiguration.java
deleted file mode 100644
index 4f10e2fc..00000000
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/config/OIDCProfileConfiguration.java
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.config;
-
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-
-/**
- * Marker interface for OIDC profile configurations.
- */
-public interface OIDCProfileConfiguration extends ProfileConfiguration {
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/config/OIDCSecurityConfiguration.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/config/OIDCSecurityConfiguration.java
deleted file mode 100644
index f7a4d680..00000000
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/config/OIDCSecurityConfiguration.java
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.config;
-
-import javax.annotation.Nullable;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
-
-/**
- * Class extends SecurityConfiguration to support separate configuration for request object decryption and signature
- * validation.
- */
-public class OIDCSecurityConfiguration extends SecurityConfiguration {
-
- /** Configuration used when decrypting request object information. */
- @Nullable
- private EncryptionConfiguration requestObjectDecryptConfig;
-
- /** Configuration used when validating request object information. */
- @Nullable
- private SignatureSigningConfiguration requestObjectSignatureValidationConfig;
-
- /** Configuration used when validating token endpoint authentication JWT signatures. */
- @Nullable
- private SignatureSigningConfiguration tokenEndpointJwtSignatureValidationConfig;
-
- /**
- * Get the configuration used when decrypting request object information.
- *
- * @return configuration used when decrypting request object information, or null
- */
- @Nullable
- public EncryptionConfiguration getRequestObjectDecryptionConfiguration() {
- return requestObjectDecryptConfig;
- }
-
- /**
- * Set the configuration used when decrypting request object information.
- *
- * @param config configuration used when decrypting request object information, or null
- */
- public void setRequestObjectDecryptionConfiguration(@Nullable final EncryptionConfiguration config) {
- requestObjectDecryptConfig = config;
- }
-
- /**
- * Get the configuration used when validating request object information.
- *
- * @return configuration used when validating request object information, or null
- */
- @Nullable
- public SignatureSigningConfiguration getRequestObjectSignatureValidationConfiguration() {
- return requestObjectSignatureValidationConfig;
- }
-
- /**
- * Set the configuration used when validating request object information.
- *
- * @param config used when validating request object information, or null
- */
- public void setRequestObjectSignatureValidationConfiguration(@Nullable final SignatureSigningConfiguration config) {
- requestObjectSignatureValidationConfig = config;
- }
-
- /**
- * Get the configuration used when validating token endpoint authentication JWT signatures.
- *
- * @return configuration used when validating token endpoint authentication JWT signatures, or null
- */
- @Nullable
- public SignatureSigningConfiguration getTokenEndpointJwtSignatureValidationConfiguration() {
- return tokenEndpointJwtSignatureValidationConfig;
- }
-
- /**
- * Set the configuration used when validating token endpoint authentication JWT signatures.
- *
- * @param config used when validating token endpoint authentication JWT signatures, or null
- */
- public void setTokenEndpointJwtSignatureValidationConfiguration(
- @Nullable final SignatureSigningConfiguration config) {
- tokenEndpointJwtSignatureValidationConfig = config;
- }
-
-}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/config/package-info.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/config/package-info.java
deleted file mode 100644
index 4a8a647f..00000000
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/config/package-info.java
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * OIDC profile configuration classes.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.config;
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/config/OIDCSecurityConfigurationTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/config/OIDCSecurityConfigurationTest.java
deleted file mode 100644
index 1d9cf914..00000000
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/config/OIDCSecurityConfigurationTest.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.config;
-
-import org.mockito.Mockito;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- * Unit tests for {@link OIDCSecurityConfiguration}
- */
-public class OIDCSecurityConfigurationTest {
-
- private OIDCSecurityConfiguration config;
-
- @BeforeMethod
- protected void setUp() throws Exception {
- config = new OIDCSecurityConfiguration();
- }
-
- @Test
- public void testInitialState() {
- Assert.assertNull(config.getRequestObjectDecryptionConfiguration());
- Assert.assertNull(config.getRequestObjectSignatureValidationConfiguration());
- }
-
- @Test
- public void testSetters() {
- config = new OIDCSecurityConfiguration();
- EncryptionConfiguration confEnc = Mockito.mock(EncryptionConfiguration.class);
- config.setRequestObjectDecryptionConfiguration(confEnc);
- Assert.assertEquals(confEnc, config.getRequestObjectDecryptionConfiguration());
- SignatureSigningConfiguration confDec = Mockito.mock(SignatureSigningConfiguration.class);
- config.setRequestObjectSignatureValidationConfiguration(confDec);
- Assert.assertEquals(confDec, config.getRequestObjectSignatureValidationConfiguration());
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/pom.xml b/idp-oidc-extension-impl/pom.xml
index 3a979729..4d512f90 100644
--- a/idp-oidc-extension-impl/pom.xml
+++ b/idp-oidc-extension-impl/pom.xml
@@ -111,6 +111,11 @@
<artifactId>oidc-common-metadata-impl</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-saml-api</artifactId>
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/principal/AuthenticationContextClassReferencePrincipal.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/principal/AuthenticationContextClassReferencePrincipal.java
deleted file mode 100644
index 3db7cb3a..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/principal/AuthenticationContextClassReferencePrincipal.java
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.authn.principal;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.authn.principal.CloneablePrincipal;
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import com.google.common.base.MoreObjects;
-
-/** Principal based on a OIDC Authentication Context Class Reference. */
-public final class AuthenticationContextClassReferencePrincipal implements CloneablePrincipal {
-
- /** unspecified auth ctx class. */
- public static final String UNSPECIFIED = "net.shibboleth.idp.oidc.authn.principal.string.unspecified";
-
- /** The class ref. */
- @Nonnull
- @NotEmpty
- private String authnContextClassReference;
-
- /**
- * Constructor.
- *
- * @param classRef the class reference URI
- */
- public AuthenticationContextClassReferencePrincipal(
- @Nonnull @NotEmpty @ParameterName(name = "classRef") final String classRef) {
- authnContextClassReference = Constraint.isNotNull(StringSupport.trimOrNull(classRef),
- "AuthnContextClassRef cannot be null or empty");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- @NotEmpty
- public String getName() {
- return authnContextClassReference;
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return authnContextClassReference.hashCode();
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object other) {
- if (other == null) {
- return false;
- }
-
- if (this == other) {
- return true;
- }
-
- if (other instanceof AuthenticationContextClassReferencePrincipal) {
- return authnContextClassReference.equals(((AuthenticationContextClassReferencePrincipal) other).getName());
- }
-
- return false;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return MoreObjects.toStringHelper(this).add("authnContextClassReference", authnContextClassReference)
- .toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public AuthenticationContextClassReferencePrincipal clone() throws CloneNotSupportedException {
- final AuthenticationContextClassReferencePrincipal copy =
- (AuthenticationContextClassReferencePrincipal) super.clone();
- copy.authnContextClassReference = authnContextClassReference;
- return copy;
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/principal/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/principal/package-info.java
deleted file mode 100644
index faa9b6e7..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/principal/package-info.java
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * OIDC-specific classes for integration with idp-authn-api packages.
- */
-package net.shibboleth.idp.plugin.oidc.op.authn.principal;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/AbstractOIDCClientAuthenticableProfileConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/AbstractOIDCClientAuthenticableProfileConfiguration.java
deleted file mode 100644
index 75f42d7d..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/AbstractOIDCClientAuthenticableProfileConfiguration.java
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config;
-
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-
-import net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCProfileConfiguration;
-import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * Base class for OIDC protocol configuration, containing configuration bit for setting client authentication methods.
- */
-public abstract class AbstractOIDCClientAuthenticableProfileConfiguration
- extends AbstractConditionalProfileConfiguration implements OIDCProfileConfiguration {
-
- /** Enabled token endpoint authentication methods. */
- @Nonnull private Function<ProfileRequestContext,Collection<String>> tokenEndpointAuthMethodsLookupStrategy;
-
- /**
- * Constructor.
- *
- * @param profileId Unique profile identifier
- */
- protected AbstractOIDCClientAuthenticableProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
-
- setTokenEndpointAuthMethods(
- List.of(
- ClientAuthenticationMethod.CLIENT_SECRET_BASIC.toString(),
- ClientAuthenticationMethod.CLIENT_SECRET_POST.toString(),
- ClientAuthenticationMethod.CLIENT_SECRET_JWT.toString(),
- ClientAuthenticationMethod.PRIVATE_KEY_JWT.toString()));
- }
-
- /**
- * Get the enabled token endpoint authentication methods.
- *
- * @param profileRequestContext profile request context
- *
- * @return enabled token endpoint authentication methods
- */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getTokenEndpointAuthMethods(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Collection<String> methods = tokenEndpointAuthMethodsLookupStrategy.apply(profileRequestContext);
- if (methods != null) {
- return List.copyOf(methods);
- }
- return Collections.emptyList();
- }
-
- /**
- * Set the enabled token endpoint authentication methods.
- *
- * @param methods What to set.
- */
- public void setTokenEndpointAuthMethods(@Nonnull @NonnullElements final Collection<String> methods) {
- Constraint.isNotNull(methods, "Collection of methods cannot be null");
-
- if (methods != null) {
- tokenEndpointAuthMethodsLookupStrategy =
- FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(methods)));
- } else {
- tokenEndpointAuthMethodsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the enabled token endpoint authentication methods.
- *
- * @param strategy lookup strategy
- */
- public void setTokenEndpointAuthMethodsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
- tokenEndpointAuthMethodsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/AbstractOIDCFlowAwareProfileConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/AbstractOIDCFlowAwareProfileConfiguration.java
deleted file mode 100644
index e555c4da..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/AbstractOIDCFlowAwareProfileConfiguration.java
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config;
-
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.google.common.base.Predicates;
-
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * Base class for OIDC protocol configuration, containing configuration bits shared by all flow aware OIDC protocol
- * configurations.
- */
-public abstract class AbstractOIDCFlowAwareProfileConfiguration
- extends AbstractOIDCClientAuthenticableProfileConfiguration {
-
- /** Predicate used to indicate whether authorization code flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> authorizationCodeFlowPredicate;
-
- /** Predicate used to indicate whether implicit flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> implicitFlowPredicate;
-
- /** Predicate used to indicate whether hybrid flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> hybridFlowPredicate;
-
- /** Predicate used to indicate whether refresh tokens are supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> refreshTokensPredicate;
-
- /**
- * Constructor.
- *
- * @param profileId Unique profile identifier.
- */
- protected AbstractOIDCFlowAwareProfileConfiguration(final String profileId) {
- super(profileId);
- authorizationCodeFlowPredicate = Predicates.alwaysTrue();
- implicitFlowPredicate = Predicates.alwaysTrue();
- hybridFlowPredicate = Predicates.alwaysTrue();
- refreshTokensPredicate = Predicates.alwaysTrue();
- }
-
- /**
- * Get whether authorization code flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether authorization code flow is supported by this profile
- */
- public boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return authorizationCodeFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether authorization code flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setAuthorizationCodeFlowEnabled(final boolean flag) {
- authorizationCodeFlowPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether authorization code flow is supported by this profile.
- *
- * @param condition condition to set
- */
- public void setAuthorizationCodeFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- authorizationCodeFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether authorization code flow is supported cannot be null");
- }
-
- /**
- * Get whether implicit flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether implicit flow is supported by this profile
- */
- public boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return hybridFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether implicit flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setHybridFlowEnabled(final boolean flag) {
- hybridFlowPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether implicit flow is supported by this profile.
- *
- * @param condition condition to set
- */
- public void setHybridFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- hybridFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether implicit flow is supported cannot be null");
- }
-
- /**
- * Get whether hybrid flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether hybrid flow is supported by this profile
- */
- public boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return implicitFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether hybrid flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setImplicitFlowEnabled(final boolean flag) {
- implicitFlowPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether hybrid flow is supported by this profile.
- *
- * @param condition condition to set.
- */
- public void setImplicitFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- implicitFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether hybrid flow is supported cannot be null");
- }
-
- /**
- * Get whether refresh tokens are supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether refresh tokens are supported by this profile
- */
- public boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return refreshTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether refresh tokens are supported by this profile.
- *
- * @param flag flag to set
- */
- public void setRefreshTokensEnabled(final boolean flag) {
- refreshTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether refresh tokens are supported by this profile.
- *
- * @param condition condition to set
- */
- public void setRefreshTokensEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- refreshTokensPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether refresh tokens are supported cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCCoreProtocolConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCCoreProtocolConfiguration.java
deleted file mode 100644
index d863f72d..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCCoreProtocolConfiguration.java
+++ /dev/null
@@ -1,839 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config;
-
-import java.security.Principal;
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-import java.util.Set;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.google.common.base.Predicates;
-
-import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal;
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * Profile configuration for the OpenID Connect authorization and token endpoints.
- */
-public class OIDCCoreProtocolConfiguration extends AbstractOIDCFlowAwareProfileConfiguration
- implements AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
-
- /** OIDC base protocol URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
-
- /** Whether attributes should be resolved in the course of the profile. */
- @Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
-
- /** Whether to mandate forced authentication for the request. */
- @Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
-
- /** Whether all acr claim requests should be treated as Essential. */
- @Nonnull private Predicate<ProfileRequestContext> acrRequestAlwaysEssentialPredicate;
-
- /** Whether client is required to use PKCE. */
- @Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
-
- /** Whether client is allowed to use PKCE code challenge method plain. */
- @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
-
- /** Whether to encode consent in authorization code and access/refresh tokens. */
- @Nonnull private Predicate<ProfileRequestContext> encodeConsentInTokensPredicate;
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Lookup function to supply proxyCount property. */
- @Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
-
- /** Lookup function to supply default authentication methods. */
- @Nonnull private Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>>
- defaultAuthenticationContextsLookupStrategy;
-
- /** Lookup function to supply authentication flows. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy;
-
- /** Lookup function to supply post authentication flows. */
- @Nonnull private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy;
-
- /** Lookup function to supply ID token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
-
- /** Lookup function to supply lifetime of authz code. */
- @Nonnull private Function<ProfileRequestContext,Duration> authorizeCodeLifetimeLookupStrategy;
-
- /** Lookup function to supply access token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
-
- /** Lookup function to supply refresh token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
-
- /** Lookup function to supply additional audiences for ID token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
-
- /** Lookup function to supply attribute IDs to embed in authorization code or access token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy;
-
- /** Lookup function to supply attribute IDs to include in ID token regardless of response_type. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> alwaysIncludedAttributesLookupStrategy;
-
- /** Lookup function to supply attribute IDs to omit from UserInfo token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCCoreProtocolConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCCoreProtocolConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- forceAuthnPredicate = Predicates.alwaysFalse();
- resolveAttributesPredicate = Predicates.alwaysTrue();
- issuerLookupStrategy = FunctionSupport.constant(null);
- proxyCountLookupStrategy = FunctionSupport.constant(null);
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
-
- idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
- authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
- refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
-
- acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
- forcePKCEPredicate = Predicates.alwaysFalse();
- allowPKCEPlainPredicate = Predicates.alwaysFalse();
- encodeConsentInTokensPredicate = Predicates.alwaysFalse();
-
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
-
- encodedAttributesLookupStrategy = FunctionSupport.constant(null);
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /**
- * Get whether attributes should be resolved during the profile.
- *
- * <p>Default is true</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff attributes should be resolved
- */
- public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
- return resolveAttributesPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether attributes should be resolved during the profile.
- *
- * @param flag flag to set
- */
- public void setResolveAttributes(final boolean flag) {
- resolveAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether attributes should be resolved during the profile.
- *
- * @param condition condition to set
- */
- public void setResolveAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
- return forceAuthnPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether a fresh user presence proof should be required for this request.
- *
- * @param flag flag to set
- */
- public void setForceAuthn(final boolean flag) {
- forceAuthnPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether a fresh user presence proof should be required for this request.
- *
- * @param condition condition to set
- */
- public void setForceAuthnPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
- final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- return count;
- }
-
- /**
- * Sets the maximum number of times an assertion may be proxied outbound and/or
- * the maximum number of hops between the relying party and a proxied authentication
- * authority inbound.
- *
- * @param count proxy count
- */
- public void setProxyCount(@Nullable @NonNegative final Integer count) {
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- proxyCountLookupStrategy = FunctionSupport.constant(count);
- }
-
- /**
- * Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or
- * the maximum number of hops between the relying party and a proxied authentication authority inbound.
- *
- * @param strategy lookup strategy
- */
- public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext,Integer> strategy) {
- proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return Set.copyOf(flows);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the authentication flows to use.
- *
- * @param flows flow identifiers to use
- */
- public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- authenticationFlowsLookupStrategy =
- FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication flows to use.
- *
- * @param strategy lookup strategy
- */
- public void setAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- authenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return List.copyOf(flows);
- }
- return Collections.emptyList();
- }
-
- /**
- * Set the ordered collection of post-authentication interceptor flows to enable.
- *
- * @param flows flow identifiers to enable
- */
- public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- postAuthenticationFlowsLookupStrategy =
- FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the post-authentication interceptor flows to enable.
- *
- * @param strategy lookup strategy
- */
- public void setPostAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
- postAuthenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<AuthenticationContextClassReferencePrincipal> methods =
- defaultAuthenticationContextsLookupStrategy.apply(profileRequestContext);
- if (methods != null) {
- return List.copyOf(methods);
- }
- return Collections.emptyList();
- }
-
- /**
- * Set the default authentication contexts to use, expressed as custom principals.
- *
- * @param contexts default authentication contexts to use
- */
- public void setDefaultAuthenticationMethods(
- @Nullable @NonnullElements final Collection<AuthenticationContextClassReferencePrincipal> contexts) {
- if (contexts != null) {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(List.copyOf(contexts));
- } else {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
- *
- * @param strategy lookup strategy
- */
- public void setDefaultAuthenticationMethodsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>>
- strategy) {
- defaultAuthenticationContextsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get ID token lifetime.
- *
- * <p>Defaults to 1 hour.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return ID token lifetime
- */
- @Positive @Nonnull public Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Duration lifetime = idTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "ID token lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of an id token.
- *
- * @param lifetime lifetime of an id token in milliseconds
- */
- public void setIDTokenLifetime(@Positive @Nonnull final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "ID token lifetime must be greater than 0");
-
- idTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the ID token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setIDTokenLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- idTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get access token lifetime.
- *
- * <p>Defaults to 10 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return access token lifetime
- */
- @Positive @Nonnull
- public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Access token lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of an access token.
- *
- * @param lifetime lifetime of an access token in milliseconds
- */
- public void setAccessTokenLifetime(@Positive @Nonnull final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Access token lifetime must be greater than 0");
-
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
-
- /**
- * Set a lookup strategy for the access token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setAccessTokenLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get authz code lifetime.
- *
- * <p>Defaults to 5 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return authz code lifetime
- */
- @Positive @Nonnull
- public Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = authorizeCodeLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Authorization code lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of authz code.
- *
- * @param lifetime lifetime of authz code
- */
- public void setAuthorizeCodeLifetime(@Positive @Nonnull final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Authorization code lifetime must be greater than 0");
-
- authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the authz code lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setAuthorizeCodeLifetimeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- authorizeCodeLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get refresh token lifetime.
- *
- * <p>Defaults to 2 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return refresh token lifetime
- */
- @Nonnull @Positive
- public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of refresh token.
- *
- * @param lifetime lifetime of an refresh token
- */
- public void setRefreshTokenLifetime(@Nonnull @Positive final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token lifetime must be greater than 0");
-
- refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the refresh token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setRefreshTokenLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
- * which the token may be shared.
- *
- * @param profileRequestContext profile request context
- *
- * @return the additional audiences
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
- if (audiences != null) {
- return Set.copyOf(audiences);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
- * which the token may be shared.
- *
- * @param audiences the additional audiences
- */
- public void setAdditionalAudiencesForIdToken(@Nullable @NonnullElements final Collection<String> audiences) {
-
- if (audiences == null || audiences.isEmpty()) {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- } else {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(audiences)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of audiences, in addition to the relying party(ies) to which the IdP
- * is issuing the ID Token, with which the token may be shared.
- *
- * @param strategy lookup strategy
- */
- public void setAdditionalAudiencesForIdTokenLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get whether all acr claim requests should be treated as Essential.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether all acr claim requests should be treated as Essential
- */
- public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
- return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether all acr claim requests should be treated as Essential.
- *
- * @param flag flag to set
- */
- public void setAcrRequestAlwaysEssential(final boolean flag) {
- acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether all acr claim requests should be treated as Essential.
- *
- * @param condition condition to set
- */
- public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether client is required to use PKCE.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is required to use PKCE
- */
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
- return forcePKCEPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is required to use PKCE.
- *
- * @param flag flag to set
- */
- public void setForcePKCE(final boolean flag) {
- forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is required to use PKCE.
- *
- * @param condition condition to set
- */
- public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether client is allowed to use PKCE code challenge method plain.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is allowed to use PKCE code challenge method plain
- */
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
- return allowPKCEPlainPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is allowed to use PKCE code challenge method plain.
- *
- * @param flag flag to set
- */
- public void setAllowPKCEPlain(final boolean flag) {
- allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is allowed to use PKCE code challenge method plain.
- *
- * @param condition condition to set
- */
- public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
-
- /**
- * Get whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to encode consent in authorization code and access/refresh tokens
- */
- public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
- return encodeConsentInTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param flag flag to set
- */
- public void setEncodeConsentInTokens(final boolean flag) {
- encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param condition condition to set
- */
- public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
- * and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to encode
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getEncodedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = encodedAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be encoded in encrypted form into the authorization code
- * and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param attributes the attribute IDs to encode
- */
- public void setEncodedAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- encodedAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- encodedAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the attribute IDs which should be encoded in encrypted form into the
- * authorization code and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param strategy lookup strategy
- */
- public void setEncodedAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- encodedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get the set of attribute IDs which should be included in the ID token regardless of response_type.
- *
- * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
- * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
- * attributes to be added to the ID token regardless of flow.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to include in all cases
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getAlwaysIncludedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = alwaysIncludedAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be included in the ID token regardless of response_type.
- *
- * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
- * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
- * attributes to be added to the ID token regardless of flow.</p>
- *
- * @param attributes the attribute IDs to include in all cases
- */
- public void setAlwaysIncludedAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the attribute IDs which should be included in the ID token regardless of
- * response_type.
- *
- * @param strategy lookup strategy
- */
- public void setAlwaysIncludedAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- alwaysIncludedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to omit from UserInfo token
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = deniedUserInfoAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param attributes the attribute IDs to omit from UserInfo token
- */
- public void setDeniedUserInfoAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * @param strategy lookup strategy
- */
- public void setDeniedUserInfoAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCDynamicRegistrationConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCDynamicRegistrationConfiguration.java
deleted file mode 100644
index bce3b790..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCDynamicRegistrationConfiguration.java
+++ /dev/null
@@ -1,182 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config;
-
-import java.time.Duration;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-
-/**
- * Profile configuration for the OpenID Connect dynamic client registration.
- */
-public class OIDCDynamicRegistrationConfiguration extends AbstractOIDCFlowAwareProfileConfiguration
- implements OverriddenIssuerProfileConfiguration {
-
- /** OIDC base protocol URI. */
- public static final String PROTOCOL_URI = "https://openid.net/specs/openid-connect-registration-1_0.html";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/registration";
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Lookup function to supply registration validity period. */
- @Nonnull private Function<ProfileRequestContext,Duration> registrationValidityPeriodLookupStrategy;
-
- /** Lookup function to supply client secret expiration period. */
- @Nullable private Function<ProfileRequestContext,Duration> secretExpirationPeriodLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCDynamicRegistrationConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCDynamicRegistrationConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- setRegistrationValidityPeriod(Duration.ofHours(24));
- setSecretExpirationPeriod(Duration.ofDays(365));
- }
-
- /** {@inheritDoc} */
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /**
- * Get dynamic registration validity period.
- *
- * <p>A null or 0 is interpreted as an unlimited period.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return dynamic registration validity period
- */
- @Nullable @NonNegative
- public Duration getRegistrationValidityPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Duration period = registrationValidityPeriodLookupStrategy.apply(profileRequestContext);
-
- Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
- return period;
- }
-
- /**
- * Sets the registration validity period.
- *
- * <p>A null or 0 is interpreted as an unlimited period.</p>
- *
- * @param period registration validity period
- */
- public void setRegistrationValidityPeriod(@Nullable @NonNegative final Duration period) {
- Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
-
- registrationValidityPeriodLookupStrategy = FunctionSupport.constant(period);
- }
-
- /**
- * Set a lookup strategy for the registration validity period.
- *
- * <p>A null or 0 is interpreted as an unlimited period.</p>
- *
- * @param strategy lookup strategy
- */
- public void setRegistrationValidityPeriodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- registrationValidityPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get client secret expiration period.
- *
- * <p>A null or 0 is interpreted as an unlimited period.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return client secret expiration period
- */
- @Nullable @NonNegative
- public Duration getSecretExpirationPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration period = secretExpirationPeriodLookupStrategy.apply(profileRequestContext);
-
- Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
- return period;
- }
-
- /**
- * Sets the client secret expiration period.
- *
- * <p>A null or 0 is interpreted as an unlimited period.</p>
- *
- * @param period registration validity period
- */
- public void setSecretExpirationPeriod(@Nullable @NonNegative final Duration period) {
- Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
-
- secretExpirationPeriodLookupStrategy = FunctionSupport.constant(period);
- }
-
- /**
- * Set a lookup strategy for the client secret expiration period.
- *
- * <p>A null or 0 is interpreted as an unlimited period.</p>
- *
- * @param strategy lookup strategy
- */
- public void setSecretExpirationPeriodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- secretExpirationPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCProviderInformationConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCProviderInformationConfiguration.java
deleted file mode 100644
index 58af4966..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCProviderInformationConfiguration.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCProfileConfiguration;
-import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-
-/**
- * Profile configuration for the OpenID Connect Provider Configuration.
- */
-public class OIDCProviderInformationConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration {
-
- /** OIDC base protocol URI. Section 4 is relevant. */
- public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-discovery-1_0.html";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/configuration";
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCProviderInformationConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCProviderInformationConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCPublishKeySetConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCPublishKeySetConfiguration.java
deleted file mode 100644
index 4b488b14..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCPublishKeySetConfiguration.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCProfileConfiguration;
-import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-
-/**
- * Profile configuration for publishing OP key set.
- */
-public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration{
-
- /** OIDC base protocol URI. Section 3 jwks_uri is the relevant. */
- public static final String PROTOCOL_URI =
- "https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/keyset";
-
- /**
- * Constructor.
- */
- public OIDCPublishKeySetConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCPublishKeySetConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCUserInfoConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCUserInfoConfiguration.java
deleted file mode 100644
index 6f600b68..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCUserInfoConfiguration.java
+++ /dev/null
@@ -1,148 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config;
-
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Set;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCProfileConfiguration;
-import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * Profile configuration for the OpenID Connect core protocol userinfo endpoint.
- */
-public class OIDCUserInfoConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration {
-
- /** OIDC base protocol URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/userinfo";
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Lookup function to supply attribute IDs to omit from UserInfo token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCUserInfoConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCUserInfoConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
-
- issuerLookupStrategy = FunctionSupport.constant(null);
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /**
- * Get the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to omit from UserInfo token
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = deniedUserInfoAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param attributes the attribute IDs to omit from UserInfo token
- */
- public void setDeniedUserInfoAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * @param strategy lookup strategy
- */
- public void setDeniedUserInfoAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/AttributeConsentFlowEnabledPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/AttributeConsentFlowEnabledPredicate.java
deleted file mode 100644
index 0c0a796a..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/AttributeConsentFlowEnabledPredicate.java
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.logic;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.authn.config.navigate.PostAuthenticationFlowsLookupFunction;
-import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-
-/**
- * A predicate implementation that checks if attribute-release is included in the list of post authentication flows
- * returned by {@link PostAuthenticationFlowsLookupFunction}.
- */
-public class AttributeConsentFlowEnabledPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
- final PostAuthenticationFlowsLookupFunction postAuthnFlowsLookup = new PostAuthenticationFlowsLookupFunction();
- return postAuthnFlowsLookup.apply(input).contains("attribute-release");
- }
-}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/AuthorizationCodeFlowEnabledPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/AuthorizationCodeFlowEnabledPredicate.java
deleted file mode 100644
index 6af4d3b6..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/AuthorizationCodeFlowEnabledPredicate.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.logic;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.AbstractOIDCFlowAwareProfileConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-
-/**
- * A predicate implementation that forwards to {@link
- * AbstractOIDCFlowAwareProfileConfiguration#isAuthorizationCodeFlowEnabled(ProfileRequestContext)}.
- */
-public class AuthorizationCodeFlowEnabledPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOIDCFlowAwareProfileConfiguration) {
- return ((AbstractOIDCFlowAwareProfileConfiguration) pc).isAuthorizationCodeFlowEnabled(input);
- }
- }
- return false;
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/HybridFlowEnabledPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/HybridFlowEnabledPredicate.java
deleted file mode 100644
index 46a040fc..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/HybridFlowEnabledPredicate.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.logic;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.AbstractOIDCFlowAwareProfileConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-
-/**
- * A predicate implementation that forwards to
- * AbstractOIDCFlowAwareProfileConfiguration#isHybridFlowEnabled(ProfileRequestContext)}.
- */
-public class HybridFlowEnabledPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOIDCFlowAwareProfileConfiguration) {
- return ((AbstractOIDCFlowAwareProfileConfiguration) pc).isHybridFlowEnabled(input);
- }
- }
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/ImplicitFlowEnabledPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/ImplicitFlowEnabledPredicate.java
deleted file mode 100644
index ac20caf6..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/ImplicitFlowEnabledPredicate.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.logic;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.AbstractOIDCFlowAwareProfileConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-
-/**
- * A predicate implementation that forwards to
- * {@link AbstractOIDCFlowAwareProfileConfiguration#isImplicitFlowEnabled(ProfileRequestContext)}.
- */
-public class ImplicitFlowEnabledPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOIDCFlowAwareProfileConfiguration) {
- return ((AbstractOIDCFlowAwareProfileConfiguration) pc).isImplicitFlowEnabled(input);
- }
- }
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/RefreshTokensEnabledPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/RefreshTokensEnabledPredicate.java
deleted file mode 100644
index 036e8c34..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/RefreshTokensEnabledPredicate.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.logic;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.AbstractOIDCFlowAwareProfileConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-
-/**
- * A predicate implementation that forwards to
- * {@link AbstractOIDCFlowAwareProfileConfiguration#isRefreshTokensEnabled(ProfileRequestContext)}.
- */
-public class RefreshTokensEnabledPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOIDCFlowAwareProfileConfiguration) {
- return ((AbstractOIDCFlowAwareProfileConfiguration) pc).isRefreshTokensEnabled(input);
- }
- }
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/package-info.java
deleted file mode 100644
index b852db19..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/package-info.java
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Configuration predicates. To be moved to API project.
- */
-package net.shibboleth.idp.plugin.oidc.op.config.logic;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java
deleted file mode 100644
index a1135758..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-
-/**
- * A predicate that returns {@link OIDCCoreProtocolConfiguration#isAcrRequestAlwaysEssential(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function, by default a child
- * of the {@link ProfileRequestContext}.
- *
- * <p>
- * If a specific setting is unavailable, a false value is returned.
- * </p>
- */
-public class AcrClaimAlwaysEssentialLookupFunction extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- @Nullable
- public boolean test(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
- return ((OIDCCoreProtocolConfiguration) pc).isAcrRequestAlwaysEssential(input);
- }
- }
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/AlwaysIncludedAttributesLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/AlwaysIncludedAttributesLookupFunction.java
deleted file mode 100644
index 60afcb2d..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/AlwaysIncludedAttributesLookupFunction.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.Set;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that obtains
- * {@link OIDCCoreProtocolConfiguration#getAlwaysIncludedAttributes(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class AlwaysIncludedAttributesLookupFunction
- extends AbstractRelyingPartyLookupFunction<Set<String>> {
-
- /** {@inheritDoc} */
- @Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
- return ((OIDCCoreProtocolConfiguration)pc).getAlwaysIncludedAttributes(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/AudienceRestrictionsLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/AudienceRestrictionsLookupFunction.java
deleted file mode 100644
index 3343c1c7..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/AudienceRestrictionsLookupFunction.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.Collection;
-import java.util.Collections;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableCollection.Builder;
-
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-
-/**
- * A function that returns the effective audience restrictions to include in ID tokens, based on combining a relying
- * party's entityID with the result of
- * {@link OIDCCoreProtocolConfiguration#getAdditionalAudiencesForIdToken(ProfileRequestContext)}, if such
- * a profile is available from a {@link RelyingPartyContext} obtained via a lookup function, by default a child of the
- * {@link ProfileRequestContext}.
- *
- * <p>
- * If a specific setting is unavailable, no values are returned.
- * </p>
- */
-public class AudienceRestrictionsLookupFunction extends AbstractRelyingPartyLookupFunction<Collection<String>> {
-
- /** {@inheritDoc} */
- @Nullable @NonnullElements @NotLive @Unmodifiable public Collection<String> apply(
- @Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final String id = rpc.getRelyingPartyId();
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration
- && !((OIDCCoreProtocolConfiguration) pc).getAdditionalAudiencesForIdToken(input).isEmpty()) {
- final Builder<String> builder = ImmutableList.builder();
- if (id != null) {
- builder.add(rpc.getRelyingPartyId());
- }
- builder.addAll(((OIDCCoreProtocolConfiguration) pc).getAdditionalAudiencesForIdToken(input));
- return builder.build();
- } else if (id != null) {
- return Collections.singletonList(rpc.getRelyingPartyId());
- }
- }
-
- return Collections.emptyList();
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/DataEncryptionAlgorithmsLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/DataEncryptionAlgorithmsLookupFunction.java
deleted file mode 100644
index 79ad1ef3..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/DataEncryptionAlgorithmsLookupFunction.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.Collections;
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns {@link EncryptionConfiguration#getDataEncryptionAlgorithms()} if it is available in the
- * security configuration of the profile configuration. The profile configuration is fetched from the
- * {@link RelyingPartyContext} obtained via a lookup function, by default a child of the {@link ProfileRequestContext}.
- *
- * <p>
- * If a specific setting is unavailable, an empty list is returned.
- * </p>
- */
-public class DataEncryptionAlgorithmsLookupFunction extends AbstractRelyingPartyLookupFunction<List<String>> {
-
- /** {@inheritDoc} */
- @Nullable
- public List<String> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null && rpc.getProfileConfig() != null
- && rpc.getProfileConfig().getSecurityConfiguration(input) != null) {
- final EncryptionConfiguration encryptionConfig =
- rpc.getProfileConfig().getSecurityConfiguration(input).getEncryptionConfiguration();
- if (encryptionConfig != null && encryptionConfig.getDataEncryptionAlgorithms() != null) {
- return encryptionConfig.getDataEncryptionAlgorithms();
- }
- }
- return Collections.emptyList();
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/DeniedUserInfoAttributesLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/DeniedUserInfoAttributesLookupFunction.java
deleted file mode 100644
index 0f292dbd..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/DeniedUserInfoAttributesLookupFunction.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.Set;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCUserInfoConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that obtains
- * {@link OIDCCoreProtocolConfiguration#getDeniedUserInfoAttributes(ProfileRequestContext)} or
- * {@link OIDCUserInfoConfiguration#getDeniedUserInfoAttributes(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class DeniedUserInfoAttributesLookupFunction
- extends AbstractRelyingPartyLookupFunction<Set<String>> {
-
- /** {@inheritDoc} */
- @Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCCoreProtocolConfiguration) {
- return ((OIDCCoreProtocolConfiguration)pc).getDeniedUserInfoAttributes(input);
- } else if (pc instanceof OIDCUserInfoConfiguration) {
- return ((OIDCUserInfoConfiguration) pc).getDeniedUserInfoAttributes(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/EncodedAttributesLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/EncodedAttributesLookupFunction.java
deleted file mode 100644
index 94062d1a..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/EncodedAttributesLookupFunction.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.Set;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that obtains
- * {@link OIDCCoreProtocolConfiguration#getEncodedAttributes(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class EncodedAttributesLookupFunction
- extends AbstractRelyingPartyLookupFunction<Set<String>> {
-
- /** {@inheritDoc} */
- @Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
- return ((OIDCCoreProtocolConfiguration)pc).getEncodedAttributes(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/KeyTransportEncryptionAlgorithmsLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/KeyTransportEncryptionAlgorithmsLookupFunction.java
deleted file mode 100644
index db3fa01e..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/KeyTransportEncryptionAlgorithmsLookupFunction.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.Collections;
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns {@link EncryptionConfiguration#getKeyTransportEncryptionAlgorithms()} if it is available in
- * the security configuration of the profile configuration. The profile configuration is fetched from the
- * {@link RelyingPartyContext} obtained via a lookup function, by default a child of the {@link ProfileRequestContext}.
- *
- * <p>
- * If a specific setting is unavailable, an empty list is returned.
- * </p>
- */
-public class KeyTransportEncryptionAlgorithmsLookupFunction extends AbstractRelyingPartyLookupFunction<List<String>> {
-
- /** {@inheritDoc} */
- @Nullable
- public List<String> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null && rpc.getProfileConfig() != null
- && rpc.getProfileConfig().getSecurityConfiguration(input) != null) {
- final EncryptionConfiguration encryptionConfig =
- rpc.getProfileConfig().getSecurityConfiguration(input).getEncryptionConfiguration();
- if (encryptionConfig != null && encryptionConfig.getKeyTransportEncryptionAlgorithms() != null) {
- return encryptionConfig.getKeyTransportEncryptionAlgorithms();
- }
- }
- return Collections.emptyList();
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/RegistrationValidityPeriodLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/RegistrationValidityPeriodLookupFunction.java
deleted file mode 100644
index fffa710a..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/RegistrationValidityPeriodLookupFunction.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.time.Duration;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCDynamicRegistrationConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns
- * {@link OIDCDynamicRegistrationConfiguration#getRegistrationValidityPeriod(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class RegistrationValidityPeriodLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
-
- /** {@inheritDoc} */
- @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCDynamicRegistrationConfiguration) {
- return ((OIDCDynamicRegistrationConfiguration) pc).getRegistrationValidityPeriod(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/RequestObjectDecryptionConfigurationLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/RequestObjectDecryptionConfigurationLookupFunction.java
deleted file mode 100644
index 9dc11acc..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/RequestObjectDecryptionConfigurationLookupFunction.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCSecurityConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.EncryptionConfiguration;
-
-/**
- * A function that returns a {@link EncryptionConfiguration} list for request object decryption by way of various lookup
- * strategies.
- *
- * <p>
- * If a specific setting is unavailable, a null value is returned.
- * </p>
- */
-public class RequestObjectDecryptionConfigurationLookupFunction
- extends AbstractRelyingPartyLookupFunction<List<EncryptionConfiguration>> {
-
- /** A resolver for default security configurations. */
- @Nullable
- private RelyingPartyConfigurationResolver rpResolver;
-
- /**
- * Set the resolver for default security configurations.
- *
- * @param resolver the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
- rpResolver = resolver;
- }
-
- /** {@inheritDoc} */
- @Nullable
- public List<EncryptionConfiguration> apply(@Nullable final ProfileRequestContext input) {
-
- final List<EncryptionConfiguration> configs = new ArrayList<>();
-
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
- && ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getRequestObjectDecryptionConfiguration() != null) {
- configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getRequestObjectDecryptionConfiguration());
- }
- }
-
- // Check for a per-profile default (relying party independent) config.
- if (input != null && rpResolver != null) {
- final SecurityConfiguration defaultConfig =
- rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
- if (defaultConfig instanceof OIDCSecurityConfiguration
- && ((OIDCSecurityConfiguration) defaultConfig).getRequestObjectDecryptionConfiguration() != null) {
- configs.add(((OIDCSecurityConfiguration) defaultConfig).getRequestObjectDecryptionConfiguration());
- }
- }
- // TODO: Add Support for global default ?
- return configs;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/RequestObjectSignatureValidationConfigurationLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/RequestObjectSignatureValidationConfigurationLookupFunction.java
deleted file mode 100644
index 67d92505..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/RequestObjectSignatureValidationConfigurationLookupFunction.java
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCSecurityConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-
-/**
- * A function that returns a {@link SignatureSigningConfiguration} list for request object signature validation by way
- * of various lookup strategies.
- *
- * <p>
- * If a specific setting is unavailable, a null value is returned.
- * </p>
- */
-public class RequestObjectSignatureValidationConfigurationLookupFunction
- extends AbstractRelyingPartyLookupFunction<List<SignatureSigningConfiguration>> {
-
- /** A resolver for default security configurations. */
- @Nullable
- private RelyingPartyConfigurationResolver rpResolver;
-
- /**
- * Set the resolver for default security configurations.
- *
- * @param resolver the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
- rpResolver = resolver;
- }
-
- /** {@inheritDoc} */
- @Nullable
- public List<SignatureSigningConfiguration> apply(@Nullable final ProfileRequestContext input) {
-
- final List<SignatureSigningConfiguration> configs = new ArrayList<>();
-
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
- && ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getRequestObjectSignatureValidationConfiguration() != null) {
- configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getRequestObjectSignatureValidationConfiguration());
- }
- }
-
- // Check for a per-profile default (relying party independent) config.
- if (input != null && rpResolver != null) {
- final SecurityConfiguration defaultConfig =
- rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
- if (defaultConfig instanceof OIDCSecurityConfiguration
- && ((OIDCSecurityConfiguration) defaultConfig)
- .getRequestObjectSignatureValidationConfiguration() != null) {
- configs.add(
- ((OIDCSecurityConfiguration) defaultConfig).getRequestObjectSignatureValidationConfiguration());
- }
- }
- // TODO: Support for Global Default configuration?
- return configs;
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/SecretExpirationPeriodLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/SecretExpirationPeriodLookupFunction.java
deleted file mode 100644
index ad96f916..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/SecretExpirationPeriodLookupFunction.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.time.Duration;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCDynamicRegistrationConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns
- * {@link OIDCDynamicRegistrationConfiguration#getSecretExpirationPeriod(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class SecretExpirationPeriodLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
-
- /** {@inheritDoc} */
- @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCDynamicRegistrationConfiguration) {
- return ((OIDCDynamicRegistrationConfiguration) pc).getSecretExpirationPeriod(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/SignatureAlgorithmsLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/SignatureAlgorithmsLookupFunction.java
deleted file mode 100644
index 5612cd18..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/SignatureAlgorithmsLookupFunction.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.Collections;
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns {@link SignatureSigningConfiguration#getSignatureAlgorithms()} if it is available in the
- * security configuration of the profile configuration. The profile configuration is fetched from the
- * {@link RelyingPartyContext} obtained via a lookup function, by default a child of the {@link ProfileRequestContext}.
- *
- * <p>
- * If a specific setting is unavailable, an empty list is returned.
- * </p>
- */
-public class SignatureAlgorithmsLookupFunction extends AbstractRelyingPartyLookupFunction<List<String>> {
-
- /** {@inheritDoc} */
- @Nullable
- public List<String> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null && rpc.getProfileConfig() != null
- && rpc.getProfileConfig().getSecurityConfiguration(input) != null) {
- final SignatureSigningConfiguration sigConfig =
- rpc.getProfileConfig().getSecurityConfiguration(input).getSignatureSigningConfiguration();
- if (sigConfig != null && sigConfig.getSignatureAlgorithms() != null) {
- return sigConfig.getSignatureAlgorithms();
- }
- }
- return Collections.emptyList();
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/TokenEndpointAuthMethodLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/TokenEndpointAuthMethodLookupFunction.java
deleted file mode 100644
index 60611afe..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/TokenEndpointAuthMethodLookupFunction.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.Collection;
-import java.util.List;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-
-import net.shibboleth.idp.plugin.oidc.op.config.AbstractOIDCClientAuthenticableProfileConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.config.AbstractOIDCFlowAwareProfileConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that obtains
- * {@link AbstractOIDCFlowAwareProfileConfiguration#getTokenEndpointAuthMethods(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}. That result is then transformed into a list
- * of {@link ClientAuthenticationMethod}s.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class TokenEndpointAuthMethodLookupFunction
- extends AbstractRelyingPartyLookupFunction<List<ClientAuthenticationMethod>> {
-
- /** {@inheritDoc} */
- @Nullable public List<ClientAuthenticationMethod> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOIDCClientAuthenticableProfileConfiguration) {
-
- final Collection<String> methods =
- ((AbstractOIDCClientAuthenticableProfileConfiguration)pc).getTokenEndpointAuthMethods(input);
- if (methods != null) {
- return methods
- .stream()
- .map(ClientAuthenticationMethod::new)
- .collect(Collectors.toUnmodifiableList());
- }
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/TokenEndpointJwtSignatureValidationConfigurationLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/TokenEndpointJwtSignatureValidationConfigurationLookupFunction.java
deleted file mode 100644
index 93afac1e..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/TokenEndpointJwtSignatureValidationConfigurationLookupFunction.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCSecurityConfiguration;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.xmlsec.SignatureSigningConfiguration;
-
-/**
- * A function that returns a {@link SignatureSigningConfiguration} list for token endpoint JWT signature validation by
- * way of various lookup strategies.
- *
- * <p>
- * If a specific setting is unavailable, a null value is returned.
- * </p>
- */
-public class TokenEndpointJwtSignatureValidationConfigurationLookupFunction
- extends AbstractRelyingPartyLookupFunction<List<SignatureSigningConfiguration>> {
-
- /** A resolver for default security configurations. */
- @Nullable private RelyingPartyConfigurationResolver rpResolver;
-
- /**
- * Set the resolver for default security configurations.
- *
- * @param resolver the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
- rpResolver = resolver;
- }
-
- /** {@inheritDoc} */
- @Nullable public List<SignatureSigningConfiguration> apply(@Nullable final ProfileRequestContext input) {
-
- final List<SignatureSigningConfiguration> configs = new ArrayList<>();
-
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
- && ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getTokenEndpointJwtSignatureValidationConfiguration() != null) {
- configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getTokenEndpointJwtSignatureValidationConfiguration());
- }
- }
-
- // Check for a per-profile default (relying party independent) config.
- if (input != null && rpResolver != null) {
- final SecurityConfiguration defaultConfig =
- rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
- if (defaultConfig instanceof OIDCSecurityConfiguration
- && ((OIDCSecurityConfiguration) defaultConfig).
- getTokenEndpointJwtSignatureValidationConfiguration() != null) {
- configs.add(
- ((OIDCSecurityConfiguration) defaultConfig).
- getTokenEndpointJwtSignatureValidationConfiguration());
- }
- }
- // TODO: Support for Global Default configuration?
- return configs;
- }
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/package-info.java
deleted file mode 100644
index 6fad26fa..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/navigate/package-info.java
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Navigation functions related to OIDC profile configurations.
- */
-package net.shibboleth.idp.plugin.oidc.op.config.navigate;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/package-info.java
deleted file mode 100644
index 42dc8e16..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/package-info.java
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Profile configurations related to OIDC functionality.
- */
-package net.shibboleth.idp.plugin.oidc.op.config;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/OAuth2TokenIntrospectionConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
deleted file mode 100644
index 2cb2d970..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oauth2.config;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.config.AbstractOIDCClientAuthenticableProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-
-/**
- * Profile configuration for the OAuth2 Token Introspection.
- */
-public class OAuth2TokenIntrospectionConfiguration extends AbstractOIDCClientAuthenticableProfileConfiguration {
-
- /** OAuth2 Token Revocation URI. */
- public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
-
- /**
- * Constructor.
- */
- public OAuth2TokenIntrospectionConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OAuth2TokenIntrospectionConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/OAuth2TokenRevocationConfiguration.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/OAuth2TokenRevocationConfiguration.java
deleted file mode 100644
index ac5ccc60..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/OAuth2TokenRevocationConfiguration.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oauth2.config;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.config.AbstractOIDCClientAuthenticableProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-
-/**
- * Profile configuration for the OAuth2 Token Revocation. The profile is required to define client authentication
- * methods.
- */
-public class OAuth2TokenRevocationConfiguration extends AbstractOIDCClientAuthenticableProfileConfiguration {
-
- /** OAuth2 Token Revocation URI. */
- public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7009";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/revocation";
-
- /**
- * Constructor.
- */
- public OAuth2TokenRevocationConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OAuth2TokenRevocationConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/package-info.java
deleted file mode 100644
index c8ed9dab..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/package-info.java
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * OAuth2 profile configurations.
- */
-package net.shibboleth.idp.plugin.oidc.op.oauth2.config;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
index fd52950a..59585a94 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
@@ -35,14 +35,14 @@ import net.shibboleth.idp.attribute.transcoding.AttributeTranscoder;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.attribute.transcoding.TranscoderSupport;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.AlwaysIncludedAttributesLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.DeniedUserInfoAttributesLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultResponseClaimsSetLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.navigate.AlwaysIncludedAttributesLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.DeniedUserInfoAttributesLookupFunction;
import net.shibboleth.utilities.java.support.annotation.constraint.Live;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java
index 1d8ef6d7..b95e3ac0 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java
@@ -33,9 +33,9 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.GrantType;
-import net.shibboleth.idp.plugin.oidc.op.config.logic.AuthorizationCodeFlowEnabledPredicate;
-import net.shibboleth.idp.plugin.oidc.op.config.logic.ImplicitFlowEnabledPredicate;
-import net.shibboleth.idp.plugin.oidc.op.config.logic.RefreshTokensEnabledPredicate;
+import net.shibboleth.oidc.profile.config.logic.AuthorizationCodeFlowEnabledPredicate;
+import net.shibboleth.oidc.profile.config.logic.ImplicitFlowEnabledPredicate;
+import net.shibboleth.oidc.profile.config.logic.RefreshTokensEnabledPredicate;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.logic.Constraint;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShell.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShell.java
index 2b81ef45..ab4950e8 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShell.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShell.java
@@ -28,16 +28,15 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.AudienceRestrictionsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.IDTokenLifetimeLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
@@ -60,14 +59,12 @@ public class AddIDTokenShell extends AbstractOIDCResponseAction {
/** Strategy used to obtain the response issuer value. */
@Nonnull private Function<ProfileRequestContext, String> issuerLookupStrategy;
- /**
- * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
- */
- @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
-
/** Strategy used to obtain the audiences to add. */
- @Nullable private Function<ProfileRequestContext,Collection<String>> audienceRestrictionsLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,Collection<String>> audienceRestrictionsLookupStrategy;
+ /** Strategy used to obtain the ID token lifetime. */
+ @Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
+
/** EntityID to populate into Issuer element. */
@Nullable private String issuerId;
@@ -76,25 +73,15 @@ public class AddIDTokenShell extends AbstractOIDCResponseAction {
/** Audiences to add. */
@Nullable private Collection<String> audiences;
+
+ /** ID token lifetime. */
+ @Nullable private Duration lifetime;
/** Constructor. */
public AddIDTokenShell() {
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- }
-
- /**
- * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}.
- *
- * @param strategy strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ issuerLookupStrategy = new ResponderIdLookupFunction();
+ audienceRestrictionsLookupStrategy = new AudienceRestrictionsLookupFunction();
+ idTokenLifetimeLookupStrategy = new IDTokenLifetimeLookupFunction();
}
/**
@@ -104,6 +91,7 @@ public class AddIDTokenShell extends AbstractOIDCResponseAction {
*/
public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
issuerLookupStrategy = Constraint.isNotNull(strategy, "IssuerLookupStrategy lookup strategy cannot be null");
}
@@ -119,15 +107,17 @@ public class AddIDTokenShell extends AbstractOIDCResponseAction {
audienceRestrictionsLookupStrategy =
Constraint.isNotNull(strategy, "Audience restriction lookup strategy cannot be null");
}
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
+
+ /**
+ * Set the strategy used to obtain the ID token lifetime.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIDTokenLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- if (audienceRestrictionsLookupStrategy == null) {
- throw new ComponentInitializationException("Audience restriction lookup strategy cannot be null");
- }
+ idTokenLifetimeLookupStrategy =
+ Constraint.isNotNull(strategy, "ID token lifetime lookup strategy cannot be null");
}
/** {@inheritDoc} */
@@ -138,18 +128,24 @@ public class AddIDTokenShell extends AbstractOIDCResponseAction {
return false;
}
- rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx == null) {
- log.debug("{} No relying party context associated with this profile request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ issuerId = issuerLookupStrategy.apply(profileRequestContext);
+ if (issuerId == null) {
+ log.warn("{} No issuer returned for ID token", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return false;
}
- issuerId = issuerLookupStrategy.apply(profileRequestContext);
audiences = audienceRestrictionsLookupStrategy.apply(profileRequestContext);
if (audiences == null || audiences.isEmpty()) {
- log.debug("{} No audiences to add, nothing to do", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ log.warn("{} No audiences returned for ID token", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+ return false;
+ }
+
+ lifetime = idTokenLifetimeLookupStrategy.apply(profileRequestContext);
+ if (lifetime == null) {
+ log.warn("{} No lifetime supplied for ID token", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return false;
}
@@ -163,19 +159,10 @@ public class AddIDTokenShell extends AbstractOIDCResponseAction {
for (final String audience : audiences) {
aud.add(new Audience(audience));
}
- Date exp = null;
- final ProfileConfiguration pc = rpCtx.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
- final Duration lifetime = ((OIDCCoreProtocolConfiguration) pc).getIDTokenLifetime(profileRequestContext);
- exp = Date.from(Instant.now().plus(lifetime));
- } else {
- log.debug("{} No oidc profile configuration associated with this profile request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
- return;
- }
+ final Date exp = Date.from(Instant.now().plus(lifetime));
final IDTokenClaimsSet idToken = new IDTokenClaimsSet(new Issuer(issuerId),
new Subject(getOidcResponseContext().getSubject()), aud, exp, new Date());
- log.debug("{} Setting id token shell to response context {}", getLogPrefix(),
+ log.debug("{} Setting ID token shell to response context {}", getLogPrefix(),
idToken.toJSONObject().toJSONString());
getOidcResponseContext().setIDToken(idToken);
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
index 3d24db0b..f29c2063 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
@@ -33,10 +33,10 @@ import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWSAlgorithm;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.DataEncryptionAlgorithmsLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.KeyTransportEncryptionAlgorithmsLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.SignatureAlgorithmsLookupFunction;
import net.shibboleth.oidc.jwa.support.SignatureConstants;
+import net.shibboleth.oidc.profile.config.navigate.DataEncryptionAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.KeyTransportEncryptionAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.SignatureAlgorithmsLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddResponseTypesToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddResponseTypesToClientMetadata.java
index bf0f6b1b..f92f31e8 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddResponseTypesToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddResponseTypesToClientMetadata.java
@@ -34,8 +34,8 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.openid.connect.sdk.OIDCResponseTypeValue;
-import net.shibboleth.idp.plugin.oidc.op.config.logic.AuthorizationCodeFlowEnabledPredicate;
-import net.shibboleth.idp.plugin.oidc.op.config.logic.ImplicitFlowEnabledPredicate;
+import net.shibboleth.oidc.profile.config.logic.AuthorizationCodeFlowEnabledPredicate;
+import net.shibboleth.oidc.profile.config.logic.ImplicitFlowEnabledPredicate;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.PredicateSupport;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
index 2dc28af7..48207115 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
@@ -35,10 +35,10 @@ import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.oauth2.sdk.ResponseType;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.DataEncryptionAlgorithmsLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.KeyTransportEncryptionAlgorithmsLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.SignatureAlgorithmsLookupFunction;
import net.shibboleth.oidc.jwa.support.SignatureConstants;
+import net.shibboleth.oidc.profile.config.navigate.DataEncryptionAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.KeyTransportEncryptionAlgorithmsLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.SignatureAlgorithmsLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenEndpointAuthMethodsToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenEndpointAuthMethodsToClientMetadata.java
index 29858c83..67378551 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenEndpointAuthMethodsToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenEndpointAuthMethodsToClientMetadata.java
@@ -31,7 +31,7 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.TokenEndpointAuthMethodLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.TokenEndpointAuthMethodLookupFunction;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundKeySetResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundKeySetResponseMessage.java
index 956a7fc5..c878e788 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundKeySetResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundKeySetResponseMessage.java
@@ -39,11 +39,11 @@ import com.nimbusds.jose.jwk.JWKSet;
import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.oidc.op.messaging.JSONSuccessResponse;
-import net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCSecurityConfiguration;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
index 6e90b43e..2e746d67 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
@@ -24,9 +24,9 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.PreferredPrincipalContext;
import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
-import net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.AcrClaimAlwaysEssentialLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedAcrLookupFunction;
+import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
+import net.shibboleth.oidc.profile.config.navigate.AcrClaimAlwaysEssentialLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
index 2eb9ca2b..463b33ad 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
@@ -35,8 +35,6 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.minidev.json.JSONArray;
import net.shibboleth.idp.authn.context.SubjectContext;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.config.logic.AttributeConsentFlowEnabledPredicate;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
@@ -46,9 +44,9 @@ import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.RefreshTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
+import net.shibboleth.oidc.profile.config.logic.AttributeConsentFlowEnabledPredicate;
+import net.shibboleth.oidc.profile.config.navigate.AccessTokenLifetimeLookupFunction;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -75,17 +73,15 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
/** Data sealer for handling access token. */
@Nonnull private final DataSealer dataSealer;
- /**
- * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
- */
- @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
-
/** Authorize Code / Refresh Token the access token is based on. */
@Nullable private TokenClaimsSet tokenClaimsSet;
/** Strategy used to obtain the response issuer value. */
@Nonnull private Function<ProfileRequestContext, String> issuerLookupStrategy;
+ /** Strategy used to obtain the access token lifetime. */
+ @Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
+
/** Predicate used to check if consent is enabled with a given {@link ProfileRequestContext}. */
@Nonnull
private Predicate<ProfileRequestContext> consentEnabledPredicate;
@@ -109,7 +105,7 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
@Nonnull
private Function<ProfileRequestContext,OIDCAuthenticationResponseTokenClaimsContext>
tokenClaimsContextLookupStrategy;
-
+
/** Strategy used to locate the {@link OIDCAuthenticationResponseConsentContext}. */
@Nonnull
private Function<ProfileRequestContext, OIDCAuthenticationResponseConsentContext> consentContextLookupStrategy;
@@ -126,7 +122,7 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
consentContextLookupStrategy =
new ChildContextLookup<>(OIDCAuthenticationResponseConsentContext.class).compose(
new OIDCAuthenticationResponseContextLookupFunction());
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ accessTokenLifetimeLookupStrategy = new AccessTokenLifetimeLookupFunction();
consentEnabledPredicate = new AttributeConsentFlowEnabledPredicate();
dataSealer = Constraint.isNotNull(sealer, "DataSealer cannot be null");
issuerLookupStrategy = new ResponderIdLookupFunction();
@@ -160,18 +156,15 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
}
/**
- * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}.
+ * Set the strategy used to obtain the access token lifetime.
*
- * @param strategy strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}
+ * @param strategy lookup strategy
*/
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
+ public void setAccessTokenLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+
+ accessTokenLifetimeLookupStrategy =
+ Constraint.isNotNull(strategy, "Access token lifetime lookup strategy cannot be null");
}
/**
@@ -184,7 +177,7 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
idGeneratorLookupStrategy =
- Constraint.isNotNull(strategy, "IdentifierGenerationStrategy lookup strategy cannot be null");
+ Constraint.isNotNull(strategy, "Identifier generation strategy cannot be null");
}
/**
@@ -194,7 +187,8 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
*/
public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- issuerLookupStrategy = Constraint.isNotNull(strategy, "IssuerLookupStrategy lookup strategy cannot be null");
+
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
}
/**
@@ -217,28 +211,20 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
return false;
}
- final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx == null) {
- log.error("{} No relying party context associated with this profile request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
- return false;
- }
- final ProfileConfiguration pc = rpCtx.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
- accessTokenLifetime = ((OIDCCoreProtocolConfiguration) pc).getAccessTokenLifetime(profileRequestContext);
- } else {
- log.error("{} No oidc profile configuration associated with this profile request", getLogPrefix());
+ accessTokenLifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
+ if (accessTokenLifetime == null) {
+ log.warn("{} No lifetime supplied for access token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return false;
}
+
tokenClaimsSet = getOidcResponseContext().getTokenClaimsSet();
- if (tokenClaimsSet != null && (!(tokenClaimsSet instanceof RefreshTokenClaimsSet)
- && !(tokenClaimsSet instanceof AuthorizeCodeClaimsSet))) {
+ if (tokenClaimsSet != null && !(tokenClaimsSet instanceof RefreshTokenClaimsSet)
+ && !(tokenClaimsSet instanceof AuthorizeCodeClaimsSet)) {
log.error("{} No token grant if of illegal type", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
} else if (tokenClaimsSet == null) {
-
/*
* Alternate path possible only when access token is to be provided by authz endpoint without authorization
* code This is the case only with "token id_token" response type. Unusually complex initialization.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java
index 1bc27b89..62554e70 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java
@@ -28,8 +28,8 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.PreferredPrincipalContext;
import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
import net.shibboleth.idp.authn.principal.DefaultPrincipalDeterminationStrategy;
-import net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java
index 2a7b3a8a..3e22d403 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java
@@ -32,8 +32,6 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.minidev.json.JSONArray;
import net.shibboleth.idp.authn.context.SubjectContext;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.config.logic.AttributeConsentFlowEnabledPredicate;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
@@ -43,9 +41,9 @@ import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequest
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
+import net.shibboleth.oidc.profile.config.logic.AttributeConsentFlowEnabledPredicate;
+import net.shibboleth.oidc.profile.config.navigate.AuthzCodeLifetimeLookupFunction;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -66,12 +64,10 @@ import net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifie
public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthenticationResponseAction {
/** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(SetAuthorizationCodeToResponseContext.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(SetAuthorizationCodeToResponseContext.class);
/** Strategy used to obtain the response issuer value. */
- @Nonnull
- private Function<ProfileRequestContext, String> issuerLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext, String> issuerLookupStrategy;
/** Data sealer for handling authorization code. */
@Nonnull private final DataSealer dataSealer;
@@ -82,10 +78,8 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
/** Strategy used to locate the {@link IdentifierGenerationStrategy} to use. */
@Nonnull private Function<ProfileRequestContext, IdentifierGenerationStrategy> idGeneratorLookupStrategy;
- /**
- * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
- */
- @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
+ /** Strategy used to obtain the authz code lifetime. */
+ @Nonnull private Function<ProfileRequestContext,Duration> authzCodeLifetimeLookupStrategy;
/** Strategy used to locate the {@link OIDCAuthenticationResponseTokenClaimsContext}. */
@Nonnull
@@ -110,7 +104,7 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
@Nullable private SubjectContext subjectCtx;
/** Authorization code lifetime. */
- @Nullable private Duration authCodeLifetime;
+ @Nullable private Duration authzCodeLifetime;
/** Code challenge and the code challenge method stored to authz code.*/
@Nullable private String codeChallenge;
@@ -129,7 +123,7 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
consentContextLookupStrategy =
new ChildContextLookup<>(OIDCAuthenticationResponseConsentContext.class).compose(
new OIDCAuthenticationResponseContextLookupFunction());
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ authzCodeLifetimeLookupStrategy = new AuthzCodeLifetimeLookupFunction();
issuerLookupStrategy = new ResponderIdLookupFunction();
consentEnabledPredicate = new AttributeConsentFlowEnabledPredicate();
dataSealer = Constraint.isNotNull(sealer, "DataSealer cannot be null");
@@ -144,7 +138,7 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
public void setCodeChallengeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
codeChallengeLookupStrategy =
- Constraint.isNotNull(strategy, "CodeChallengeLookupStrategy lookup strategy cannot be null");
+ Constraint.isNotNull(strategy, "Code challenge lookup strategy cannot be null");
}
/**
@@ -155,7 +149,7 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
public void setCodeChallengeMethodLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
codeChallengeMethodLookupStrategy =
- Constraint.isNotNull(strategy, "CodeChallengeMethodLookupStrategy lookup strategy cannot be null");
+ Constraint.isNotNull(strategy, "Code challenge method lookup strategy cannot be null");
}
/**
@@ -185,18 +179,15 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
}
/**
- * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}.
+ * Set the strategy used to obtain the authz code lifetime.
*
- * @param strategy strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}
+ * @param strategy lookup strategy
*/
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
+ public void setAuthzCodeLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+
+ authzCodeLifetimeLookupStrategy =
+ Constraint.isNotNull(strategy, "Authz code lifetime lookup strategy cannot be null");
}
/**
@@ -244,30 +235,25 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
subjectCtx = profileRequestContext.getSubcontext(SubjectContext.class, false);
if (subjectCtx == null) {
- log.error("{} No subject context", getLogPrefix());
+ log.warn("{} No subject context", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
+
idGenerator = idGeneratorLookupStrategy.apply(profileRequestContext);
if (idGenerator == null) {
- log.debug("{} No identifier generation strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
- final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx == null) {
- log.debug("{} No relying party context associated with this profile request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ log.warn("{} No identifier generation strategy", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
return false;
}
- final ProfileConfiguration pc = rpCtx.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
- authCodeLifetime = ((OIDCCoreProtocolConfiguration) pc).getAuthorizeCodeLifetime(profileRequestContext);
- } else {
- log.debug("{} No oidc profile configuration associated with this profile request", getLogPrefix());
+
+ authzCodeLifetime = authzCodeLifetimeLookupStrategy.apply(profileRequestContext);
+ if (authzCodeLifetime == null) {
+ log.warn("{} No authorization code lifetime available", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return false;
}
+
codeChallenge = codeChallengeLookupStrategy.apply(profileRequestContext);
if (codeChallenge != null && !codeChallenge.isEmpty()) {
// Prepend the PKCE challenge with method as we need to store both method and challenge.
@@ -276,6 +262,7 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
// Default method is "plain"
codeChallenge = (codeChallengeMethod != null ? codeChallengeMethod : "plain") + codeChallenge;
}
+
return true;
}
@@ -296,7 +283,7 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
claimsID = tokenClaimsCtx.getIdtokenClaims();
claimsUI = tokenClaimsCtx.getUserinfoClaims();
}
- final Instant dateExp = Instant.now().plus(authCodeLifetime);
+ final Instant dateExp = Instant.now().plus(authzCodeLifetime);
final AuthorizeCodeClaimsSet claimsSet = new AuthorizeCodeClaimsSet.Builder(idGenerator,
getAuthenticationRequest().getClientID(), issuerLookupStrategy.apply(profileRequestContext),
subjectCtx.getPrincipalName(), getOidcResponseContext().getSubject(), Instant.now(), dateExp,
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContext.java
index e0ac0e40..13782400 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContext.java
@@ -31,14 +31,12 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.config.logic.AttributeConsentFlowEnabledPredicate;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
-import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.logic.AttributeConsentFlowEnabledPredicate;
+import net.shibboleth.oidc.profile.config.logic.EncodeConsentPredicate;
import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.context.AttributeContext;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -54,45 +52,30 @@ public class SetConsentToResponseContext extends AbstractOIDCResponseAction {
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(SetConsentToResponseContext.class);
- /**
- * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
- */
- @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
-
/**
* Strategy used to locate the {@link AttributeContext} associated with a given {@link ProfileRequestContext}.
*/
@Nonnull private Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy;
/**
- * Predicate used to check if consent is enabled with a given {@link ProfileRequestContext}.
+ * Predicate used to check if consent is enabled.
*/
@Nonnull private Predicate<ProfileRequestContext> consentEnabledPredicate;
+ /**
+ * Predicate used to check if consent should be embedded in tokens.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> encodeConsentPredicate;
+
/** AttributeContext to use. */
@Nullable private AttributeContext attributeCtx;
/** Constructor. */
SetConsentToResponseContext() {
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
new ChildContextLookup<>(RelyingPartyContext.class));
consentEnabledPredicate = new AttributeConsentFlowEnabledPredicate();
- }
-
- /**
- * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}.
- *
- * @param strategy strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ encodeConsentPredicate = new EncodeConsentPredicate();
}
/**
@@ -111,17 +94,27 @@ public class SetConsentToResponseContext extends AbstractOIDCResponseAction {
}
/**
- * Set the predicate used to check if consent is enabled with a given {@link ProfileRequestContext}.
+ * Set the predicate used to check if consent is enable.
*
- * @param predicate predicate used to check if consent is enabled with a given {@link ProfileRequestContext}.
+ * @param predicate predicate used to check if consent is enabled
*/
public void setConsentEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- consentEnabledPredicate =
- Constraint.isNotNull(predicate, "predicate used to check if consent is enabled cannot be null");
+ consentEnabledPredicate = Constraint.isNotNull(predicate, "Predicate cannot be null");
}
+ /**
+ * Set the predicate used to check if consent should be encoded.
+ *
+ * @param predicate predicate used to check if consent should be encoded
+ */
+ public void setEncodeConsentPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ encodeConsentPredicate = Constraint.isNotNull(predicate, "Predicate cannot be null");
+ }
+
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -129,28 +122,13 @@ public class SetConsentToResponseContext extends AbstractOIDCResponseAction {
return false;
}
- final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx == null) {
- log.error("{} No relying party context associated with this profile request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
- return false;
- }
-
if (!consentEnabledPredicate.test(profileRequestContext)) {
log.debug("{} The attribute consent has not been enabled, nothing to do", getLogPrefix());
return false;
}
-
- final ProfileConfiguration pc = rpCtx.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
- if (!((OIDCCoreProtocolConfiguration) pc).isEncodeConsentInTokens(profileRequestContext)) {
- log.debug("{} The consent encoding to token has not been enabled, nothing to do",
- getLogPrefix());
- return false;
- }
- } else {
- log.error("{} No oidc profile configuration associated with this profile request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+
+ if (!encodeConsentPredicate.test(profileRequestContext)) {
+ log.debug("{} Consent is not being encoded into tokens, nothing to do", getLogPrefix());
return false;
}
@@ -159,7 +137,6 @@ public class SetConsentToResponseContext extends AbstractOIDCResponseAction {
log.debug("{} No AttributeSubcontext available, nothing to do", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
-
}
return true;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java
index c9d112ac..ec02b216 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java
@@ -31,16 +31,13 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.OIDCScopeValue;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.RefreshTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.navigate.RefreshTokenLifetimeLookupFunction;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -62,10 +59,8 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
/** Data sealer for handling access token. */
@Nonnull private final DataSealer dataSealer;
- /**
- * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
- */
- @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
+ /** Strategy used to obtain the refresh token lifetime. */
+ @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
/** Authorize Code / Refresh Token the refresh token will be based on. */
@Nullable private TokenClaimsSet tokenClaimsSet;
@@ -79,23 +74,21 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
* @param sealer sealer to encrypt/hmac refresh token.
*/
public SetRefreshTokenToResponseContext(@Nonnull @ParameterName(name = "sealer") final DataSealer sealer) {
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ refreshTokenLifetimeLookupStrategy = new RefreshTokenLifetimeLookupFunction();
dataSealer = Constraint.isNotNull(sealer, "DataSealer cannot be null");
}
/**
- * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}.
+ * Set the strategy used to obtain the access token lifetime.
*
- * @param strategy strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}
+ * @param strategy lookup strategy
*/
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
+ public void setRefreshTokenLifetimeLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+
+ refreshTokenLifetimeLookupStrategy =
+ Constraint.isNotNull(strategy, "Refresh token lifetime lookup strategy cannot be null");
}
/** {@inheritDoc} */
@@ -106,30 +99,25 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
}
if (!getOidcResponseContext().getScope().contains(OIDCScopeValue.OFFLINE_ACCESS)) {
- log.debug("{} no offline_access scope, nothing to do", getLogPrefix());
+ log.debug("{} No offline_access scope, nothing to do", getLogPrefix());
return false;
}
- final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx == null) {
- log.error("{} No relying party context associated with this profile request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
- return false;
- }
- final ProfileConfiguration pc = rpCtx.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
- refreshTokenLifetime = ((OIDCCoreProtocolConfiguration) pc).getRefreshTokenLifetime(profileRequestContext);
- } else {
- log.error("{} No oidc profile configuration associated with this profile request", getLogPrefix());
+
+ refreshTokenLifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
+ if (refreshTokenLifetime == null) {
+ log.warn("{} No lifetime supplied for refresh token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return false;
}
+
tokenClaimsSet = getOidcResponseContext().getTokenClaimsSet();
- if (tokenClaimsSet == null || (!(tokenClaimsSet instanceof RefreshTokenClaimsSet)
- && !(tokenClaimsSet instanceof AuthorizeCodeClaimsSet))) {
+ if (tokenClaimsSet == null || !(tokenClaimsSet instanceof RefreshTokenClaimsSet)
+ && !(tokenClaimsSet instanceof AuthorizeCodeClaimsSet)) {
log.error("{} No token to base refresh on", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
+
return true;
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
index 9ca49aae..83f419c4 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
@@ -33,13 +33,13 @@ import net.shibboleth.idp.attribute.transcoding.AttributeTranscoder;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.attribute.transcoding.TranscoderSupport;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.AlwaysIncludedAttributesLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.DeniedUserInfoAttributesLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.EncodedAttributesLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.navigate.AlwaysIncludedAttributesLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.DeniedUserInfoAttributesLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.EncodedAttributesLookupFunction;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateEndpointAuthentication.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateEndpointAuthentication.java
index 24443f3d..b04813b7 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateEndpointAuthentication.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateEndpointAuthentication.java
@@ -45,8 +45,8 @@ import com.nimbusds.oauth2.sdk.auth.Secret;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.TokenEndpointAuthMethodLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
+import net.shibboleth.oidc.profile.config.navigate.TokenEndpointAuthMethodLookupFunction;
import net.shibboleth.oidc.security.impl.JWTSignatureValidationUtil;
import net.shibboleth.oidc.security.impl.OIDCSignatureValidationParameters;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java
index c493809d..8a65d32f 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java
@@ -21,6 +21,7 @@ import java.nio.charset.Charset;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.function.Function;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -30,14 +31,11 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.jose.util.Base64URL;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestCodeVerifierLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
-import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.logic.AllowPKCEPlainPredicate;
+import net.shibboleth.oidc.profile.config.logic.ForcePKCEPredicate;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
@@ -55,15 +53,16 @@ public class ValidatePKCE extends AbstractOIDCResponseAction {
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(ValidatePKCE.class);
- /**
- * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
- */
- @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
-
/**
* Strategy used to locate the PKCE Code Verifier value.
*/
- @Nonnull private Function<ProfileRequestContext, String> codeVerifierLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,String> codeVerifierLookupStrategy;
+
+ /** Strategy used to determine whether to require PKCE. */
+ @Nonnull private Predicate<ProfileRequestContext> forcePKCECondition;
+
+ /** Strategy used to determine whether to allow plaintext PKCE. */
+ @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainCondition;
/** Whether PKCE is mandatory. */
private boolean forcePKCE;
@@ -81,23 +80,31 @@ public class ValidatePKCE extends AbstractOIDCResponseAction {
* Constructor.
*/
public ValidatePKCE() {
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
codeVerifierLookupStrategy = new DefaultRequestCodeVerifierLookupFunction();
+ forcePKCECondition = new ForcePKCEPredicate();
+ allowPKCEPlainCondition = new AllowPKCEPlainPredicate();
}
/**
- * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}.
+ * Set the condition used to determine whether to require PKCE.
*
- * @param strategy strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}
+ * @param condition condition to apply
*/
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
+ public void setForcePKCECondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ forcePKCECondition = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Set the condition used to determine whether to allow plaintext PKCE.
+ *
+ * @param condition condition to apply
+ */
+ public void setAllowPKCEPlainCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ allowPKCEPlainCondition = Constraint.isNotNull(condition, "Condition cannot be null");
}
/**
@@ -126,21 +133,10 @@ public class ValidatePKCE extends AbstractOIDCResponseAction {
log.debug("{} No authorization code presented, PKCE not applied, nothing to do", getLogPrefix());
return false;
}
- final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (rpCtx == null) {
- log.error("{} No relying party context associated with this profile request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
- return false;
- }
- final ProfileConfiguration pc = rpCtx.getProfileConfig();
- if (pc != null && pc instanceof OIDCCoreProtocolConfiguration) {
- forcePKCE = ((OIDCCoreProtocolConfiguration) pc).isForcePKCE(profileRequestContext);
- plainPKCE = ((OIDCCoreProtocolConfiguration) pc).isAllowPKCEPlain(profileRequestContext);
- } else {
- log.error("{} No oidc profile configuration associated with this profile request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
- return false;
- }
+
+ forcePKCE = forcePKCECondition.test(profileRequestContext);
+ plainPKCE = allowPKCEPlainCondition.test(profileRequestContext);
+
codeChallenge = getOidcResponseContext().getTokenClaimsSet().getCodeChallenge();
// Checks whether PKCE needs to be validated.
if ((codeChallenge == null || codeChallenge.isEmpty()) && !forcePKCE) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java
similarity index 97%
rename from idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java
rename to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java
index 884d6cfc..c2fe1e2c 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/config/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.config.logic;
+package net.shibboleth.idp.plugin.oidc.op.profile.logic;
import javax.annotation.Nullable;
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 5cb34564..a4f6694a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -16,15 +16,15 @@
<!-- OIDC authentication context class reference parent declaration -->
<bean id="shibboleth.OIDCAuthnContextClassReference" abstract="true"
- class="net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal" />
+ class="net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal" />
<bean p:id="oidc" class="net.shibboleth.idp.authn.principal.GenericPrincipalService"
- c:claz="net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal"
+ c:claz="net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal"
c:serializer-ref="shibboleth.GenericPrincipalSerializer" />
<!-- OIDC exact match bean definitions -->
<bean id="shibboleth.OIDCAuthnMethodExact" parent="shibboleth.Pair"
- p:first="#{ T(net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal) }"
+ p:first="#{T(net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}"
p:second="exact"/>
<bean parent="shibboleth.AuthnComparisonRegistration"
c:key-ref="shibboleth.OIDCAuthnMethodExact" c:value-ref="shibboleth.ExactMatchFactory" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
index ba5097c9..62dd613a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
@@ -8,7 +8,7 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.oauth2.config.OAuth2TokenIntrospectionConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenIntrospectionConfiguration).PROFILE_ID}" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
index cf08991a..6aecfcaf 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
@@ -8,7 +8,7 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.oauth2.config.OAuth2TokenRevocationConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration).PROFILE_ID}" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 47dedfa8..043d1f3f 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -9,7 +9,7 @@
<bean id="shibboleth.oidc.browserProfile" class="java.lang.Boolean" c:_0="true" />
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration).PROFILE_ID}" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
@@ -65,7 +65,7 @@
p:parameterType="#{T(net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationEncryptionParametersResolver.ParameterType).REQUEST_OBJECT_DECRYPTION}" />
<bean id="shibboleth.oidc.DecryptionConfigurationLookup"
- class="net.shibboleth.idp.plugin.oidc.op.config.navigate.RequestObjectDecryptionConfigurationLookupFunction"
+ class="net.shibboleth.oidc.profile.config.navigate.RequestObjectDecryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
<bean id="PopulateRequestObjectSignatureValidationParameters"
@@ -85,7 +85,7 @@
</bean>
<bean id="shibboleth.oidc.SignatureValidationConfigurationLookup"
- class="net.shibboleth.idp.plugin.oidc.op.config.navigate.RequestObjectSignatureValidationConfigurationLookupFunction"
+ class="net.shibboleth.oidc.profile.config.navigate.RequestObjectSignatureValidationConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
<bean id="shibboleth.oidc.RequestObjectSignatureValidationParametersResolver"
@@ -216,24 +216,19 @@
scope="prototype">
<property name="classRefLookupStrategy">
<bean class="net.shibboleth.idp.authn.principal.DefaultPrincipalDeterminationStrategy"
- c:type="net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal">
+ c:type="net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal">
<constructor-arg name="principal">
- <bean
- class="net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal"
- c:classRef="#{T(net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal).UNSPECIFIED}" />
+ <bean class="net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal"
+ c:classRef="#{T(net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal).UNSPECIFIED}" />
</constructor-arg>
</bean>
</property>
</bean>
- <bean id="AddIDTokenShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell" scope="prototype"
- p:issuerLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple">
+ <bean id="AddIDTokenShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell" scope="prototype">
<property name="activationCondition">
<ref bean="IDTokenRequested" />
</property>
- <property name="audienceRestrictionsLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.config.navigate.AudienceRestrictionsLookupFunction" />
- </property>
</bean>
<bean id="AddAttributeClaimsToIDToken"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/configuration/configuration-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/configuration/configuration-beans.xml
index 193774d4..1333bdf4 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/configuration/configuration-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/configuration/configuration-beans.xml
@@ -12,7 +12,7 @@
<bean id="OidcApiInfoFlowAuditName" class="java.lang.String" c:_0="Discovery" />
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.config.OIDCProviderInformationConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration).PROFILE_ID}" />
<bean id="BuildErrorResponseFromEvent"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.BuildJSONErrorResponseFromEvent" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/consent-lookup/consent-lookup-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/consent-lookup/consent-lookup-beans.xml
index ab93d5af..307fed4c 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/consent-lookup/consent-lookup-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/consent-lookup/consent-lookup-beans.xml
@@ -8,7 +8,7 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="ConsentEnabledPredicate"
- class="net.shibboleth.idp.plugin.oidc.op.config.logic.AttributeConsentEnabledInTokenClaimsSetPredicate" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.logic.AttributeConsentEnabledInTokenClaimsSetPredicate" />
<bean id="PopulateConsentInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/keyset/keyset-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/keyset/keyset-beans.xml
index 248e9ace..6da705ee 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/keyset/keyset-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/keyset/keyset-beans.xml
@@ -11,7 +11,7 @@
<bean id="OidcApiInfoFlowAuditName" class="java.lang.String" c:_0="KeySet" />
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.config.OIDCPublishKeySetConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration).PROFILE_ID}" />
<bean id="FormOutboundMessage"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundKeySetResponseMessage" scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
index d0bdf262..0f8f398c 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
@@ -11,7 +11,7 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.config.OIDCDynamicRegistrationConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCDynamicRegistrationConfiguration).PROFILE_ID}" />
<bean id="DecodeMessage"
class="org.opensaml.profile.action.impl.DecodeMessage"
@@ -41,7 +41,7 @@
<bean id="GenerateClientSecret"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.GenerateClientSecret" scope="prototype">
<property name="secretExpirationPeriodStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.config.navigate.SecretExpirationPeriodLookupFunction" />
+ <bean class="net.shibboleth.oidc.profile.config.navigate.SecretExpirationPeriodLookupFunction" />
</property>
</bean>
@@ -132,7 +132,7 @@
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.StoreClientInformation" scope="prototype"
p:clientInformationManager-ref="shibboleth.oidc.ClientInformationManager">
<property name="registrationValidityPeriodStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.config.navigate.RegistrationValidityPeriodLookupFunction" />
+ <bean class="net.shibboleth.oidc.profile.config.navigate.RegistrationValidityPeriodLookupFunction" />
</property>
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 2e0c5b17..e15f74ad 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -8,7 +8,7 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration).PROFILE_ID}" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
@@ -42,8 +42,7 @@
p:replayCache-ref="shibboleth.ReplayCache"
p:revocationCache-ref="shibboleth.RevocationCache" />
- <bean id="ValidatePKCE" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidatePKCE"
- scope="prototype" />
+ <bean id="ValidatePKCE" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidatePKCE" scope="prototype" />
<bean id="ValidateRedirectURI" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidateRedirectURI"
scope="prototype" p:redirectURILookupStrategy-ref="shibboleth.TokenRequestRedirectURILookupStrategy"
@@ -138,11 +137,7 @@
<bean id="SetSubjectToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetSubjectToResponseContext" scope="prototype" />
- <bean id="AddIDTokenShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell" scope="prototype"
- p:issuerLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple">
- <property name="audienceRestrictionsLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.config.navigate.AudienceRestrictionsLookupFunction" />
- </property>
+ <bean id="AddIDTokenShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell" scope="prototype">
</bean>
<bean id="AddAttributeClaimsToIDToken"
@@ -231,7 +226,7 @@
</bean>
<bean id="shibboleth.oidc.SignatureValidationConfigurationLookup"
- class="net.shibboleth.idp.plugin.oidc.op.config.navigate.TokenEndpointJwtSignatureValidationConfigurationLookupFunction"
+ class="net.shibboleth.oidc.profile.config.navigate.TokenEndpointJwtSignatureValidationConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
<bean id="shibboleth.oidc.TokenEndpointJwtSignatureValidationParametersResolver"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
index 004c7265..86df0a69 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
@@ -8,7 +8,7 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.config.OIDCUserInfoConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration).PROFILE_ID}" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
@@ -99,7 +99,7 @@
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetSubjectToResponseContext" scope="prototype" />
<bean id="AddUserInfoShell" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddUserInfoShell" scope="prototype"
- p:issuerLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple"></bean>
+ p:issuerLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple" />
<bean id="AddAttributeClaimsToUserInfo"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddAttributesToClaimsSet" scope="prototype"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 0436a857..3f272190 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -19,7 +19,7 @@
p:securityConfiguration-ref="%{idp.security.oidc.config:shibboleth.oidc.DefaultSecurityConfiguration}" />
<bean id="OIDC.SSO" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration"
+ class="net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration"
p:issuer-ref="issuer"
p:iDTokenLifetime="%{idp.oidc.idToken.defaultLifetime:PT1H}"
p:accessTokenLifetime="%{idp.oidc.accessToken.defaultLifetime:PT10M}"
@@ -34,31 +34,31 @@
p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}" />
<bean id="OIDC.UserInfo" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCUserInfoConfiguration"
+ class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration"
p:issuer-ref="issuer"
p:deniedUserInfoAttributes="%{idp.oidc.deniedUserInfoAttributes:}" />
<bean id="OIDC.Registration" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCDynamicRegistrationConfiguration"
+ class="net.shibboleth.oidc.profile.config.OIDCDynamicRegistrationConfiguration"
p:issuer-ref="issuer"
p:registrationValidityPeriod="%{idp.oidc.dynreg.defaultRegistrationValidity:PT24H}"
p:secretExpirationPeriod="%{idp.oidc.dynreg.defaultSecretExpiration:P12M}"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
<bean id="OIDC.Configuration" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCProviderInformationConfiguration"
+ class="net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration"
p:issuer-ref="issuer" />
<bean id="OAUTH2.Revocation" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.oauth2.config.OAuth2TokenRevocationConfiguration"
+ class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
<bean id="OIDC.Keyset" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCPublishKeySetConfiguration"
+ class="net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration"
p:securityConfiguration-ref="shibboleth.oidc.PublishKeySetSecurityConfiguration" />
<bean id="OAUTH2.Introspection" parent="AbstractOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.oauth2.config.OAuth2TokenIntrospectionConfiguration"
+ class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenIntrospectionConfiguration"
p:tokenEndpointAuthMethods="%{idp.oidc.dynreg.tokenEndpointAuthMethods:client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt}" />
<!-- Metadata-driven variants. -->
@@ -107,7 +107,7 @@
</bean>
<bean id="OIDC.SSO.MDDriven" parent="AbstractMDDrivenOIDCFlowAwareProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration">
+ class="net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration">
<property name="resolveAttributesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -196,7 +196,7 @@
</property>
<property name="defaultAuthenticationMethodsLookupStrategy">
<bean parent="shibboleth.MDDrivenListProperty" p:propertyName="defaultAuthenticationMethods"
- p:propertyType="#{T(net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal)}" />
+ p:propertyType="#{T(net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal)}" />
</property>
<property name="encodedAttributesLookupStrategy">
<bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="encodedAttributes">
@@ -228,7 +228,7 @@
</bean>
<bean id="OIDC.UserInfo.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCUserInfoConfiguration">
+ class="net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration">
<property name="issuerLookupStrategy">
<bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
</property>
@@ -244,7 +244,7 @@
</bean>
<bean id="OIDC.Registration.MDDriven" parent="AbstractMDDrivenOIDCFlowAwareProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCDynamicRegistrationConfiguration">
+ class="net.shibboleth.oidc.profile.config.OIDCDynamicRegistrationConfiguration">
<property name="issuerLookupStrategy">
<bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
</property>
@@ -269,14 +269,14 @@
</bean>
<bean id="OIDC.Configuration.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCProviderInformationConfiguration">
+ class="net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration">
<property name="issuerLookupStrategy">
<bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="issuer" p:defaultValue-ref="issuer" />
</property>
</bean>
<bean id="OIDC.Keyset.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.config.OIDCPublishKeySetConfiguration">
+ class="net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration">
<property name="securityConfigurationLookupStrategy">
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
p:propertyType="#{T(net.shibboleth.idp.profile.config.SecurityConfiguration)}"
@@ -285,7 +285,7 @@
</bean>
<bean id="OAUTH2.Revocation.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.oauth2.config.OAuth2TokenRevocationConfiguration">
+ class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration">
<property name="tokenEndpointAuthMethodsLookupStrategy">
<bean parent="shibboleth.MDDrivenListProperty" p:propertyName="tokenEndpointAuthMethods">
<property name="defaultValue">
@@ -299,7 +299,7 @@
</bean>
<bean id="OAUTH2.Introspection.MDDriven" parent="AbstractMDDrivenOIDCProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.oauth2.config.OAuth2TokenIntrospectionConfiguration">
+ class="net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenIntrospectionConfiguration">
<property name="tokenEndpointAuthMethodsLookupStrategy">
<bean parent="shibboleth.MDDrivenListProperty" p:propertyName="tokenEndpointAuthMethods">
<property name="defaultValue">
@@ -332,7 +332,7 @@
-->
<bean id="shibboleth.oidc.DefaultSecurityConfiguration"
- class="net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCSecurityConfiguration">
+ class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
<property name="signatureSigningConfiguration">
<ref bean="#{'%{idp.oidc.signing.config:shibboleth.oidc.SigningConfiguration}'.trim()}" />
</property>
@@ -522,7 +522,7 @@
<!-- Configuration for publishing key set. -->
<bean id="shibboleth.oidc.PublishKeySetSecurityConfiguration"
- class="net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCSecurityConfiguration">
+ class="net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration">
<property name="signatureSigningConfiguration">
<ref bean="shibboleth.oidc.PublishKeySetSigningConfiguration" />
</property>
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/lib/json-web-key-generator-0.8.2-jar-with-dependencies.jar b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/lib/json-web-key-generator-0.8.2-jar-with-dependencies.jar
deleted file mode 100644
index c697d8af..00000000
Binary files a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/bin/lib/json-web-key-generator-0.8.2-jar-with-dependencies.jar and /dev/null differ
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/principal/AuthenticationContextClassReferencePrincipalTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/principal/AuthenticationContextClassReferencePrincipalTest.java
deleted file mode 100644
index d505a85d..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/authn/principal/AuthenticationContextClassReferencePrincipalTest.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.authn.principal;
-
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal;
-
-public class AuthenticationContextClassReferencePrincipalTest {
-
- private AuthenticationContextClassReferencePrincipal principal;
-
- @BeforeMethod
- protected void setUp() throws Exception {
- principal = new AuthenticationContextClassReferencePrincipal("testvalue");
- }
-
- @Test
- public void testEquals() {
- Assert.assertNotEquals(principal, null);
- Assert.assertEquals(principal, principal);
- Assert.assertEquals(principal, new AuthenticationContextClassReferencePrincipal("testvalue"));
- Assert.assertNotEquals(principal, new AuthenticationContextClassReferencePrincipal("testvalue2"));
- }
-
- @Test
- public void testClone() throws CloneNotSupportedException {
- Assert.assertEquals(principal, principal.clone());
- }
-
- @Test
- public void testToString() {
- Assert.assertEquals(principal.toString(),
- "AuthenticationContextClassReferencePrincipal{authnContextClassReference=" + principal.getName() + "}");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCCoreProtocolConfigurationTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCCoreProtocolConfigurationTest.java
deleted file mode 100644
index d3fd7c23..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/config/OIDCCoreProtocolConfigurationTest.java
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.config;
-
-import java.time.Duration;
-import java.util.Collections;
-
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
-import net.shibboleth.idp.profile.config.SecurityConfiguration;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-/**
- * Unit tests for {@link OIDCCoreProtocolConfiguration}.
- */
-public class OIDCCoreProtocolConfigurationTest {
-
- private OIDCCoreProtocolConfiguration config;
-
- @BeforeMethod
- protected void setUp() throws Exception {
- config = new OIDCCoreProtocolConfiguration();
- config.setSecurityConfiguration(new SecurityConfiguration());
- config.initialize();
- }
-
- @Test
- public void testInitialState() throws ComponentInitializationException {
- Assert.assertEquals(config.getId(), OIDCCoreProtocolConfiguration.PROFILE_ID);
- Assert.assertTrue(config.getAuthenticationFlows(null).isEmpty());
- Assert.assertTrue(config.getPostAuthenticationFlows(null).isEmpty());
- Assert.assertTrue(config.getDefaultAuthenticationMethods(null).isEmpty());
- Assert.assertTrue(config.getAdditionalAudiencesForIdToken(null).isEmpty());
- Assert.assertEquals(config.getAuthorizeCodeLifetime(null), Duration.ofMinutes(5));
- Assert.assertEquals(config.getIDTokenLifetime(null), Duration.ofHours(1));
- Assert.assertEquals(config.getAccessTokenLifetime(null), Duration.ofMinutes(10));
- Assert.assertEquals(config.getRefreshTokenLifetime(null), Duration.ofHours(2));
- Assert.assertFalse(config.isAcrRequestAlwaysEssential(null));
- Assert.assertTrue(config.getAdditionalAudiencesForIdToken(null).isEmpty());
- Assert.assertTrue(config.isResolveAttributes(null));
- }
-
- @Test
- void testsetResolveAttributes() {
- Assert.assertTrue(config.isResolveAttributes(null));
- config.setResolveAttributes(false);
- Assert.assertFalse(config.isResolveAttributes(null));
- }
-
- @Test
- void testsetDefaultAuthenticationMethods() {
- Assert.assertTrue(config.getDefaultAuthenticationMethods(null).isEmpty());
- config.setDefaultAuthenticationMethods(
- Collections.singletonList(new AuthenticationContextClassReferencePrincipal("value")));
- Assert.assertTrue(
- config.getDefaultAuthenticationMethods(null).contains(
- new AuthenticationContextClassReferencePrincipal("value")));
- }
-
- @Test
- void testsetRefreshTokenLifetime() {
- config.setRefreshTokenLifetime(Duration.ofMillis(100));
- Assert.assertEquals(config.getRefreshTokenLifetime(null), Duration.ofMillis(100));
- }
-
- @Test
- void testsetAccessTokenLifetime() {
- config.setAccessTokenLifetime(Duration.ofMillis(100));
- Assert.assertEquals(config.getAccessTokenLifetime(null), Duration.ofMillis(100));
- }
-
- @Test
- void testsetAuthorizeCodeLifetime() {
- config.setAuthorizeCodeLifetime(Duration.ofMillis(100));
- Assert.assertEquals(config.getAuthorizeCodeLifetime(null), Duration.ofMillis(100));
- }
-
- @Test
- void testsetIDTokenLifetime() {
- config.setIDTokenLifetime(Duration.ofMillis(100));
- Assert.assertEquals(config.getIDTokenLifetime(null), Duration.ofMillis(100));
- }
-
- @Test
- void testsetAcrRequestAlwaysEssential() {
- Assert.assertFalse(config.isAcrRequestAlwaysEssential(null));
- config.setAcrRequestAlwaysEssential(true);
- Assert.assertTrue(config.isAcrRequestAlwaysEssential(null));
- }
-
- @Test
- void testsetAdditionalAudiencesForIdToken() {
- Assert.assertTrue(config.getAdditionalAudiencesForIdToken(null).isEmpty());
- config.setAdditionalAudiencesForIdToken(Collections.singletonList("value"));
- Assert.assertTrue(config.getAdditionalAudiencesForIdToken(null).contains("value"));
- }
-
- @Test
- void testsetAuthenticationFlows() {
- Assert.assertTrue(config.getAuthenticationFlows(null).isEmpty());
- config.setAuthenticationFlows(Collections.singletonList("value"));
- Assert.assertTrue(config.getAuthenticationFlows(null).contains("value"));
- }
-
- @Test
- void testsetPostAuthenticationFlows() {
- Assert.assertTrue(config.getPostAuthenticationFlows(null).isEmpty());
- config.setPostAuthenticationFlows(Collections.singletonList("value"));
- Assert.assertTrue(config.getPostAuthenticationFlows(null).contains("value"));
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/CredentialMetadataValueResolverTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/CredentialMetadataValueResolverTest.java
index bf0b5b27..03204dc9 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/CredentialMetadataValueResolverTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/metadata/impl/CredentialMetadataValueResolverTest.java
@@ -32,12 +32,12 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCProviderInformationConfiguration;
import net.shibboleth.idp.plugin.oidc.op.profile.spring.factory.BasicJWKCredentialFactoryBean;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
+import net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/OAuth2TokenRevocationConfigurationTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/OAuth2TokenRevocationConfigurationTest.java
deleted file mode 100644
index 3a26c3f7..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/config/OAuth2TokenRevocationConfigurationTest.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oauth2.config;
-
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import net.shibboleth.idp.plugin.oidc.op.oauth2.config.OAuth2TokenRevocationConfiguration;
-
-import org.testng.Assert;
-
-/**
- * Tests for {@link OAuth2TokenRevocationConfiguration}, tests only constructors.
- */
-public class OAuth2TokenRevocationConfigurationTest {
-
- private OAuth2TokenRevocationConfiguration conf;
-
- @BeforeMethod
- protected void setUp() throws Exception {
- conf = new OAuth2TokenRevocationConfiguration();
- }
-
- @Test
- public void test() {
- Assert.assertEquals(OAuth2TokenRevocationConfiguration.PROFILE_ID, conf.getId());
- conf = new OAuth2TokenRevocationConfiguration("somethingelse");
- Assert.assertEquals("somethingelse", conf.getId());
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
index 1def710d..5bf93dac 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
@@ -35,7 +35,6 @@ import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.attribute.transcoding.BasicNamingFunction;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
import net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
@@ -43,6 +42,7 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder;
import net.shibboleth.oidc.attribute.transcoding.OIDCAttributeTranscoder;
import net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder;
+import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.test.service.MockReloadableService;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShellTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShellTest.java
index 0f258346..fd7e1ca5 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShellTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShellTest.java
@@ -17,10 +17,10 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-import net.shibboleth.idp.plugin.oidc.op.config.navigate.AudienceRestrictionsLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.AddIDTokenShell;
import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
+import net.shibboleth.oidc.profile.config.navigate.AudienceRestrictionsLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import org.springframework.webflow.execution.Event;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
index 5dc8c223..3421d71d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BaseOIDCResponseActionTest.java
@@ -25,7 +25,6 @@ import java.util.Date;
import java.util.List;
import javax.annotation.Nonnull;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
import net.shibboleth.idp.plugin.oidc.op.profile.spring.factory.BasicJWKCredentialFactoryBean;
@@ -33,6 +32,7 @@ import net.shibboleth.idp.plugin.oidc.op.storage.RevocationCache;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
+import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.security.DataSealer;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundKeySetResponseMessageTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundKeySetResponseMessageTest.java
index 4525ea8b..44bb4ee0 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundKeySetResponseMessageTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundKeySetResponseMessageTest.java
@@ -23,16 +23,15 @@ import java.util.List;
import net.minidev.json.JSONArray;
import net.minidev.json.JSONObject;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCPublishKeySetConfiguration;
import net.shibboleth.idp.plugin.oidc.op.messaging.JSONSuccessResponse;
-import net.shibboleth.idp.plugin.oidc.op.profile.config.OIDCSecurityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundKeySetResponseMessage;
import net.shibboleth.idp.plugin.oidc.op.profile.spring.factory.BasicJWKCredentialFactoryBean;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
+import net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import org.mockito.Mockito;
@@ -108,7 +107,10 @@ public class FormOutboundKeySetResponseMessageTest {
/**
* Test that action is able to form success message.
*
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
* @throws java.text.ParseException
+ * @throws JOSEException
*/
@Test
public void testSuccessMessage() throws ComponentInitializationException, URISyntaxException, ParseException,
@@ -116,7 +118,8 @@ public class FormOutboundKeySetResponseMessageTest {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertTrue(profileRequestCtx.getOutboundMessageContext().getMessage() instanceof JSONSuccessResponse);
- final JSONSuccessResponse resp = (JSONSuccessResponse) profileRequestCtx.getOutboundMessageContext().getMessage();
+ final JSONSuccessResponse resp =
+ (JSONSuccessResponse) profileRequestCtx.getOutboundMessageContext().getMessage();
Assert.assertTrue(resp.indicatesSuccess());
final JSONObject keyset = resp.toHTTPResponse().getContentAsJSONObject();
final JSONArray keys = (JSONArray) keyset.get("keys");
@@ -126,6 +129,11 @@ public class FormOutboundKeySetResponseMessageTest {
/**
* Test case of no sec conf.
+ *
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws JOSEException
*/
@Test
public void testFailNoSecConf()
@@ -137,6 +145,11 @@ public class FormOutboundKeySetResponseMessageTest {
/**
* Test case of no profile conf.
+ *
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws JOSEException
*/
@Test
public void testFailNoProfileConf()
@@ -148,6 +161,11 @@ public class FormOutboundKeySetResponseMessageTest {
/**
* Test case of no rp ctx.
+ *
+ * @throws ComponentInitializationException
+ * @throws URISyntaxException
+ * @throws ParseException
+ * @throws JOSEException
*/
@Test
public void testFailNoRPCtx()
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java
index c2832e41..49071b66 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java
@@ -21,9 +21,9 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.PreferredPrincipalContext;
import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
-import net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.ProcessRequestedAuthnContext;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
+import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import java.net.URI;
import java.util.ArrayList;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContextTest.java
index f50632ff..b5168a66 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContextTest.java
@@ -181,7 +181,7 @@ public class SetAccessTokenToResponseContextTest extends BaseOIDCResponseActionT
init();
profileRequestCtx.removeSubcontext(RelyingPartyContext.class);
final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ ActionTestingSupport.assertEvent(event, IdPEventIds.INVALID_PROFILE_CONFIG);
}
/**
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContextTest.java
index b1504e77..ceb58bc0 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContextTest.java
@@ -24,9 +24,9 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.PreferredPrincipalContext;
import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
import net.shibboleth.idp.authn.impl.DefaultAuthenticationResultSerializer;
-import net.shibboleth.idp.plugin.oidc.op.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAuthenticationContextClassReferenceToResponseContext;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
+import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import java.security.Principal;
import java.util.ArrayList;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContextTest.java
index 3a313e2b..64477c52 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContextTest.java
@@ -160,7 +160,7 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
init();
profileRequestCtx.removeSubcontext(RelyingPartyContext.class);
final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ ActionTestingSupport.assertEvent(event, IdPEventIds.INVALID_PROFILE_CONFIG);
}
/**
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java
index 3e31a9e0..9d70f423 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContextTest.java
@@ -19,10 +19,10 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.context.AttributeContext;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
+import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import java.util.HashSet;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContextTest.java
index 37016720..c7866766 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContextTest.java
@@ -94,7 +94,7 @@ public class SetRefreshTokenToResponseContextTest extends BaseOIDCResponseAction
throws NoSuchAlgorithmException, ComponentInitializationException, URISyntaxException {
profileRequestCtx.removeSubcontext(RelyingPartyContext.class);
final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ ActionTestingSupport.assertEvent(event, IdPEventIds.INVALID_PROFILE_CONFIG);
}
/**
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
index 8eca4b72..6031a713 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContextTest.java
@@ -34,7 +34,6 @@ import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.attribute.transcoding.BasicNamingFunction;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
import net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.SetTokenDeliveryAttributesToResponseContext;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
@@ -42,6 +41,7 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder;
import net.shibboleth.oidc.attribute.transcoding.OIDCAttributeTranscoder;
import net.shibboleth.oidc.attribute.transcoding.impl.OIDCStringAttributeTranscoder;
+import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.test.service.MockReloadableService;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
index e69b645c..b3465df7 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCETest.java
@@ -21,12 +21,12 @@ import java.net.URI;
import java.net.URISyntaxException;
import java.time.Instant;
-import net.shibboleth.idp.plugin.oidc.op.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.ValidatePKCE;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.RefreshTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
+import net.shibboleth.oidc.profile.config.OIDCCoreProtocolConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import org.opensaml.profile.action.EventIds;
diff --git a/pom.xml b/pom.xml
index 88494f67..f9082f31 100644
--- a/pom.xml
+++ b/pom.xml
@@ -15,7 +15,7 @@
<properties>
<shib.idp.version>4.2.0-SNAPSHOT</shib.idp.version>
<opensaml.version>4.2.0-SNAPSHOT</opensaml.version>
- <oidc.common.version>1.1.1-SNAPSHOT</oidc.common.version>
+ <oidc.common.version>1.2.0-SNAPSHOT</oidc.common.version>
<gson.version>2.8.6</gson.version>
<commons.io.version>2.6</commons.io.version>
<checkstyle.configLocation>${project.basedir}/resources/checkstyle.xml</checkstyle.configLocation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list