[java-oidc-common] branch main updated: Add useRequestObject configuration parameter to OIDC profile config

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=3bcab9659b71ebbd0d7ed418b963a4e336f55c10

The following commit(s) were added to refs/heads/main by this push:
     new 3bcab96  Add useRequestObject configuration parameter to OIDC profile config
3bcab96 is described below

commit 3bcab9659b71ebbd0d7ed418b963a4e336f55c10
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Dec 14 15:36:50 2021 +0000

    Add useRequestObject configuration parameter to OIDC profile config
    
    To allow the profile config to specify if a Request Object JWT should be
    used to encode authorization request parameters
---
 .../config/OIDCAuthorizationConfiguration.java     | 35 ++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index ebc7da7..6269564 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -64,6 +64,9 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
     
     /** Lookup function to supply attribute IDs to embed in authorization code or access token. */
     @Nonnull private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy;
+    
+    /** Whether to encode authentication request parameters inside a JWT request object.*/
+    @Nonnull private Predicate<ProfileRequestContext> useRequestObjectPredicate;
 
     /** Lookup function to supply attribute IDs to omit from UserInfo token. */
     @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
@@ -105,6 +108,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
 
         acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
         encodeConsentInTokensPredicate = Predicates.alwaysFalse();
+        useRequestObjectPredicate = Predicates.alwaysFalse();
         
         encodedAttributesLookupStrategy = FunctionSupport.constant(null);
         deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
@@ -179,6 +183,37 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
     public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
         acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
     }
+    
+    /**
+     * Set condition for whether the authentication request parameters should be passed in a single, 
+     * self contained, JWT. 
+     * 
+     * @param condition condition to set
+     */
+    public void setUseRequestObjectPredicate(
+            @Nonnull final Predicate<ProfileRequestContext> condition) {
+        useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
+    }
+    
+    /**
+     * Set whether the authentication request parameters should be passed in a single, self contained, JWT. 
+     *
+     * @param flag flag to set
+     */
+    public void setUseRequestObjectPredicate(final boolean flag) {
+        useRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+    }
+    
+    /**
+     * Should authentication request parameters should be passed in a single, self contained, JWT?
+     * 
+     * @param profileRequestContext the profile request context
+     * 
+     * @return whether authentication request parameters should be passed in a single, self contained, JWT
+     */
+    public boolean isUseRequestObjectPredicate(@Nullable final ProfileRequestContext profileRequestContext) {
+        return useRequestObjectPredicate.test(profileRequestContext);
+    }
 
     /**
      * Get whether to encode consent in authorization code and access/refresh tokens.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.