[java-oidc-common] branch main updated: Add OIDC HTTP authentication request method

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=1a0ebefa2ebaa7ad9be1246a8bd1d800ba09f943

The following commit(s) were added to refs/heads/main by this push:
     new 1a0ebef  Add OIDC HTTP authentication request method
1a0ebef is described below

commit 1a0ebefa2ebaa7ad9be1246a8bd1d800ba09f943
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Dec 14 11:53:40 2021 +0000

    Add OIDC HTTP authentication request method
    
    See section 3.1.2.1 of openid-connect-core 1.0.
    
    This seems to extend the OAuth2.0 authorization request to include POST
    - OAuth2 seems to only support GET. If that is not true, this should be
    moved up the hierarchy to oner of the OAuth2 configuration classes.
---
 .../config/OIDCAuthorizationConfiguration.java     | 59 ++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 687f504..ebc7da7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -38,6 +38,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
 import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
 import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
 import net.shibboleth.utilities.java.support.logic.FunctionSupport;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
@@ -66,6 +67,24 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
 
     /** Lookup function to supply attribute IDs to omit from UserInfo token. */
     @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
+    
+    /** Enumeration of the HTTP methods used in OIDC authentication requests.*/
+    public enum OIDCHttpRequestMethod {    
+        /**
+         * HTTP GET.
+         */
+        GET,                
+        /**
+         * HTTP POST.
+         */
+        POST
+    }
+    
+    /** 
+     * Which HTTP method should be used to issue OIDC authentication requests. 
+     * Supported values are POST and GET. The default is GET. 
+     */
+    @Nonnull private Function<ProfileRequestContext,OIDCHttpRequestMethod> httpRequestMethodLookupStrategy;
 
     /**
      * Constructor.
@@ -89,6 +108,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
         
         encodedAttributesLookupStrategy = FunctionSupport.constant(null);
         deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
+        httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
     }
 
     /**
@@ -188,6 +208,45 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
     public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
         encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
     }
+    
+    /**
+     * Set a lookup strategy to determine the HTTP request method for an authentication request.
+     * 
+     * @param strategy the strategy to set.
+     */
+    public void setHttpRequestMethodLookupStrategy(
+            @Nonnull Function<ProfileRequestContext, OIDCHttpRequestMethod> strategy) {
+        httpRequestMethodLookupStrategy = 
+                Constraint.isNotNull(strategy, "HTTP request method strategy can not be null");
+    }
+    
+    /**
+     * Set the HTTP request method for an authentication request.
+     * 
+     * @param method the HTTP method to set, either POST or GET.
+     */
+    public void setHttpRequestMethod(@Nonnull @NotEmpty final String method){
+        Constraint.isNotEmpty(method, "HTTP request method strategy can not be null or empty");
+        if ("POST".equals(method)) {
+            httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.POST);
+        } else if ("GET".equals(method)) {
+            httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
+        } else {
+            throw new ConstraintViolationException("OIDC HTTP request method not "
+                    + "recognized, must be one of POST or GET");
+        }
+    }
+    
+    /**
+     * Get the HTTP request method for an authentication request.
+     * 
+     * @param profileRequestContext profile request context
+     * 
+     * @return the HTTP request method
+     */
+    public OIDCHttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext) {
+        return httpRequestMethodLookupStrategy.apply(profileRequestContext);
+    }
 
     /**
      * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.