[java-idp-oidc] 01/03: JOIDC-22 Update Core Nimbus libraries

Henri Mikkonen henri.mikkonen at iki.fi
Fri Jan 22 17:46:59 UTC 2021


This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e0822e2206706260e3fad942d859419d23bafb16

commit e0822e2206706260e3fad942d859419d23bafb16
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jan 22 19:42:49 2021 +0200

    JOIDC-22 Update Core Nimbus libraries
    
    https://issues.shibboleth.net/jira/browse/JOIDC-22
    
    POM: Inherit the dependency management from oidc-common
    
    Java:
    - ClaimsRequest -> OIDCClaimsRequest
    - ClaimsRequest addIdTokenClaim & addUserInfoClaim -> IDToken/UserInfo ClaimsRequest in OIDCClaimsRequest
    - ClaimsRequest.Entry -> ClaimsSetRequest.Entry
---
 .../context/OIDCAuthenticationResponseContext.java |  8 +++---
 .../DefaultRequestedClaimsLookupFunction.java      | 20 ++++++-------
 .../TokenRequestRequestedClaimsLookupFunction.java |  6 ++--
 .../op/token/support/AccessTokenClaimsSet.java     |  4 +--
 .../op/token/support/AuthorizeCodeClaimsSet.java   |  4 +--
 .../oidc/op/token/support/TokenClaimsSet.java      | 14 ++++-----
 .../OIDCAuthenticationResponseContextTest.java     |  4 +--
 .../BaseTokenRequestLookupFunctionTest.java        | 10 ++++---
 .../DefaultRequestedClaimsLookupFunctionTest.java  | 33 ++++++++++++++++------
 ...enRequestRequestedClaimsLookupFunctionTest.java |  2 +-
 .../oidc/op/token/support/TokenClaimsSetTest.java  |  3 +-
 .../support/testing/BaseTokenClaimsSetTest.java    | 10 ++++---
 .../profile/impl/ProcessRequestedAuthnContext.java | 22 ++++++++-------
 .../impl/SetAccessTokenToResponseContext.java      |  2 +-
 .../impl/SetRequestedClaimsToResponseContext.java  | 13 +++++----
 .../impl/SetRequestedSubjectToResponseContext.java |  8 ++++--
 .../AttributeInOIDCRequestedClaimsMatcherTest.java | 19 +++++++------
 .../impl/ProcessRequestedAuthnContextTest.java     | 14 ++++-----
 .../SetRequestedClaimsToResponseContextTest.java   |  4 +--
 .../SetRequestedSubjectToResponseContextTest.java  | 11 ++++----
 pom.xml                                            | 16 ++++-------
 21 files changed, 123 insertions(+), 104 deletions(-)

diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContext.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContext.java
index 0d5597b9..e7a7b12d 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContext.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContext.java
@@ -31,7 +31,7 @@ import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.token.AccessToken;
 import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
 import com.nimbusds.oauth2.sdk.token.RefreshToken;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
 import com.nimbusds.openid.connect.sdk.claims.UserInfo;
@@ -107,7 +107,7 @@ public class OIDCAuthenticationResponseContext extends BaseContext {
 
     /** Requested claims. */
     @Nullable
-    private ClaimsRequest requestedClaims;
+    private OIDCClaimsRequest requestedClaims;
     
     /** Mapped requested claims from the ID Token set. */
     @Nullable private AttributesMapContainer mappedIdTokenRequestedClaims;
@@ -121,7 +121,7 @@ public class OIDCAuthenticationResponseContext extends BaseContext {
      * @return requested claims
      */
     @Nullable
-    public ClaimsRequest getRequestedClaims() {
+    public OIDCClaimsRequest getRequestedClaims() {
         return requestedClaims;
     }
 
@@ -130,7 +130,7 @@ public class OIDCAuthenticationResponseContext extends BaseContext {
      * 
      * @param claims requested claims
      */
-    public void setRequestedClaims(@Nullable final ClaimsRequest claims) {
+    public void setRequestedClaims(@Nullable final OIDCClaimsRequest claims) {
         requestedClaims = claims;
     }
     
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
index 80d3d7b3..7a5f873c 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
@@ -18,11 +18,12 @@
 package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
 
 import java.text.ParseException;
+
 import javax.annotation.Nonnull;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 
 import net.minidev.json.JSONObject;
 
@@ -31,7 +32,8 @@ import net.minidev.json.JSONObject;
  * from oidc authentication request if available. If information is not available, null is returned. If there is claims
  * request in request object it is used instead of claims parameter.
  */
-public class DefaultRequestedClaimsLookupFunction extends AbstractAuthenticationRequestLookupFunction<ClaimsRequest> {
+public class DefaultRequestedClaimsLookupFunction 
+    extends AbstractAuthenticationRequestLookupFunction<OIDCClaimsRequest> {
 
     /** Class logger. */
     @Nonnull
@@ -39,26 +41,22 @@ public class DefaultRequestedClaimsLookupFunction extends AbstractAuthentication
 
     /** {@inheritDoc} */
     @Override
-    ClaimsRequest doLookup(@Nonnull final AuthenticationRequest req) {
+    OIDCClaimsRequest doLookup(@Nonnull final AuthenticationRequest req) {
         try {
             if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("claims") != null) {
                 final Object claims = getRequestObject().getJWTClaimsSet().getClaim("claims");
                 if (claims instanceof JSONObject) {
-                    return ClaimsRequest.parse((JSONObject) claims);
+                    return OIDCClaimsRequest.parse((JSONObject) claims);
                 } else {
                     log.error("claims claim is not of expected type");
                     return null;
                 }
             }
-        } catch (final ParseException e) {
+        } catch (final ParseException | com.nimbusds.oauth2.sdk.ParseException e) {
             log.error("unable to parse claims claim {}", e.getMessage());
             return null;
         }
-        if (req.getClaims() == null) {
-            return null;
-        }
-        final ClaimsRequest request = new ClaimsRequest();
-        request.add(req.getClaims());
-        return request;
+        return req.getOIDCClaims();
     }
+    
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunction.java
index 56e363b5..41339f5e 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunction.java
@@ -19,7 +19,7 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
 
 import javax.annotation.Nonnull;
 
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 
 import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
 
@@ -29,11 +29,11 @@ import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
  * A function that returns copy of requested claims via a lookup function. This lookup locates requested claims from
  * token for token request handling. If token claims are not available, null is returned.
  */
-public class TokenRequestRequestedClaimsLookupFunction extends AbstractTokenClaimsLookupFunction<ClaimsRequest> {
+public class TokenRequestRequestedClaimsLookupFunction extends AbstractTokenClaimsLookupFunction<OIDCClaimsRequest> {
 
     /** {@inheritDoc} */
     @Override
-    ClaimsRequest doLookup(@Nonnull final TokenClaimsSet tokenClaims) {
+    OIDCClaimsRequest doLookup(@Nonnull final TokenClaimsSet tokenClaims) {
         return tokenClaims.getClaimsRequest();
 
     }
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
index 0e152adc..704a60a5 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
@@ -25,8 +25,8 @@ import org.slf4j.LoggerFactory;
 import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
 import com.nimbusds.openid.connect.sdk.Nonce;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
 
@@ -98,7 +98,7 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
             @Nonnull final ClientID clientID, @Nonnull final String issuer, @Nonnull final String userPrincipal,
             @Nonnull final String subject, @Nullable final ACR acr, @Nonnull final Instant iat,
             @Nonnull final Instant exp, @Nullable final Nonce nonce, @Nonnull final Instant authTime,
-            @Nonnull final URI redirectURI, @Nonnull final Scope scope, @Nullable final ClaimsRequest claims,
+            @Nonnull final URI redirectURI, @Nonnull final Scope scope, @Nullable final OIDCClaimsRequest claims,
             @Nullable final ClaimsSet dlClaims, @Nullable final ClaimsSet dlClaimsUI,
             @Nullable final JSONArray consentableClaims, @Nullable final JSONArray consentedClaims) {
         super(VALUE_TYPE_AT, idGenerator.generateIdentifier(), clientID, issuer, userPrincipal, subject, acr, iat, exp,
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
index 005198df..f0e2366d 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
@@ -23,8 +23,8 @@ import javax.annotation.Nullable;
 import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
 import com.nimbusds.openid.connect.sdk.Nonce;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
 
@@ -70,7 +70,7 @@ public final class AuthorizeCodeClaimsSet extends TokenClaimsSet {
             @Nonnull final ClientID clientID, @Nonnull final String issuer, @Nonnull final String userPrincipal,
             @Nonnull final String subject, @Nonnull final ACR acr, @Nonnull final Instant iat,
             @Nonnull final Instant exp, @Nullable final Nonce nonce, @Nonnull final Instant authTime,
-            @Nonnull final URI redirectURI, @Nonnull final Scope scope, @Nullable final ClaimsRequest claims,
+            @Nonnull final URI redirectURI, @Nonnull final Scope scope, @Nullable final OIDCClaimsRequest claims,
             @Nullable final ClaimsSet dlClaims, @Nullable final ClaimsSet dlClaimsID,
             @Nullable final ClaimsSet dlClaimsUI, @Nullable final JSONArray consentableClaims,
             @Nullable final JSONArray consentedClaims, @Nullable final String codeChallenge) {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
index 5f55ac20..a1c38d8b 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
@@ -28,8 +28,8 @@ import org.slf4j.LoggerFactory;
 import com.nimbusds.jwt.JWTClaimsSet;
 import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
 import com.nimbusds.openid.connect.sdk.Nonce;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
 
@@ -152,7 +152,7 @@ public class TokenClaimsSet {
             @Nonnull final String issuer, @Nonnull final String userPrincipal, @Nonnull final String subject,
             @Nullable final ACR acr, @Nonnull final Instant iat, @Nonnull final Instant exp,
             @Nullable final Nonce nonce, @Nonnull final Instant authTime, @Nonnull final URI redirectURI,
-            @Nonnull final Scope scope, @Nullable final ClaimsRequest claims, @Nullable final ClaimsSet dlClaims,
+            @Nonnull final Scope scope, @Nullable final OIDCClaimsRequest claims, @Nullable final ClaimsSet dlClaims,
             @Nullable final ClaimsSet dlClaimsID, @Nullable final ClaimsSet dlClaimsUI,
             @Nullable final JSONArray consentableClaims, @Nullable final JSONArray consentedClaims,
             @Nullable final String codeChallenge) {
@@ -386,13 +386,13 @@ public class TokenClaimsSet {
      * @return claims request in authentication request, null if not existing.
      */
     @Nullable
-    public ClaimsRequest getClaimsRequest() {
+    public OIDCClaimsRequest getClaimsRequest() {
         if (tokenClaimsSet.getClaim(KEY_CLAIMS) == null) {
             return null;
         }
         try {
-            return ClaimsRequest.parse(tokenClaimsSet.getJSONObjectClaim(KEY_CLAIMS));
-        } catch (final ParseException e) {
+            return OIDCClaimsRequest.parse(tokenClaimsSet.getJSONObjectClaim(KEY_CLAIMS));
+        } catch (final ParseException | com.nimbusds.oauth2.sdk.ParseException e) {
             log.error("Error parsing claims request {}", tokenClaimsSet.getClaim(KEY_CLAIMS));
             return null;
         }
@@ -584,7 +584,7 @@ public class TokenClaimsSet {
 
         /** Claims request of the authentication request. */
         @Nullable
-        protected ClaimsRequest claims;
+        protected OIDCClaimsRequest claims;
 
         /** Token delivery claims delivered both for id token and userinfo response. */
         @Nullable
@@ -673,7 +673,7 @@ public class TokenClaimsSet {
          * 
          * @return the builder
          */
-        public Builder<T> setClaims(@Nullable final ClaimsRequest requestedClaims) {
+        public Builder<T> setClaims(@Nullable final OIDCClaimsRequest requestedClaims) {
             claims = requestedClaims;
             return this;
         }
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContextTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContextTest.java
index 4fb18c13..f1733f3c 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContextTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContextTest.java
@@ -35,7 +35,7 @@ import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.Audience;
 import com.nimbusds.oauth2.sdk.id.Issuer;
 import com.nimbusds.oauth2.sdk.id.Subject;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
 import com.nimbusds.openid.connect.sdk.claims.UserInfo;
 
@@ -91,7 +91,7 @@ public class OIDCAuthenticationResponseContextTest {
         ctx.setProcessedToken(sJWT);
         Assert.assertEquals(ctx.getAcr().toString(), "acrValue");
         ctx.setAcr(null);
-        ClaimsRequest claims = new ClaimsRequest();
+        OIDCClaimsRequest claims = new OIDCClaimsRequest();
         ctx.setRequestedClaims(claims);
         ctx.setSubjectType("pairwise");
         UserInfo info = new UserInfo(sub);
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/BaseTokenRequestLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/BaseTokenRequestLookupFunctionTest.java
index 418bb214..cb72e4ac 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/BaseTokenRequestLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/BaseTokenRequestLookupFunctionTest.java
@@ -37,10 +37,11 @@ import org.testng.annotations.BeforeMethod;
 
 import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
 import com.nimbusds.openid.connect.sdk.Nonce;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
 
 /** Base class for testing classes extending {@link AbstractTokenRequestLookupFunction}. */
 public class BaseTokenRequestLookupFunctionTest {
@@ -75,7 +76,7 @@ public class BaseTokenRequestLookupFunctionTest {
 
     protected String idpSessionId = "idpSessionId";
 
-    protected ClaimsRequest claimsRequest;
+    protected OIDCClaimsRequest claimsRequest;
 
     protected ClaimsSet tokenDeliveryClaims = new TokenDeliveryClaimsClaimsSet();
 
@@ -93,8 +94,9 @@ public class BaseTokenRequestLookupFunctionTest {
         } catch (final URISyntaxException e) {
             e.printStackTrace();
         }
-        claimsRequest = new ClaimsRequest();
-        claimsRequest.addIDTokenClaim("email");
+        final ClaimsSetRequest idTokenClaimsSet = new ClaimsSetRequest().add("email");
+        claimsRequest = new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsSet);
+        
         tokenDeliveryClaims.setClaim("tokenDelivery", "value");
         tokenToIdTokenDeliveryClaims.setClaim("tokenToIdtokenDelivery", "value");
         tokenToUserInfoTokenDeliveryClaims.setClaim("tokenToUserInfotokenDeliveryClaim", "value");
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
index f907816a..cb4339d7 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
@@ -29,8 +29,9 @@ import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.ClientID;
 import com.nimbusds.oauth2.sdk.id.State;
 import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
 import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
 import com.nimbusds.openid.connect.sdk.claims.UserInfo;
 
@@ -47,9 +48,15 @@ public class DefaultRequestedClaimsLookupFunctionTest extends BaseDefaultRequest
 
     @Test
     public void testSuccessNoReqObject() {
-        final ClaimsRequest cr = new ClaimsRequest();
-        cr.addIDTokenClaim(IDTokenClaimsSet.SUB_CLAIM_NAME, ClaimRequirement.ESSENTIAL);
-        cr.addUserInfoClaim(UserInfo.BIRTHDATE_CLAIM_NAME, ClaimRequirement.ESSENTIAL);
+        final ClaimsSetRequest idTokenClaims = new ClaimsSetRequest()
+                .add(new ClaimsSetRequest.Entry(IDTokenClaimsSet.SUB_CLAIM_NAME)
+                        .withClaimRequirement(ClaimRequirement.ESSENTIAL));
+        final ClaimsSetRequest userInfoClaims = new ClaimsSetRequest()
+                .add(new ClaimsSetRequest.Entry(UserInfo.BIRTHDATE_CLAIM_NAME)
+                        .withClaimRequirement(ClaimRequirement.ESSENTIAL));
+        final OIDCClaimsRequest cr = new OIDCClaimsRequest()
+                .withIDTokenClaimsRequest(idTokenClaims)
+                .withUserInfoClaimsRequest(userInfoClaims);
         final AuthenticationRequest req =
                 new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"), new ClientID("000123"),
                         URI.create("https://example.com/callback")).claims(cr).state(new State()).build();
@@ -59,11 +66,19 @@ public class DefaultRequestedClaimsLookupFunctionTest extends BaseDefaultRequest
 
     @Test
     public void testSuccessReqObject() {
-        final ClaimsRequest crParameter = new ClaimsRequest();
-        crParameter.addIDTokenClaim(IDTokenClaimsSet.SUB_CLAIM_NAME, ClaimRequirement.ESSENTIAL);
-        final ClaimsRequest crRequestObject = new ClaimsRequest();
-        crRequestObject.addIDTokenClaim(IDTokenClaimsSet.SUB_CLAIM_NAME, ClaimRequirement.ESSENTIAL);
-        crRequestObject.addUserInfoClaim(UserInfo.BIRTHDATE_CLAIM_NAME, ClaimRequirement.ESSENTIAL);
+        final ClaimsSetRequest idTokenClaims = new ClaimsSetRequest()
+                .add(new ClaimsSetRequest.Entry(IDTokenClaimsSet.SUB_CLAIM_NAME)
+                .withClaimRequirement(ClaimRequirement.ESSENTIAL));
+        final OIDCClaimsRequest crParameter = new OIDCClaimsRequest()
+                .withIDTokenClaimsRequest(idTokenClaims);
+
+        final ClaimsSetRequest userInfoClaims = new ClaimsSetRequest()
+                .add(new ClaimsSetRequest.Entry(UserInfo.BIRTHDATE_CLAIM_NAME)
+                .withClaimRequirement(ClaimRequirement.ESSENTIAL));
+        final OIDCClaimsRequest crRequestObject = new OIDCClaimsRequest()
+                .withIDTokenClaimsRequest(idTokenClaims)
+                .withUserInfoClaimsRequest(userInfoClaims);
+
         final JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("claims", crRequestObject.toJSONObject()).build();
         final AuthenticationRequest req = new AuthenticationRequest.Builder(
                 new ResponseType("code"), new Scope("openid"), new ClientID("000123"),
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunctionTest.java
index 94c5da9a..c73fd5fb 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRequestedClaimsLookupFunctionTest.java
@@ -30,7 +30,7 @@ public class TokenRequestRequestedClaimsLookupFunctionTest extends BaseTokenRequ
 
     @Test
     public void testLookup() {
-        Assert.assertFalse(lookup.apply(prc).getIDTokenClaims().isEmpty());
+        Assert.assertFalse(lookup.apply(prc).getIDTokenClaimsRequest().getEntries().isEmpty());
     }
 
 }
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSetTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSetTest.java
index 5efb8ad4..126bb516 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSetTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSetTest.java
@@ -51,7 +51,8 @@ public class TokenClaimsSetTest extends BaseTokenClaimsSetTest {
         Assert.assertEquals(tokenClaimsSet.getPrincipal(), userPrincipal);
         Assert.assertEquals(tokenClaimsSet.isExpired(), false);
         Assert.assertEquals(tokenClaimsSet.getAuthenticationTime(), authTime.truncatedTo(ChronoUnit.MILLIS));
-        Assert.assertTrue(tokenClaimsSet.getClaimsRequest().getIDTokenClaimNames(false).contains("email"));
+        Assert.assertTrue(tokenClaimsSet.getClaimsRequest().getIDTokenClaimsRequest().getClaimNames(false)
+                .contains("email"));
         Assert.assertEquals(tokenClaimsSet.getDeliveryClaims().getClaim("tokenDelivery"), "value");
         Assert.assertEquals(tokenClaimsSet.getIDTokenDeliveryClaims().getClaim("tokenToIdtokenDeliveryClaim"), "value");
         Assert.assertEquals(tokenClaimsSet.getUserinfoDeliveryClaims().getClaim("tokenToUserInfotokenDeliveryClaim"),
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/testing/BaseTokenClaimsSetTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/testing/BaseTokenClaimsSetTest.java
index fcab0138..7673c86d 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/testing/BaseTokenClaimsSetTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/token/support/testing/BaseTokenClaimsSetTest.java
@@ -19,10 +19,12 @@ package net.shibboleth.idp.plugin.oidc.op.token.support.testing;
 
 import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
 import com.nimbusds.openid.connect.sdk.Nonce;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
+
 import net.minidev.json.JSONArray;
 import net.shibboleth.ext.spring.resource.ResourceHelper;
 import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
@@ -80,7 +82,7 @@ public class BaseTokenClaimsSetTest {
 
     protected JSONArray consentedClaims = new JSONArray();
 
-    protected ClaimsRequest claims;
+    protected OIDCClaimsRequest claims;
 
     protected String codeChallenge = "code_challenge_123456";
 
@@ -102,8 +104,8 @@ public class BaseTokenClaimsSetTest {
     @BeforeMethod
     protected void setUpParameters() throws Exception {
         redirectURI = new URI("https://rp.example.com/cb");
-        claims = new ClaimsRequest();
-        claims.addIDTokenClaim("email");
+        final ClaimsSetRequest idTokenClaims = new ClaimsSetRequest().add("email");
+        claims = new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaims);
         dlClaims.setClaim("tokenDelivery", "value");
         dlClaimsID.setClaim("tokenToIdtokenDeliveryClaim", "value");
         dlClaimsUI.setClaim("tokenToUserInfotokenDeliveryClaim", "value");
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
index 7b529ab1..6e90b43e 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
@@ -36,9 +36,9 @@ import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import com.nimbusds.openid.connect.sdk.ClaimsRequest.Entry;
 import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
 import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
 
 import java.security.Principal;
@@ -121,16 +121,17 @@ public class ProcessRequestedAuthnContext extends AbstractOIDCAuthenticationResp
         
         acrValues = acrLookupStrategy.apply(profileRequestContext);
         if (getOidcResponseContext().getRequestedClaims() != null
-                && getOidcResponseContext().getRequestedClaims().getIDTokenClaims() != null) {
-            for (final Entry entry : getOidcResponseContext().getRequestedClaims().getIDTokenClaims()) {
+                && getOidcResponseContext().getRequestedClaims().getIDTokenClaimsRequest() != null) {
+            for (final Entry entry : 
+                    getOidcResponseContext().getRequestedClaims().getIDTokenClaimsRequest().getEntries()) {
                 if (IDTokenClaimsSet.ACR_CLAIM_NAME.equals(entry.getClaimName())) {
                     acrClaim = entry;
                     break;
                 }
             }
         }
-        if ((acrValues == null || acrValues.isEmpty())
-                && (acrClaim == null || (acrClaim.getValues() == null && acrClaim.getValue() == null))) {
+        if ((acrValues == null || acrValues.isEmpty()) && (acrClaim == null
+                || (acrClaim.getValuesAsListOfStrings() == null  && acrClaim.getValueAsString() == null))) {
             log.debug("No acr values nor acr claim values in request, nothing to do");
             return false;
         }
@@ -158,14 +159,15 @@ public class ProcessRequestedAuthnContext extends AbstractOIDCAuthenticationResp
                 log.debug("{} Located acr value {} in request", getLogPrefix(), acr.getValue());
                 principals.add(new AuthenticationContextClassReferencePrincipal(acr.getValue()));
             }
-        } else if (acrClaim != null && acrClaim.getValue() != null) {
+        } else if (acrClaim != null && acrClaim.getValueAsString() != null) {
             isEssential = acrClaim.getClaimRequirement().equals(ClaimRequirement.ESSENTIAL);
             log.debug("{} Located {} acr claim {} in id token section of claims request", getLogPrefix(),
-                    acrClaim.getClaimRequirement().toString(), acrClaim.getValue());
-            principals.add(new AuthenticationContextClassReferencePrincipal(acrClaim.getValue()));
-        } else if (acrClaim != null && !(acrClaim.getValues() != null && acrClaim.getValues().isEmpty())) {
+                    acrClaim.getClaimRequirement().toString(), acrClaim.getValueAsString());
+            principals.add(new AuthenticationContextClassReferencePrincipal(acrClaim.getValueAsString()));
+        } else if (acrClaim != null && !(acrClaim.getValueAsString() != null 
+                && acrClaim.getValueAsString().isEmpty())) {
             isEssential = acrClaim.getClaimRequirement().equals(ClaimRequirement.ESSENTIAL);
-            for (final String acr : acrClaim.getValues()) {
+            for (final String acr : acrClaim.getValuesAsListOfStrings()) {
                 log.debug("{} Located {} acr claim {} in id token section of claims request", getLogPrefix(),
                         acrClaim.getClaimRequirement().toString(), acr);
                 principals.add(new AuthenticationContextClassReferencePrincipal(acr));
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
index a6a8eeb7..9e0e7ae0 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
@@ -282,7 +282,7 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
                     getOidcResponseContext().getSubject(), Instant.now(), dateExp,
                     getOidcResponseContext().getAuthTime(), getOidcResponseContext().getRedirectURI(),
                     getOidcResponseContext().getScope())
-                            .setACR(getOidcResponseContext().getAcr()).setClaims(authenticationRequest.getClaims())
+                            .setACR(getOidcResponseContext().getAcr()).setClaims(authenticationRequest.getOIDCClaims())
                             .setConsentableClaims(consentable).setConsentedClaims(consented).setDlClaims(claims)
                             .setDlClaimsUI(claimsUI).setNonce(authenticationRequest.getNonce()).build();
         }
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
index 9940adb3..4e8aefef 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
@@ -29,7 +29,8 @@ import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.HashMultimap;
 import com.google.common.collect.Multimap;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
 
 import net.minidev.json.JSONObject;
 import net.shibboleth.idp.attribute.AttributeDecodingException;
@@ -62,7 +63,7 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
     @Nonnull private final Logger log = LoggerFactory.getLogger(SetRequestedClaimsToResponseContext.class);
     
     /** Strategy used to obtain the requested claims of request. */
-    @Nonnull private Function<ProfileRequestContext, ClaimsRequest> requestedClaimsLookupStrategy;
+    @Nonnull private Function<ProfileRequestContext, OIDCClaimsRequest> requestedClaimsLookupStrategy;
 
     /** Transcoder registry service object. */
     @NonnullAfterInit private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry;
@@ -91,7 +92,7 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
      * @param strategy lookup strategy
      */
     public void setRequestedClaimsLookupStrategy(
-            @Nonnull final Function<ProfileRequestContext, ClaimsRequest> strategy) {
+            @Nonnull final Function<ProfileRequestContext, OIDCClaimsRequest> strategy) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         requestedClaimsLookupStrategy =
                 Constraint.isNotNull(strategy, "RequestedClaimsLookupStrategy lookup strategy cannot be null");
@@ -111,7 +112,7 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         
-        final ClaimsRequest cr = requestedClaimsLookupStrategy.apply(profileRequestContext);
+        final OIDCClaimsRequest cr = requestedClaimsLookupStrategy.apply(profileRequestContext);
         getOidcResponseContext().setRequestedClaims(cr);
         if (cr == null) {
             getOidcResponseContext().setMappedIdTokenRequestedClaims(null);
@@ -134,7 +135,7 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
             // out.
             
             Multimap<String,IdPAttribute> results = HashMultimap.create();
-            for (final ClaimsRequest.Entry entry : cr.getIDTokenClaims()) {
+            for (final ClaimsSetRequest.Entry entry : cr.getIDTokenClaimsRequest().getEntries()) {
                                 
                 final JSONObject wrapper = new JSONObject();
                 wrapper.put(entry.getClaimName(), entry);
@@ -147,7 +148,7 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
                     new AttributesMapContainer(results));
             
             results = HashMultimap.create();
-            for (final ClaimsRequest.Entry entry : cr.getUserInfoClaims()) {
+            for (final ClaimsSetRequest.Entry entry : cr.getUserInfoClaimsRequest().getEntries()) {
                                 
                 final JSONObject wrapper = new JSONObject();
                 wrapper.put(entry.getClaimName(), entry);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContext.java
index 1a5ec0b4..5d7009f1 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContext.java
@@ -28,7 +28,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import com.nimbusds.jwt.JWT;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest.Entry;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
 import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
 
 /**
@@ -55,7 +56,10 @@ public class SetRequestedSubjectToResponseContext extends AbstractOIDCAuthentica
         }
         
         if (getOidcResponseContext().getRequestedClaims() != null) {
-            idTokenClaims = getOidcResponseContext().getRequestedClaims().getIDTokenClaims();
+            final OIDCClaimsRequest claimsRequest = getOidcResponseContext().getRequestedClaims();
+            if (claimsRequest.getIDTokenClaimsRequest() != null) {
+                idTokenClaims = getOidcResponseContext().getRequestedClaims().getIDTokenClaimsRequest().getEntries();
+            }
         }
         idTokenHint = getAuthenticationRequest().getIDTokenHint();
         if (idTokenClaims == null && idTokenHint == null) {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/attribute/filter/matcher/impl/AttributeInOIDCRequestedClaimsMatcherTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/attribute/filter/matcher/impl/AttributeInOIDCRequestedClaimsMatcherTest.java
index 606931ce..c110b8e2 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/attribute/filter/matcher/impl/AttributeInOIDCRequestedClaimsMatcherTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/attribute/filter/matcher/impl/AttributeInOIDCRequestedClaimsMatcherTest.java
@@ -46,8 +46,9 @@ import com.nimbusds.oauth2.sdk.auth.Secret;
 import com.nimbusds.oauth2.sdk.id.ClientID;
 import com.nimbusds.oauth2.sdk.id.State;
 import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
 import com.nimbusds.openid.connect.sdk.Nonce;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
 import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
 import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
 
@@ -107,18 +108,18 @@ public class AttributeInOIDCRequestedClaimsMatcherTest {
         }
     }
     
-    private ClaimsRequest getClaimsRequest(final boolean idtoken, final boolean userinfo) {
-        final ClaimsRequest request = new ClaimsRequest();
-        request.addIDTokenClaim("any");
-        request.addUserInfoClaim("any");
+    private OIDCClaimsRequest getClaimsRequest(final boolean idtoken, final boolean userinfo) {
+        ClaimsSetRequest idTokenClaims = new ClaimsSetRequest().add("any");
+        ClaimsSetRequest userInfoClaims = new ClaimsSetRequest().add("any");
         if (idtoken) {
-            request.addIDTokenClaim("test");
+            idTokenClaims = idTokenClaims.add("test");
         }
         if (userinfo) {
-            request.addUserInfoClaim("test");
+            userInfoClaims = userInfoClaims.add("test");
         }
-        
-        return request;
+        return new OIDCClaimsRequest()
+                .withIDTokenClaimsRequest(idTokenClaims)
+                .withUserInfoClaimsRequest(userInfoClaims);
     }
 
     @Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java
index d5e71939..c2832e41 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java
@@ -37,10 +37,11 @@ import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.ClientID;
 import com.nimbusds.oauth2.sdk.id.State;
 import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest.Entry;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
 
 /** {@link ProcessRequestedAuthnContext} unit test. */
 public class ProcessRequestedAuthnContextTest extends BaseOIDCResponseActionTest {
@@ -118,8 +119,7 @@ public class ProcessRequestedAuthnContextTest extends BaseOIDCResponseActionTest
     public void testSuccessRequestedClaims1() throws ComponentInitializationException {
         init();
         Entry entry = new Entry("acr").withValue("1");
-        ClaimsRequest claims = new ClaimsRequest();
-        claims.addIDTokenClaim(entry);
+        OIDCClaimsRequest claims = new OIDCClaimsRequest().withIDTokenClaimsRequest(new ClaimsSetRequest().add(entry));
         respCtx.setRequestedClaims(claims);
         AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
                 new ClientID("clientid"), URI.create("https://example.com/callback")).claims(claims).state(new State())
@@ -146,8 +146,7 @@ public class ProcessRequestedAuthnContextTest extends BaseOIDCResponseActionTest
         acrs.add("1");
         acrs.add("2");
         Entry entry = new Entry("acr").withClaimRequirement(ClaimRequirement.ESSENTIAL).withValues(acrs);
-        ClaimsRequest claims = new ClaimsRequest();
-        claims.addIDTokenClaim(entry);
+        OIDCClaimsRequest claims = new OIDCClaimsRequest().withIDTokenClaimsRequest(new ClaimsSetRequest().add(entry));
         respCtx.setRequestedClaims(claims);
         AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
                 new ClientID("clientid"), URI.create("https://example.com/callback")).claims(claims).state(new State())
@@ -171,8 +170,7 @@ public class ProcessRequestedAuthnContextTest extends BaseOIDCResponseActionTest
     @Test
     public void testSuccessRequestedClaims3() throws ComponentInitializationException {
         init();
-        ClaimsRequest claims = new ClaimsRequest();
-        claims.addIDTokenClaim("acr");
+        OIDCClaimsRequest claims = new OIDCClaimsRequest().withIDTokenClaimsRequest(new ClaimsSetRequest().add("acr"));
         AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
                 new ClientID("clientid"), URI.create("https://example.com/callback")).claims(claims).state(new State())
                         .build();
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContextTest.java
index 906f904c..84dfbfa2 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContextTest.java
@@ -28,7 +28,7 @@ import org.testng.annotations.Test;
 
 import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.ClientID;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ACR;
 
 import net.minidev.json.JSONObject;
@@ -53,7 +53,7 @@ public class SetRequestedClaimsToResponseContextTest extends BaseOIDCResponseAct
         respCtx.setScope(new Scope());
         TokenClaimsSet claims = new AuthorizeCodeClaimsSet.Builder(idGenerator, new ClientID(), "issuer", "userPrin",
                 "subject", Instant.now(), Instant.now(), Instant.now(), new URI("http://example.com"),
-                new Scope()).setACR(new ACR("0")).setClaims(ClaimsRequest.parse("{\"id_token\":{\"email\":{\"essential\":true}},\"userinfo\":{\"name\":{\"essential\":true}}}")).build();
+                new Scope()).setACR(new ACR("0")).setClaims(OIDCClaimsRequest.parse("{\"id_token\":{\"email\":{\"essential\":true}},\"userinfo\":{\"name\":{\"essential\":true}}}")).build();
         respCtx.setSubject("subject");
         respCtx.setAuthTime(Instant.now());
         respCtx.setTokenClaimsSet(claims);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContextTest.java
index 90cd2a15..74386726 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContextTest.java
@@ -33,9 +33,10 @@ import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.id.ClientID;
 import com.nimbusds.oauth2.sdk.id.State;
 import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest;
-import com.nimbusds.openid.connect.sdk.ClaimsRequest.Entry;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
 import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
 
 /** {@link SetRequestedSubjectToResponseContext} unit test. */
 public class SetRequestedSubjectToResponseContextTest extends BaseOIDCResponseActionTest {
@@ -87,9 +88,8 @@ public class SetRequestedSubjectToResponseContextTest extends BaseOIDCResponseAc
     @Test
     public void testClaimsRequest() throws ComponentInitializationException {
         init();
-        ClaimsRequest claims = new ClaimsRequest();
         Entry entry = new Entry("sub").withClaimRequirement(ClaimRequirement.ESSENTIAL).withValue("reqsubclaims");
-        claims.addIDTokenClaim(entry);
+        OIDCClaimsRequest claims = new OIDCClaimsRequest().withIDTokenClaimsRequest(new ClaimsSetRequest().add(entry));
         AuthenticationRequest req =
                 new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"), new ClientID("000123"),
                         URI.create("https://example.com/callback")).claims(claims).state(new State()).build();
@@ -109,10 +109,9 @@ public class SetRequestedSubjectToResponseContextTest extends BaseOIDCResponseAc
     @Test
     public void testMixed() throws ComponentInitializationException {
         init();
-        ClaimsRequest claims = new ClaimsRequest();
         Entry entry = new Entry("sub").withClaimRequirement(ClaimRequirement.ESSENTIAL).withValue("reqsubclaims");
         JWT idTokenHint = new PlainJWT(new JWTClaimsSet.Builder().subject("reqsubidtokenhint").build());
-        claims.addIDTokenClaim(entry);
+        OIDCClaimsRequest claims = new OIDCClaimsRequest().withIDTokenClaimsRequest(new ClaimsSetRequest().add(entry));
         AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
                 new ClientID("000123"), URI.create("https://example.com/callback")).idTokenHint(idTokenHint)
                         .claims(claims).state(new State()).build();
diff --git a/pom.xml b/pom.xml
index 8d8d0952..2f5ea52c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -47,18 +47,14 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
-            <!-- Compile Dependencies -->
             <dependency>
-                <groupId>com.nimbusds</groupId>
-                <artifactId>oauth2-oidc-sdk</artifactId>
-                <version>7.1.1</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>com.sun.mail</groupId>
-                        <artifactId>javax.mail</artifactId>
-                    </exclusion>
-                </exclusions>
+                <groupId>net.shibboleth.oidc</groupId>
+                <artifactId>oidc-common-parent</artifactId>
+                <version>0.0.1-SNAPSHOT</version>
+                <type>pom</type>
+                <scope>import</scope>
             </dependency>
+            <!-- Compile Dependencies -->
             <dependency>
                 <groupId>net.shibboleth.oidc</groupId>
                 <version>${project.version}</version>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list