[java-oidc-common] branch main updated: Move login flow settings up to base class for use by OAuth flows.
Scott Cantor
cantor.2 at osu.edu
Tue Dec 21 19:39:12 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=ce7020f9af625b931f78068c7fd45ef431f6ccef
The following commit(s) were added to refs/heads/main by this push:
new ce7020f Move login flow settings up to base class for use by OAuth flows.
ce7020f is described below
commit ce7020f9af625b931f78068c7fd45ef431f6ccef
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 21 14:38:46 2021 -0500
Move login flow settings up to base class for use by OAuth flows.
---
.../config/AbstractOIDCSSOConfiguration.java | 187 --------------------
...th2ClientAuthenticableProfileConfiguration.java | 191 ++++++++++++++++++++-
2 files changed, 190 insertions(+), 188 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index f9998ea..0c4ca13 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -17,11 +17,9 @@
package net.shibboleth.oidc.profile.config;
-import java.security.Principal;
import java.time.Duration;
import java.util.Collection;
import java.util.Collections;
-import java.util.List;
import java.util.Set;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -35,14 +33,11 @@ import com.google.common.base.Predicates;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
@@ -62,22 +57,6 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** Whether attributes should be resolved in the course of the profile. */
@Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
- /** Whether to mandate forced authentication for the request. */
- @Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
-
- /** Lookup function to supply proxyCount property. */
- @Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
-
- /** Lookup function to supply default authentication methods. */
- @Nonnull private Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>>
- defaultAuthenticationContextsLookupStrategy;
-
- /** Lookup function to supply authentication flows. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy;
-
- /** Lookup function to supply post authentication flows. */
- @Nonnull private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy;
-
/** Whether client is required to use PKCE. */
@Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
@@ -109,12 +88,6 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
issuerLookupStrategy = FunctionSupport.constant(null);
resolveAttributesPredicate = Predicates.alwaysTrue();
- forceAuthnPredicate = Predicates.alwaysFalse();
- proxyCountLookupStrategy = FunctionSupport.constant(null);
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
-
forcePKCEPredicate = Predicates.alwaysFalse();
allowPKCEPlainPredicate = Predicates.alwaysFalse();
@@ -180,165 +153,6 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
}
- /** {@inheritDoc} */
- public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
- return forceAuthnPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether a fresh user presence proof should be required for this request.
- *
- * @param flag flag to set
- */
- public void setForceAuthn(final boolean flag) {
- forceAuthnPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether a fresh user presence proof should be required for this request.
- *
- * @param condition condition to set
- */
- public void setForceAuthnPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
- final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- return count;
- }
-
- /**
- * Sets the maximum number of times an assertion may be proxied outbound and/or
- * the maximum number of hops between the relying party and a proxied authentication
- * authority inbound.
- *
- * @param count proxy count
- */
- public void setProxyCount(@Nullable @NonNegative final Integer count) {
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- proxyCountLookupStrategy = FunctionSupport.constant(count);
- }
-
- /**
- * Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or
- * the maximum number of hops between the relying party and a proxied authentication authority inbound.
- *
- * @param strategy lookup strategy
- */
- public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext,Integer> strategy) {
- proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return Set.copyOf(flows);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the authentication flows to use.
- *
- * @param flows flow identifiers to use
- */
- public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- authenticationFlowsLookupStrategy =
- FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication flows to use.
- *
- * @param strategy lookup strategy
- */
- public void setAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- authenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
- if (flows != null) {
- return List.copyOf(flows);
- }
- return Collections.emptyList();
- }
-
- /**
- * Set the ordered collection of post-authentication interceptor flows to enable.
- *
- * @param flows flow identifiers to enable
- */
- public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
- if (flows != null) {
- postAuthenticationFlowsLookupStrategy =
- FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(flows)));
- } else {
- postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the post-authentication interceptor flows to enable.
- *
- * @param strategy lookup strategy
- */
- public void setPostAuthenticationFlowsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
- postAuthenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<AuthenticationContextClassReferencePrincipal> methods =
- defaultAuthenticationContextsLookupStrategy.apply(profileRequestContext);
- if (methods != null) {
- return List.copyOf(methods);
- }
- return Collections.emptyList();
- }
-
- /**
- * Set the default authentication contexts to use, expressed as custom principals.
- *
- * @param contexts default authentication contexts to use
- */
- public void setDefaultAuthenticationMethods(
- @Nullable @NonnullElements final Collection<AuthenticationContextClassReferencePrincipal> contexts) {
- if (contexts != null) {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(List.copyOf(contexts));
- } else {
- defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
- *
- * @param strategy lookup strategy
- */
- public void setDefaultAuthenticationMethodsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>>
- strategy) {
- defaultAuthenticationContextsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
/**
* Get whether client is required to use PKCE.
@@ -468,7 +282,6 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
}
-
/**
* Set a lookup strategy for the access token lifetime.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index 8be3087..321ad8b 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -17,19 +17,26 @@
package net.shibboleth.oidc.profile.oauth2.config;
+import java.security.Principal;
import java.util.Collection;
import java.util.Collections;
+import java.util.List;
import java.util.Set;
import java.util.function.Function;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.google.common.base.Predicates;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
+import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
+import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
@@ -42,11 +49,27 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Base class for OAuth profile configurations that support OAuth-defined client authentication methods.
*/
public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
- extends AbstractConditionalProfileConfiguration implements OAuth2ProfileConfiguration {
+ extends AbstractConditionalProfileConfiguration implements OAuth2ProfileConfiguration, AuthenticationProfileConfiguration {
/** Enabled token endpoint authentication methods. */
@Nonnull private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy;
+ /** Whether to mandate forced authentication for the request. */
+ @Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
+
+ /** Lookup function to supply proxyCount property. */
+ @Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
+
+ /** Lookup function to supply default authentication methods. */
+ @Nonnull private Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>>
+ defaultAuthenticationContextsLookupStrategy;
+
+ /** Lookup function to supply authentication flows. */
+ @Nonnull private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy;
+
+ /** Lookup function to supply post authentication flows. */
+ @Nonnull private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy;
+
/**
* Constructor.
*
@@ -61,6 +84,12 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
ClientAuthenticationMethod.CLIENT_SECRET_POST.toString(),
ClientAuthenticationMethod.CLIENT_SECRET_JWT.toString(),
ClientAuthenticationMethod.PRIVATE_KEY_JWT.toString()));
+
+ forceAuthnPredicate = Predicates.alwaysFalse();
+ proxyCountLookupStrategy = FunctionSupport.constant(null);
+ defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
+ authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
+ postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
}
/**
@@ -106,4 +135,164 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
tokenEndpointAuthMethodsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
+ return forceAuthnPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether a fresh user presence proof should be required for this request.
+ *
+ * @param flag flag to set
+ */
+ public void setForceAuthn(final boolean flag) {
+ forceAuthnPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether a fresh user presence proof should be required for this request.
+ *
+ * @param condition condition to set
+ */
+ public void setForceAuthnPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
+ if (count != null) {
+ Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
+ }
+ return count;
+ }
+
+ /**
+ * Sets the maximum number of times an assertion may be proxied outbound and/or
+ * the maximum number of hops between the relying party and a proxied authentication
+ * authority inbound.
+ *
+ * @param count proxy count
+ */
+ public void setProxyCount(@Nullable @NonNegative final Integer count) {
+ if (count != null) {
+ Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
+ }
+ proxyCountLookupStrategy = FunctionSupport.constant(count);
+ }
+
+ /**
+ * Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or
+ * the maximum number of hops between the relying party and a proxied authentication authority inbound.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext,Integer> strategy) {
+ proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
+ if (flows != null) {
+ return Set.copyOf(flows);
+ }
+ return Collections.emptySet();
+ }
+
+ /**
+ * Set the authentication flows to use.
+ *
+ * @param flows flow identifiers to use
+ */
+ public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+ if (flows != null) {
+ authenticationFlowsLookupStrategy =
+ FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(flows)));
+ } else {
+ authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
+ }
+ }
+
+ /**
+ * Set a lookup strategy for the authentication flows to use.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAuthenticationFlowsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
+ authenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
+ if (flows != null) {
+ return List.copyOf(flows);
+ }
+ return Collections.emptyList();
+ }
+
+ /**
+ * Set the ordered collection of post-authentication interceptor flows to enable.
+ *
+ * @param flows flow identifiers to enable
+ */
+ public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+ if (flows != null) {
+ postAuthenticationFlowsLookupStrategy =
+ FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(flows)));
+ } else {
+ postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
+ }
+ }
+
+ /**
+ * Set a lookup strategy for the post-authentication interceptor flows to enable.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setPostAuthenticationFlowsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
+ postAuthenticationFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ final Collection<AuthenticationContextClassReferencePrincipal> methods =
+ defaultAuthenticationContextsLookupStrategy.apply(profileRequestContext);
+ if (methods != null) {
+ return List.copyOf(methods);
+ }
+ return Collections.emptyList();
+ }
+
+ /**
+ * Set the default authentication contexts to use, expressed as custom principals.
+ *
+ * @param contexts default authentication contexts to use
+ */
+ public void setDefaultAuthenticationMethods(
+ @Nullable @NonnullElements final Collection<AuthenticationContextClassReferencePrincipal> contexts) {
+ if (contexts != null) {
+ defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(List.copyOf(contexts));
+ } else {
+ defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
+ }
+ }
+
+ /**
+ * Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setDefaultAuthenticationMethodsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Collection<AuthenticationContextClassReferencePrincipal>>
+ strategy) {
+ defaultAuthenticationContextsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list