[java-oidc-common] branch main updated: JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
Scott Cantor
cantor.2 at osu.edu
Thu Dec 9 18:38:11 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=26b06c92d4378f8d95c3057951d5d643c0b67bd8
The following commit(s) were added to refs/heads/main by this push:
new 26b06c9 JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
26b06c9 is described below
commit 26b06c92d4378f8d95c3057951d5d643c0b67bd8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 9 13:38:08 2021 -0500
JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
https://shibboleth.atlassian.net/browse/JCOMOIDC-29
Refactor Authorization and Token endpoint classes.
---
...tion.java => AbstractOIDCSSOConfiguration.java} | 362 +--------------
.../config/OIDCAuthorizationConfiguration.java | 490 ++-------------------
.../profile/config/OIDCTokenConfiguration.java | 132 +++++-
.../config/logic/AllowPKCEPlainPredicate.java | 6 +-
.../AuthorizationCodeFlowEnabledPredicate.java | 2 +-
.../config/logic/EncodeConsentPredicate.java | 2 +-
.../profile/config/logic/ForcePKCEPredicate.java | 6 +-
.../config/logic/HybridFlowEnabledPredicate.java | 2 +-
.../config/logic/ImplicitFlowEnabledPredicate.java | 2 +-
.../logic/RefreshTokensEnabledPredicate.java | 2 +-
.../AccessTokenLifetimeLookupFunction.java | 8 +-
.../AcrClaimAlwaysEssentialLookupFunction.java | 2 +-
.../AlwaysIncludedAttributesLookupFunction.java | 8 +-
.../AudienceRestrictionsLookupFunction.java | 10 +-
.../navigate/AuthzCodeLifetimeLookupFunction.java | 2 +-
.../navigate/EncodedAttributesLookupFunction.java | 2 +-
.../navigate/IDTokenLifetimeLookupFunction.java | 8 +-
.../RefreshTokenLifetimeLookupFunction.java | 6 +-
.../RegistrationValidityPeriodLookupFunction.java | 2 +-
.../SecretExpirationPeriodLookupFunction.java | 2 +-
.../TokenEndpointAuthMethodLookupFunction.java | 3 +-
...atureValidationConfigurationLookupFunction.java | 2 +-
22 files changed, 221 insertions(+), 840 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
similarity index 60%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index 39af63f..8efaee9 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -48,19 +48,16 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Profile configuration for the OpenID Connect authorization endpoint.
- *
- * <p>For backward-compatibility it is also usable as a Token endpoint configuration but
- * this has been replaced by a dedicated class.</p>
+ * Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.
*/
-public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
+public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
/** OIDC base protocol URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
/** Whether attributes should be resolved in the course of the profile. */
@Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
@@ -68,21 +65,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
/** Whether to mandate forced authentication for the request. */
@Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
- /** Whether all acr claim requests should be treated as Essential. */
- @Nonnull private Predicate<ProfileRequestContext> acrRequestAlwaysEssentialPredicate;
-
- /** Whether client is required to use PKCE. */
- @Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
-
- /** Whether client is allowed to use PKCE code challenge method plain. */
- @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
-
- /** Whether to encode consent in authorization code and access/refresh tokens. */
- @Nonnull private Predicate<ProfileRequestContext> encodeConsentInTokensPredicate;
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
/** Lookup function to supply proxyCount property. */
@Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
@@ -99,64 +81,35 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
/** Lookup function to supply ID token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
- /** Lookup function to supply lifetime of authz code. */
- @Nonnull private Function<ProfileRequestContext,Duration> authorizeCodeLifetimeLookupStrategy;
-
/** Lookup function to supply access token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
- /** Lookup function to supply refresh token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
-
/** Lookup function to supply additional audiences for ID token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
-
- /** Lookup function to supply attribute IDs to embed in authorization code or access token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy;
/** Lookup function to supply attribute IDs to include in ID token regardless of response_type. */
@Nonnull private Function<ProfileRequestContext,Set<String>> alwaysIncludedAttributesLookupStrategy;
- /** Lookup function to supply attribute IDs to omit from UserInfo token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCAuthorizationConfiguration() {
- this(PROFILE_ID);
- }
-
/**
* Creates a new configuration instance.
*
* @param profileId Unique profile identifier.
*/
- public OIDCAuthorizationConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public AbstractOIDCSSOConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- forceAuthnPredicate = Predicates.alwaysFalse();
- resolveAttributesPredicate = Predicates.alwaysTrue();
issuerLookupStrategy = FunctionSupport.constant(null);
+ resolveAttributesPredicate = Predicates.alwaysTrue();
+
+ forceAuthnPredicate = Predicates.alwaysFalse();
proxyCountLookupStrategy = FunctionSupport.constant(null);
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
-
- idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
- authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
- refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
-
- acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
- forcePKCEPredicate = Predicates.alwaysFalse();
- allowPKCEPlainPredicate = Predicates.alwaysFalse();
- encodeConsentInTokensPredicate = Predicates.alwaysFalse();
-
defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
-
- encodedAttributesLookupStrategy = FunctionSupport.constant(null);
+
+ idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
+ accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
+ assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -452,87 +405,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
@Nullable final Function<ProfileRequestContext,Duration> strategy) {
accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
-
- /**
- * Get authz code lifetime.
- *
- * <p>Defaults to 5 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return authz code lifetime
- */
- @Positive @Nonnull
- public Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = authorizeCodeLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Authorization code lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of authz code.
- *
- * @param lifetime lifetime of authz code
- */
- public void setAuthorizeCodeLifetime(@Positive @Nonnull final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Authorization code lifetime must be greater than 0");
-
- authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the authz code lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setAuthorizeCodeLifetimeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- authorizeCodeLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get refresh token lifetime.
- *
- * <p>Defaults to 2 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return refresh token lifetime
- */
- @Nonnull @Positive
- public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of refresh token.
- *
- * @param lifetime lifetime of an refresh token
- */
- public void setRefreshTokenLifetime(@Nonnull @Positive final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token lifetime must be greater than 0");
-
- refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the refresh token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setRefreshTokenLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
/**
* Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
@@ -579,168 +451,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get whether all acr claim requests should be treated as Essential.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether all acr claim requests should be treated as Essential
- */
- public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
- return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether all acr claim requests should be treated as Essential.
- *
- * @param flag flag to set
- */
- public void setAcrRequestAlwaysEssential(final boolean flag) {
- acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether all acr claim requests should be treated as Essential.
- *
- * @param condition condition to set
- */
- public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether client is required to use PKCE.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is required to use PKCE
- */
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
- return forcePKCEPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is required to use PKCE.
- *
- * @param flag flag to set
- */
- public void setForcePKCE(final boolean flag) {
- forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is required to use PKCE.
- *
- * @param condition condition to set
- */
- public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether client is allowed to use PKCE code challenge method plain.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is allowed to use PKCE code challenge method plain
- */
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
- return allowPKCEPlainPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is allowed to use PKCE code challenge method plain.
- *
- * @param flag flag to set
- */
- public void setAllowPKCEPlain(final boolean flag) {
- allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is allowed to use PKCE code challenge method plain.
- *
- * @param condition condition to set
- */
- public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
-
- /**
- * Get whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to encode consent in authorization code and access/refresh tokens
- */
- public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
- return encodeConsentInTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param flag flag to set
- */
- public void setEncodeConsentInTokens(final boolean flag) {
- encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param condition condition to set
- */
- public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
- * and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to encode
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getEncodedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = encodedAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be encoded in encrypted form into the authorization code
- * and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param attributes the attribute IDs to encode
- */
- public void setEncodedAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- encodedAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- encodedAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the attribute IDs which should be encoded in encrypted form into the
- * authorization code and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param strategy lookup strategy
- */
- public void setEncodedAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- encodedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
/**
* Get the set of attribute IDs which should be included in the ID token regardless of response_type.
*
@@ -792,52 +502,4 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
alwaysIncludedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to omit from UserInfo token
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = deniedUserInfoAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param attributes the attribute IDs to omit from UserInfo token
- */
- public void setDeniedUserInfoAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * @param strategy lookup strategy
- */
- public void setDeniedUserInfoAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 39af63f..a2620a8 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -17,11 +17,9 @@
package net.shibboleth.oidc.profile.config;
-import java.security.Principal;
import java.time.Duration;
import java.util.Collection;
import java.util.Collections;
-import java.util.List;
import java.util.Set;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -35,16 +33,14 @@ import com.google.common.base.Predicates;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
@@ -53,20 +49,11 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* <p>For backward-compatibility it is also usable as a Token endpoint configuration but
* this has been replaced by a dedicated class.</p>
*/
-public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
+public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
- /** OIDC base protocol URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
-
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
-
- /** Whether attributes should be resolved in the course of the profile. */
- @Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
-
- /** Whether to mandate forced authentication for the request. */
- @Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
/** Whether all acr claim requests should be treated as Essential. */
@Nonnull private Predicate<ProfileRequestContext> acrRequestAlwaysEssentialPredicate;
@@ -80,43 +67,15 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
/** Whether to encode consent in authorization code and access/refresh tokens. */
@Nonnull private Predicate<ProfileRequestContext> encodeConsentInTokensPredicate;
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Lookup function to supply proxyCount property. */
- @Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
-
- /** Lookup function to supply default authentication methods. */
- @Nonnull private Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>>
- defaultAuthenticationContextsLookupStrategy;
-
- /** Lookup function to supply authentication flows. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy;
-
- /** Lookup function to supply post authentication flows. */
- @Nonnull private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy;
-
- /** Lookup function to supply ID token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
-
/** Lookup function to supply lifetime of authz code. */
@Nonnull private Function<ProfileRequestContext,Duration> authorizeCodeLifetimeLookupStrategy;
- /** Lookup function to supply access token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
-
/** Lookup function to supply refresh token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
-
- /** Lookup function to supply additional audiences for ID token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
/** Lookup function to supply attribute IDs to embed in authorization code or access token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy;
- /** Lookup function to supply attribute IDs to include in ID token regardless of response_type. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> alwaysIncludedAttributesLookupStrategy;
-
/** Lookup function to supply attribute IDs to omit from UserInfo token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
@@ -134,324 +93,19 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
*/
public OIDCAuthorizationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- forceAuthnPredicate = Predicates.alwaysFalse();
- resolveAttributesPredicate = Predicates.alwaysTrue();
- issuerLookupStrategy = FunctionSupport.constant(null);
- proxyCountLookupStrategy = FunctionSupport.constant(null);
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
-
- idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
+
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
-
- acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
+
forcePKCEPredicate = Predicates.alwaysFalse();
allowPKCEPlainPredicate = Predicates.alwaysFalse();
+
+ acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
encodeConsentInTokensPredicate = Predicates.alwaysFalse();
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
-
encodedAttributesLookupStrategy = FunctionSupport.constant(null);
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
}
-
- /** {@inheritDoc} */
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /**
- * Get whether attributes should be resolved during the profile.
- *
- * <p>Default is true</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff attributes should be resolved
- */
- public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
- return resolveAttributesPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether attributes should be resolved during the profile.
- *
- * @param flag flag to set
- */
- public void setResolveAttributes(final boolean flag) {
- resolveAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether attributes should be resolved during the profile.
- *
- * @param condition condition to set
- */
- public void setResolveAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
- return forceAuthnPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether a fresh user presence proof should be required for this request.
- *
- * @param flag flag to set
- */
- public void setForceAuthn(final boolean flag) {
- forceAuthnPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether a fresh user presence proof should be required for this request.
- *
- * @param condition condition to set
- */
- public void setForceAuthnPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
- final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- return count;
- }
-
- /**
- * Sets the maximum number of times an assertion may be proxied outbound and/or
- * the maximum number of hops between the relying party and a proxied authentication
- * authority inbound.
- *
- * @param count proxy count
- */
- public void setProxyCount(@Nullable @NonNegative final Integer count) {
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- proxyCountLookupStrategy = FunctionSupport.constant(count);
- }
-
- /**
- * Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or
- * the maximum number of hops between the relying party and a proxied authentication authority inbound.
- *
- * @param strategy lookup strategy
- */
- public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext,Integer> strategy) {
- proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return Set.copyOf(flows);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the authentication flows to use.
- *
- * @param flows flow identifiers to use
- */
- public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- authenticationFlowsLookupStrategy =
- FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication flows to use.
- *
- * @param strategy lookup strategy
- */
- public void setAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- authenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return List.copyOf(flows);
- }
- return Collections.emptyList();
- }
-
- /**
- * Set the ordered collection of post-authentication interceptor flows to enable.
- *
- * @param flows flow identifiers to enable
- */
- public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- postAuthenticationFlowsLookupStrategy =
- FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the post-authentication interceptor flows to enable.
- *
- * @param strategy lookup strategy
- */
- public void setPostAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
- postAuthenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<AuthenticationContextClassReferencePrincipal> methods =
- defaultAuthenticationContextsLookupStrategy.apply(profileRequestContext);
- if (methods != null) {
- return List.copyOf(methods);
- }
- return Collections.emptyList();
- }
-
- /**
- * Set the default authentication contexts to use, expressed as custom principals.
- *
- * @param contexts default authentication contexts to use
- */
- public void setDefaultAuthenticationMethods(
- @Nullable @NonnullElements final Collection<AuthenticationContextClassReferencePrincipal> contexts) {
- if (contexts != null) {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(List.copyOf(contexts));
- } else {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
- *
- * @param strategy lookup strategy
- */
- public void setDefaultAuthenticationMethodsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>>
- strategy) {
- defaultAuthenticationContextsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get ID token lifetime.
- *
- * <p>Defaults to 1 hour.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return ID token lifetime
- */
- @Positive @Nonnull public Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Duration lifetime = idTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "ID token lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of an id token.
- *
- * @param lifetime lifetime of an id token in milliseconds
- */
- public void setIDTokenLifetime(@Positive @Nonnull final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "ID token lifetime must be greater than 0");
-
- idTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the ID token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setIDTokenLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- idTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get access token lifetime.
- *
- * <p>Defaults to 10 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return access token lifetime
- */
- @Positive @Nonnull
- public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Access token lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of an access token.
- *
- * @param lifetime lifetime of an access token in milliseconds
- */
- public void setAccessTokenLifetime(@Positive @Nonnull final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Access token lifetime must be greater than 0");
-
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
-
- /**
- * Set a lookup strategy for the access token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setAccessTokenLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
/**
* Get authz code lifetime.
@@ -501,10 +155,13 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
* @param profileRequestContext profile request context
*
* @return refresh token lifetime
+ *
+ * @deprecated
*/
+ @Deprecated(since="1.2.0",forRemoval=true)
@Nonnull @Positive
public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
-
+ DeprecationSupport.warnOnce(ObjectType.CONFIGURATION, "refreshTokenLifetime", "OIDC.SSO", "OIDC.Token profile configuration");
final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
@@ -516,7 +173,10 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
* Set the lifetime of refresh token.
*
* @param lifetime lifetime of an refresh token
+ *
+ * @deprecated
*/
+ @Deprecated(since="1.2.0",forRemoval=true)
public void setRefreshTokenLifetime(@Nonnull @Positive final Duration lifetime) {
Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
"Refresh token lifetime must be greater than 0");
@@ -528,56 +188,14 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
* Set a lookup strategy for the refresh token lifetime.
*
* @param strategy lookup strategy
+ *
+ * @deprecated
*/
+ @Deprecated(since="1.2.0",forRemoval=true)
public void setRefreshTokenLifetimeLookupStrategy(
@Nullable final Function<ProfileRequestContext,Duration> strategy) {
refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
-
- /**
- * Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
- * which the token may be shared.
- *
- * @param profileRequestContext profile request context
- *
- * @return the additional audiences
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
- if (audiences != null) {
- return Set.copyOf(audiences);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
- * which the token may be shared.
- *
- * @param audiences the additional audiences
- */
- public void setAdditionalAudiencesForIdToken(@Nullable @NonnullElements final Collection<String> audiences) {
-
- if (audiences == null || audiences.isEmpty()) {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- } else {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(audiences)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of audiences, in addition to the relying party(ies) to which the IdP
- * is issuing the ID Token, with which the token may be shared.
- *
- * @param strategy lookup strategy
- */
- public void setAdditionalAudiencesForIdTokenLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
/**
* Get whether all acr claim requests should be treated as Essential.
@@ -614,8 +232,12 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
* @param profileRequestContext profile request context
*
* @return whether client is required to use PKCE
+ *
+ * @deprecated
*/
+ @Deprecated(since="1.2.0",forRemoval=true)
public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
+ DeprecationSupport.warnOnce(ObjectType.CONFIGURATION, "forcePKCE", "OIDC.SSO", "OIDC.Token profile configuration");
return forcePKCEPredicate.test(profileRequestContext);
}
@@ -623,7 +245,10 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
* Set whether client is required to use PKCE.
*
* @param flag flag to set
+ *
+ * @deprecated
*/
+ @Deprecated(since="1.2.0",forRemoval=true)
public void setForcePKCE(final boolean flag) {
forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
@@ -632,7 +257,10 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
* Set condition for whether client is required to use PKCE.
*
* @param condition condition to set
+ *
+ * @deprecated
*/
+ @Deprecated(since="1.2.0",forRemoval=true)
public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
@@ -643,8 +271,12 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
* @param profileRequestContext profile request context
*
* @return whether client is allowed to use PKCE code challenge method plain
+ *
+ * @deprecated
*/
+ @Deprecated(since="1.2.0",forRemoval=true)
public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
+ DeprecationSupport.warnOnce(ObjectType.CONFIGURATION, "allowPKCEPlain", "OIDC.SSO", "OIDC.Token profile configuration");
return allowPKCEPlainPredicate.test(profileRequestContext);
}
@@ -652,7 +284,10 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
* Set whether client is allowed to use PKCE code challenge method plain.
*
* @param flag flag to set
+ *
+ * @deprecated
*/
+ @Deprecated(since="1.2.0",forRemoval=true)
public void setAllowPKCEPlain(final boolean flag) {
allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
@@ -661,11 +296,13 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
* Set condition for whether client is allowed to use PKCE code challenge method plain.
*
* @param condition condition to set
+ *
+ * @deprecated
*/
+ @Deprecated(since="1.2.0",forRemoval=true)
public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
+ }
/**
* Get whether to encode consent in authorization code and access/refresh tokens.
@@ -741,57 +378,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOAuth2FlowAwareProfi
encodedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the set of attribute IDs which should be included in the ID token regardless of response_type.
- *
- * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
- * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
- * attributes to be added to the ID token regardless of flow.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to include in all cases
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getAlwaysIncludedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = alwaysIncludedAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be included in the ID token regardless of response_type.
- *
- * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
- * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
- * attributes to be added to the ID token regardless of flow.</p>
- *
- * @param attributes the attribute IDs to include in all cases
- */
- public void setAlwaysIncludedAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the attribute IDs which should be included in the ID token regardless of
- * response_type.
- *
- * @param strategy lookup strategy
- */
- public void setAlwaysIncludedAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- alwaysIncludedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
/**
* Get the set of attribute IDs which should be omitted from the UserInfo token.
*
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenConfiguration.java
index aff2e44..a54f7d0 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenConfiguration.java
@@ -17,21 +17,39 @@
package net.shibboleth.oidc.profile.config;
+import java.time.Duration;
+import java.util.function.Function;
+import java.util.function.Predicate;
+
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.google.common.base.Predicates;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * Marker interface for OIDC-specific profile configurations.
- *
- * <p>Such profiles may be OAuth-defined but if they include features specific to OIDC should
- * implement this interface as well.</p>
+ * OIDC-aware OAuth 2 token endpoint profile configuration.
*/
-public class OIDCTokenConfiguration extends OIDCAuthorizationConfiguration {
+public class OIDCTokenConfiguration extends AbstractOIDCSSOConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/token";
+ /** Whether client is required to use PKCE. */
+ @Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
+
+ /** Whether client is allowed to use PKCE code challenge method plain. */
+ @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
+
+ /** Lookup function to supply refresh token lifetime. */
+ @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
+
/**
* Constructor.
*/
@@ -46,6 +64,110 @@ public class OIDCTokenConfiguration extends OIDCAuthorizationConfiguration {
*/
public OIDCTokenConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
+
+ forcePKCEPredicate = Predicates.alwaysFalse();
+ allowPKCEPlainPredicate = Predicates.alwaysFalse();
+
+ refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
+ }
+
+ /**
+ * Get whether client is required to use PKCE.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is required to use PKCE
+ */
+ public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
+ return forcePKCEPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether client is required to use PKCE.
+ *
+ * @param flag flag to set
+ */
+ public void setForcePKCE(final boolean flag) {
+ forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether client is required to use PKCE.
+ *
+ * @param condition condition to set
+ */
+ public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Get whether client is allowed to use PKCE code challenge method plain.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is allowed to use PKCE code challenge method plain
+ */
+ public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
+ return allowPKCEPlainPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether client is allowed to use PKCE code challenge method plain.
+ *
+ * @param flag flag to set
+ */
+ public void setAllowPKCEPlain(final boolean flag) {
+ allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether client is allowed to use PKCE code challenge method plain.
+ *
+ * @param condition condition to set
+ */
+ public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Get refresh token lifetime.
+ *
+ * <p>Defaults to 2 hours.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return refresh token lifetime
+ */
+ @Nonnull @Positive
+ public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
+
+ final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
+
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Refresh token lifetime must be greater than 0");
+ return lifetime;
+ }
+
+ /**
+ * Set the lifetime of refresh token.
+ *
+ * @param lifetime lifetime of an refresh token
+ */
+ public void setRefreshTokenLifetime(@Nonnull @Positive final Duration lifetime) {
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Refresh token lifetime must be greater than 0");
+
+ refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
+ }
+
+ /**
+ * Set a lookup strategy for the refresh token lifetime.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRefreshTokenLifetimeLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,Duration> strategy) {
+ refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java
index 9862e83..ead881a 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java
@@ -25,6 +25,7 @@ import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCTokenConfiguration;
/**
* A predicate implementation that forwards to
@@ -33,11 +34,14 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
public class AllowPKCEPlainPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @SuppressWarnings("removal")
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
+ if (pc instanceof OIDCTokenConfiguration) {
+ return ((OIDCTokenConfiguration) pc).isAllowPKCEPlain(input);
+ } else if (pc instanceof OIDCAuthorizationConfiguration) {
return ((OIDCAuthorizationConfiguration) pc).isAllowPKCEPlain(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java
index 7517f6b..f071231 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java
@@ -37,7 +37,7 @@ public class AuthorizationCodeFlowEnabledPredicate extends AbstractRelyingPartyP
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
+ if (pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
return ((AbstractOAuth2FlowAwareProfileConfiguration) pc).isAuthorizationCodeFlowEnabled(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncodeConsentPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncodeConsentPredicate.java
index c999b78..07805ca 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncodeConsentPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncodeConsentPredicate.java
@@ -37,7 +37,7 @@ public class EncodeConsentPredicate extends AbstractRelyingPartyPredicate {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
+ if (pc instanceof OIDCAuthorizationConfiguration) {
return ((OIDCAuthorizationConfiguration) pc).isEncodeConsentInTokens(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java
index 8798ffe..d975a0d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java
@@ -25,6 +25,7 @@ import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCTokenConfiguration;
/**
* A predicate implementation that forwards to {@link OIDCAuthorizationConfiguration#isForcePKCE(ProfileRequestContext)}.
@@ -32,11 +33,14 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
public class ForcePKCEPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @SuppressWarnings("removal")
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
+ if (pc instanceof OIDCTokenConfiguration) {
+ return ((OIDCTokenConfiguration) pc).isForcePKCE(input);
+ } else if (pc instanceof OIDCAuthorizationConfiguration) {
return ((OIDCAuthorizationConfiguration) pc).isForcePKCE(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/HybridFlowEnabledPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/HybridFlowEnabledPredicate.java
index 60886fe..5e9b3d4 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/HybridFlowEnabledPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/HybridFlowEnabledPredicate.java
@@ -37,7 +37,7 @@ public class HybridFlowEnabledPredicate extends AbstractRelyingPartyPredicate {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
+ if (pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
return ((AbstractOAuth2FlowAwareProfileConfiguration) pc).isHybridFlowEnabled(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ImplicitFlowEnabledPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ImplicitFlowEnabledPredicate.java
index fd99011..b6c0771 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ImplicitFlowEnabledPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ImplicitFlowEnabledPredicate.java
@@ -37,7 +37,7 @@ public class ImplicitFlowEnabledPredicate extends AbstractRelyingPartyPredicate
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
+ if (pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
return ((AbstractOAuth2FlowAwareProfileConfiguration) pc).isImplicitFlowEnabled(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RefreshTokensEnabledPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RefreshTokensEnabledPredicate.java
index 29413b9..759475c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RefreshTokensEnabledPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RefreshTokensEnabledPredicate.java
@@ -37,7 +37,7 @@ public class RefreshTokensEnabledPredicate extends AbstractRelyingPartyPredicate
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
+ if (pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
return ((AbstractOAuth2FlowAwareProfileConfiguration) pc).isRefreshTokensEnabled(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java
index 7a168e6..1f14b5c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java
@@ -26,11 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
/**
* A function that returns
- * {@link OIDCAuthorizationConfiguration#getAccessTokenLifetime(ProfileRequestContext)}
+ * {@link AbstractOIDCSSOConfiguration#getAccessTokenLifetime(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -43,8 +43,8 @@ public class AccessTokenLifetimeLookupFunction extends AbstractRelyingPartyLooku
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration) pc).getAccessTokenLifetime(input);
+ if (pc instanceof AbstractOIDCSSOConfiguration) {
+ return ((AbstractOIDCSSOConfiguration) pc).getAccessTokenLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java
index 503a792..2dcb003 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java
@@ -43,7 +43,7 @@ public class AcrClaimAlwaysEssentialLookupFunction extends AbstractRelyingPartyP
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
+ if (pc instanceof OIDCAuthorizationConfiguration) {
return ((OIDCAuthorizationConfiguration) pc).isAcrRequestAlwaysEssential(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AlwaysIncludedAttributesLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AlwaysIncludedAttributesLookupFunction.java
index b5a9be2..a6bc26b 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AlwaysIncludedAttributesLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AlwaysIncludedAttributesLookupFunction.java
@@ -26,11 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
/**
* A function that obtains
- * {@link OIDCAuthorizationConfiguration#getAlwaysIncludedAttributes(ProfileRequestContext)}
+ * {@link AbstractOIDCSSOConfiguration#getAlwaysIncludedAttributes(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -44,8 +44,8 @@ public class AlwaysIncludedAttributesLookupFunction
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration)pc).getAlwaysIncludedAttributes(input);
+ if (pc instanceof AbstractOIDCSSOConfiguration) {
+ return ((AbstractOIDCSSOConfiguration)pc).getAlwaysIncludedAttributes(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AudienceRestrictionsLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AudienceRestrictionsLookupFunction.java
index 0291139..1fb97a7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AudienceRestrictionsLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AudienceRestrictionsLookupFunction.java
@@ -30,7 +30,7 @@ import com.google.common.collect.ImmutableCollection.Builder;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
@@ -38,7 +38,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
/**
* A function that returns the effective audience restrictions to include in ID tokens, based on combining a relying
* party's entityID with the result of
- * {@link OIDCAuthorizationConfiguration#getAdditionalAudiencesForIdToken(ProfileRequestContext)}, if such
+ * {@link AbstractOIDCSSOConfiguration#getAdditionalAudiencesForIdToken(ProfileRequestContext)}, if such
* a profile is available from a {@link RelyingPartyContext} obtained via a lookup function, by default a child of the
* {@link ProfileRequestContext}.
*
@@ -55,13 +55,13 @@ public class AudienceRestrictionsLookupFunction extends AbstractRelyingPartyLook
if (rpc != null) {
final String id = rpc.getRelyingPartyId();
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration
- && !((OIDCAuthorizationConfiguration) pc).getAdditionalAudiencesForIdToken(input).isEmpty()) {
+ if (pc instanceof AbstractOIDCSSOConfiguration
+ && !((AbstractOIDCSSOConfiguration) pc).getAdditionalAudiencesForIdToken(input).isEmpty()) {
final Builder<String> builder = ImmutableList.builder();
if (id != null) {
builder.add(rpc.getRelyingPartyId());
}
- builder.addAll(((OIDCAuthorizationConfiguration) pc).getAdditionalAudiencesForIdToken(input));
+ builder.addAll(((AbstractOIDCSSOConfiguration) pc).getAdditionalAudiencesForIdToken(input));
return builder.build();
} else if (id != null) {
return Collections.singletonList(rpc.getRelyingPartyId());
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthzCodeLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthzCodeLifetimeLookupFunction.java
index 0c789be..a934440 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthzCodeLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthzCodeLifetimeLookupFunction.java
@@ -43,7 +43,7 @@ public class AuthzCodeLifetimeLookupFunction extends AbstractRelyingPartyLookupF
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
+ if (pc instanceof OIDCAuthorizationConfiguration) {
return ((OIDCAuthorizationConfiguration) pc).getAuthorizeCodeLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/EncodedAttributesLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/EncodedAttributesLookupFunction.java
index b9a6c81..47e71eb 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/EncodedAttributesLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/EncodedAttributesLookupFunction.java
@@ -44,7 +44,7 @@ public class EncodedAttributesLookupFunction
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
+ if (pc instanceof OIDCAuthorizationConfiguration) {
return ((OIDCAuthorizationConfiguration)pc).getEncodedAttributes(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenLifetimeLookupFunction.java
index 6d2d45b..c676659 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenLifetimeLookupFunction.java
@@ -26,11 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
/**
* A function that returns
- * {@link OIDCAuthorizationConfiguration#getIDTokenLifetime(ProfileRequestContext)}
+ * {@link AbstractOIDCSSOConfiguration#getIDTokenLifetime(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -43,8 +43,8 @@ public class IDTokenLifetimeLookupFunction extends AbstractRelyingPartyLookupFun
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration) pc).getIDTokenLifetime(input);
+ if (pc instanceof AbstractOIDCSSOConfiguration) {
+ return ((AbstractOIDCSSOConfiguration) pc).getIDTokenLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
index ccc9459..b595c19 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
@@ -27,6 +27,7 @@ import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCTokenConfiguration;
/**
* A function that returns
@@ -39,11 +40,14 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
public class RefreshTokenLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
+ @SuppressWarnings("removal")
@Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCAuthorizationConfiguration) {
+ if (pc instanceof OIDCTokenConfiguration) {
+ return ((OIDCTokenConfiguration) pc).getRefreshTokenLifetime(input);
+ } else if (pc instanceof OIDCAuthorizationConfiguration) {
return ((OIDCAuthorizationConfiguration) pc).getRefreshTokenLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationValidityPeriodLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationValidityPeriodLookupFunction.java
index b26ed41..544fb57 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationValidityPeriodLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationValidityPeriodLookupFunction.java
@@ -43,7 +43,7 @@ public class RegistrationValidityPeriodLookupFunction extends AbstractRelyingPar
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCDynamicRegistrationConfiguration) {
+ if (pc instanceof OIDCDynamicRegistrationConfiguration) {
return ((OIDCDynamicRegistrationConfiguration) pc).getRegistrationValidityPeriod(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/SecretExpirationPeriodLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/SecretExpirationPeriodLookupFunction.java
index 5c59ddf..da1d390 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/SecretExpirationPeriodLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/SecretExpirationPeriodLookupFunction.java
@@ -43,7 +43,7 @@ public class SecretExpirationPeriodLookupFunction extends AbstractRelyingPartyLo
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCDynamicRegistrationConfiguration) {
+ if (pc instanceof OIDCDynamicRegistrationConfiguration) {
return ((OIDCDynamicRegistrationConfiguration) pc).getSecretExpirationPeriod(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java
index 128c82b..cc8441d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java
@@ -49,8 +49,7 @@ public class TokenEndpointAuthMethodLookupFunction
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof AbstractOAuth2ClientAuthenticableProfileConfiguration) {
-
+ if (pc instanceof AbstractOAuth2ClientAuthenticableProfileConfiguration) {
final Collection<String> methods =
((AbstractOAuth2ClientAuthenticableProfileConfiguration)pc).getTokenEndpointAuthMethods(input);
if (methods != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointJwtSignatureValidationConfigurationLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointJwtSignatureValidationConfigurationLookupFunction.java
index 72e50fe..7f724bf 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointJwtSignatureValidationConfigurationLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointJwtSignatureValidationConfigurationLookupFunction.java
@@ -63,7 +63,7 @@ public class TokenEndpointJwtSignatureValidationConfigurationLookupFunction
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
+ if (pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
&& ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
.getTokenEndpointJwtSignatureValidationConfiguration() != null) {
configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list