[java-oidc-common] branch main updated: JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
Scott Cantor
cantor.2 at osu.edu
Fri Dec 10 14:30:34 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=9602e958b3f3f7e53547d44cba0774cfe58bbde3
The following commit(s) were added to refs/heads/main by this push:
new 9602e95 JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
9602e95 is described below
commit 9602e958b3f3f7e53547d44cba0774cfe58bbde3
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Dec 10 09:29:53 2021 -0500
JCOMOIDC-29 - Consider adjustments to OIDC/OAuth profile configs
https://shibboleth.atlassian.net/browse/JCOMOIDC-29
Revert some of refactoring after further review.
---
.../config/AbstractOIDCSSOConfiguration.java | 116 +++++++++++++++-
.../config/OIDCAuthorizationConfiguration.java | 146 +--------------------
.../profile/config/OIDCTokenConfiguration.java | 125 ------------------
.../config/logic/AllowPKCEPlainPredicate.java | 12 +-
.../profile/config/logic/ForcePKCEPredicate.java | 12 +-
.../RefreshTokenLifetimeLookupFunction.java | 12 +-
6 files changed, 128 insertions(+), 295 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index 8efaee9..f9998ea 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -78,12 +78,21 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** Lookup function to supply post authentication flows. */
@Nonnull private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy;
+ /** Whether client is required to use PKCE. */
+ @Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
+
+ /** Whether client is allowed to use PKCE code challenge method plain. */
+ @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
+
/** Lookup function to supply ID token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
/** Lookup function to supply access token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
+ /** Lookup function to supply refresh token lifetime. */
+ @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
+
/** Lookup function to supply additional audiences for ID token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
@@ -105,9 +114,14 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
-
+
+ forcePKCEPredicate = Predicates.alwaysFalse();
+ allowPKCEPlainPredicate = Predicates.alwaysFalse();
+
idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
+ refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
+
assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
}
@@ -326,6 +340,66 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
defaultAuthenticationContextsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /**
+ * Get whether client is required to use PKCE.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is required to use PKCE
+ */
+ public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
+ return forcePKCEPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether client is required to use PKCE.
+ *
+ * @param flag flag to set
+ */
+ public void setForcePKCE(final boolean flag) {
+ forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether client is required to use PKCE.
+ *
+ * @param condition condition to set
+ */
+ public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Get whether client is allowed to use PKCE code challenge method plain.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is allowed to use PKCE code challenge method plain
+ */
+ public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
+ return allowPKCEPlainPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether client is allowed to use PKCE code challenge method plain.
+ *
+ * @param flag flag to set
+ */
+ public void setAllowPKCEPlain(final boolean flag) {
+ allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether client is allowed to use PKCE code challenge method plain.
+ *
+ * @param condition condition to set
+ */
+ public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+
/**
* Get ID token lifetime.
*
@@ -406,6 +480,46 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /**
+ * Get refresh token lifetime.
+ *
+ * <p>Defaults to 2 hours.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return refresh token lifetime
+ */
+ @Nonnull @Positive
+ public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
+
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Refresh token lifetime must be greater than 0");
+ return lifetime;
+ }
+
+ /**
+ * Set the lifetime of refresh token.
+ *
+ * @param lifetime lifetime of an refresh token
+ */
+ public void setRefreshTokenLifetime(@Nonnull @Positive final Duration lifetime) {
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Refresh token lifetime must be greater than 0");
+
+ refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
+ }
+
+ /**
+ * Set a lookup strategy for the refresh token lifetime.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRefreshTokenLifetimeLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,Duration> strategy) {
+ refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
/**
* Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
* which the token may be shared.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index a2620a8..687f504 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -39,15 +39,12 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
* Profile configuration for the OpenID Connect authorization endpoint.
*
- * <p>For backward-compatibility it is also usable as a Token endpoint configuration but
- * this has been replaced by a dedicated class.</p>
+ * <p>It is also usable as a Token endpoint configuration if no non-OIDC use cases are needed.</p>
*/
public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
@@ -58,20 +55,11 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
/** Whether all acr claim requests should be treated as Essential. */
@Nonnull private Predicate<ProfileRequestContext> acrRequestAlwaysEssentialPredicate;
- /** Whether client is required to use PKCE. */
- @Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
-
- /** Whether client is allowed to use PKCE code challenge method plain. */
- @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
-
/** Whether to encode consent in authorization code and access/refresh tokens. */
@Nonnull private Predicate<ProfileRequestContext> encodeConsentInTokensPredicate;
/** Lookup function to supply lifetime of authz code. */
@Nonnull private Function<ProfileRequestContext,Duration> authorizeCodeLifetimeLookupStrategy;
-
- /** Lookup function to supply refresh token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
/** Lookup function to supply attribute IDs to embed in authorization code or access token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy;
@@ -95,10 +83,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
super(profileId);
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
- refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
-
- forcePKCEPredicate = Predicates.alwaysFalse();
- allowPKCEPlainPredicate = Predicates.alwaysFalse();
acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
encodeConsentInTokensPredicate = Predicates.alwaysFalse();
@@ -147,56 +131,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
authorizeCodeLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get refresh token lifetime.
- *
- * <p>Defaults to 2 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return refresh token lifetime
- *
- * @deprecated
- */
- @Deprecated(since="1.2.0",forRemoval=true)
- @Nonnull @Positive
- public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- DeprecationSupport.warnOnce(ObjectType.CONFIGURATION, "refreshTokenLifetime", "OIDC.SSO", "OIDC.Token profile configuration");
- final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of refresh token.
- *
- * @param lifetime lifetime of an refresh token
- *
- * @deprecated
- */
- @Deprecated(since="1.2.0",forRemoval=true)
- public void setRefreshTokenLifetime(@Nonnull @Positive final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token lifetime must be greater than 0");
-
- refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the refresh token lifetime.
- *
- * @param strategy lookup strategy
- *
- * @deprecated
- */
- @Deprecated(since="1.2.0",forRemoval=true)
- public void setRefreshTokenLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
/**
* Get whether all acr claim requests should be treated as Essential.
*
@@ -226,84 +160,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Get whether client is required to use PKCE.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is required to use PKCE
- *
- * @deprecated
- */
- @Deprecated(since="1.2.0",forRemoval=true)
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
- DeprecationSupport.warnOnce(ObjectType.CONFIGURATION, "forcePKCE", "OIDC.SSO", "OIDC.Token profile configuration");
- return forcePKCEPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is required to use PKCE.
- *
- * @param flag flag to set
- *
- * @deprecated
- */
- @Deprecated(since="1.2.0",forRemoval=true)
- public void setForcePKCE(final boolean flag) {
- forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is required to use PKCE.
- *
- * @param condition condition to set
- *
- * @deprecated
- */
- @Deprecated(since="1.2.0",forRemoval=true)
- public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether client is allowed to use PKCE code challenge method plain.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is allowed to use PKCE code challenge method plain
- *
- * @deprecated
- */
- @Deprecated(since="1.2.0",forRemoval=true)
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
- DeprecationSupport.warnOnce(ObjectType.CONFIGURATION, "allowPKCEPlain", "OIDC.SSO", "OIDC.Token profile configuration");
- return allowPKCEPlainPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is allowed to use PKCE code challenge method plain.
- *
- * @param flag flag to set
- *
- * @deprecated
- */
- @Deprecated(since="1.2.0",forRemoval=true)
- public void setAllowPKCEPlain(final boolean flag) {
- allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is allowed to use PKCE code challenge method plain.
- *
- * @param condition condition to set
- *
- * @deprecated
- */
- @Deprecated(since="1.2.0",forRemoval=true)
- public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
/**
* Get whether to encode consent in authorization code and access/refresh tokens.
*
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenConfiguration.java
index a54f7d0..99bf239 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenConfiguration.java
@@ -17,21 +17,9 @@
package net.shibboleth.oidc.profile.config;
-import java.time.Duration;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.google.common.base.Predicates;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
* OIDC-aware OAuth 2 token endpoint profile configuration.
@@ -41,15 +29,6 @@ public class OIDCTokenConfiguration extends AbstractOIDCSSOConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/token";
- /** Whether client is required to use PKCE. */
- @Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
-
- /** Whether client is allowed to use PKCE code challenge method plain. */
- @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
-
- /** Lookup function to supply refresh token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
-
/**
* Constructor.
*/
@@ -64,110 +43,6 @@ public class OIDCTokenConfiguration extends AbstractOIDCSSOConfiguration {
*/
public OIDCTokenConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
-
- forcePKCEPredicate = Predicates.alwaysFalse();
- allowPKCEPlainPredicate = Predicates.alwaysFalse();
-
- refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
- }
-
- /**
- * Get whether client is required to use PKCE.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is required to use PKCE
- */
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
- return forcePKCEPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is required to use PKCE.
- *
- * @param flag flag to set
- */
- public void setForcePKCE(final boolean flag) {
- forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is required to use PKCE.
- *
- * @param condition condition to set
- */
- public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether client is allowed to use PKCE code challenge method plain.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is allowed to use PKCE code challenge method plain
- */
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
- return allowPKCEPlainPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether client is allowed to use PKCE code challenge method plain.
- *
- * @param flag flag to set
- */
- public void setAllowPKCEPlain(final boolean flag) {
- allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether client is allowed to use PKCE code challenge method plain.
- *
- * @param condition condition to set
- */
- public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get refresh token lifetime.
- *
- * <p>Defaults to 2 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return refresh token lifetime
- */
- @Nonnull @Positive
- public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of refresh token.
- *
- * @param lifetime lifetime of an refresh token
- */
- public void setRefreshTokenLifetime(@Nonnull @Positive final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Refresh token lifetime must be greater than 0");
-
- refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the refresh token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setRefreshTokenLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java
index ead881a..72b0ec9 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java
@@ -24,25 +24,21 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCTokenConfiguration;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
/**
* A predicate implementation that forwards to
- * {@link OIDCAuthorizationConfiguration#isAllowPKCEPlain(ProfileRequestContext)}.
+ * {@link AbstractOIDCSSOConfiguration#isAllowPKCEPlain(ProfileRequestContext)}.
*/
public class AllowPKCEPlainPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
- @SuppressWarnings("removal")
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCTokenConfiguration) {
- return ((OIDCTokenConfiguration) pc).isAllowPKCEPlain(input);
- } else if (pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration) pc).isAllowPKCEPlain(input);
+ if (pc instanceof AbstractOIDCSSOConfiguration) {
+ return ((AbstractOIDCSSOConfiguration) pc).isAllowPKCEPlain(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java
index d975a0d..2122f34 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java
@@ -24,24 +24,20 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCTokenConfiguration;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
/**
- * A predicate implementation that forwards to {@link OIDCAuthorizationConfiguration#isForcePKCE(ProfileRequestContext)}.
+ * A predicate implementation that forwards to {@link AbstractOIDCSSOConfiguration#isForcePKCE(ProfileRequestContext)}.
*/
public class ForcePKCEPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
- @SuppressWarnings("removal")
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCTokenConfiguration) {
- return ((OIDCTokenConfiguration) pc).isForcePKCE(input);
- } else if (pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration) pc).isForcePKCE(input);
+ if (pc instanceof AbstractOIDCSSOConfiguration) {
+ return ((AbstractOIDCSSOConfiguration) pc).isForcePKCE(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
index b595c19..84c4b42 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
@@ -26,12 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCTokenConfiguration;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
/**
* A function that returns
- * {@link OIDCAuthorizationConfiguration#getRefreshTokenLifetime(ProfileRequestContext)}
+ * {@link AbstractOIDCSSOConfiguration#getRefreshTokenLifetime(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -40,15 +39,12 @@ import net.shibboleth.oidc.profile.config.OIDCTokenConfiguration;
public class RefreshTokenLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
- @SuppressWarnings("removal")
@Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCTokenConfiguration) {
- return ((OIDCTokenConfiguration) pc).getRefreshTokenLifetime(input);
- } else if (pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration) pc).getRefreshTokenLifetime(input);
+ if (pc instanceof AbstractOIDCSSOConfiguration) {
+ return ((AbstractOIDCSSOConfiguration) pc).getRefreshTokenLifetime(input);
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list