[java-oidc-common] branch main updated: Add claims set input to lookup strategies
Phil Smart
philip.smart at jisc.ac.uk
Fri Jan 29 14:55:10 UTC 2021
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=58ec1aa8a00a434c66d2cc63b904500ca5da22da
The following commit(s) were added to refs/heads/main by this push:
new 58ec1aa Add claims set input to lookup strategies
58ec1aa is described below
commit 58ec1aa8a00a434c66d2cc63b904500ca5da22da
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jan 29 14:50:22 2021 +0000
Add claims set input to lookup strategies
---
.../security/jwt/claims/impl/AudienceClaimsValidator.java | 8 +++++---
.../jwt/claims/impl/ExactMatchClaimsValidator.java | 12 ++++++++----
.../jwt/claims/impl/AudienceClaimsValidatorTest.java | 14 +++++++-------
.../jwt/claims/impl/ChainingJWTClaimsValidationTest.java | 6 +++---
.../jwt/claims/impl/ExactMatchClaimsValidatorTest.java | 12 ++++++------
5 files changed, 29 insertions(+), 23 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
index 230059b..e86407a 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
@@ -19,6 +19,7 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
import java.util.List;
+import java.util.function.BiFunction;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -43,7 +44,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
public class AudienceClaimsValidator extends AbstractClaimsValidator{
/** Strategy to find the audience value from the context.*/
- @NonnullAfterInit private Function<ProfileRequestContext,String> audienceLookupStrategy;
+ @NonnullAfterInit private BiFunction<ProfileRequestContext,JWTClaimsSet, String> audienceLookupStrategy;
/** {@inheritDoc} */
@@ -61,7 +62,8 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
*
* @param strategy the strategy.
*/
- public void setAudienceLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ public void setAudienceLookupStrategy(
+ @Nonnull final BiFunction<ProfileRequestContext,JWTClaimsSet, String> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
audienceLookupStrategy = Constraint.isNotNull(strategy, "Audience lookup strategy can not be null");
@@ -71,7 +73,7 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
protected void doValidate(@Nonnull final JWTClaimsSet claims, @Nonnull final ProfileRequestContext context)
throws JWTValidationException {
- final String acceptedAudience = audienceLookupStrategy.apply(context);
+ final String acceptedAudience = audienceLookupStrategy.apply(context,claims);
if (acceptedAudience == null) {
throw new JWTValidationException("Audience value not present in the context");
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidator.java
index 606e1de..da11245 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidator.java
@@ -17,6 +17,7 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
+import java.util.function.BiFunction;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -45,8 +46,11 @@ public class ExactMatchClaimsValidator extends AbstractClaimsValidator{
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ExactMatchClaimsValidator.class);
- /** Strategy to retrieve the value to match to an ID Token claim.*/
- @NonnullAfterInit private Function<ProfileRequestContext,String> valueToMatchLookupStrategy;
+ /**
+ * Strategy to retrieve the value to match to an ID Token claim.
+ * Should return null if there is a failure to lookup the value.
+ */
+ @NonnullAfterInit private BiFunction<ProfileRequestContext, JWTClaimsSet, String> valueToMatchLookupStrategy;
/** The name of the claim to match from the ID token.*/
@NonnullAfterInit @NotEmpty private String claimName;
@@ -68,7 +72,7 @@ public class ExactMatchClaimsValidator extends AbstractClaimsValidator{
* @param strategy the strategy to use.
*/
public void setValueToMatchLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,String> strategy) {
+ @Nonnull final BiFunction<ProfileRequestContext,JWTClaimsSet, String> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
valueToMatchLookupStrategy = Constraint.isNotNull(strategy,
@@ -97,7 +101,7 @@ public class ExactMatchClaimsValidator extends AbstractClaimsValidator{
if (actualClaim == null) {
throw new JWTValidationException("Claim '"+claimName+"' does not exist");
}
- final String expectedClaim = valueToMatchLookupStrategy.apply(context);
+ final String expectedClaim = valueToMatchLookupStrategy.apply(context,claims);
log.trace("{}: Checking actual claim '{}' matches expected claim '{}'", getId(), actualClaim, expectedClaim);
//handle null in the yoda condition.
if (! actualClaim.equals(expectedClaim)) {
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidatorTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidatorTest.java
index 1246f3b..04f4af7 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidatorTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidatorTest.java
@@ -47,7 +47,7 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
public void doValidateTest() throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id").build();
validator.setId("test-validator");
- validator.setAudienceLookupStrategy(prc -> "client-id");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id");
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -57,7 +57,7 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().
audience(List.of("client-id","another-audience")).build();
validator.setId("test-validator");
- validator.setAudienceLookupStrategy(prc -> "client-id");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id");
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -67,7 +67,7 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().
audience(List.of("wrong-client","another-audience")).build();
validator.setId("test-validator");
- validator.setAudienceLookupStrategy(prc -> "client-id");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id");
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -76,7 +76,7 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
public void doInValidateTestEmptyAudiences() throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience(Collections.emptyList()).build();
validator.setId("test-validator");
- validator.setAudienceLookupStrategy(prc -> "client-id");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id");
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -85,7 +85,7 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
public void doInValidateTest() throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id").build();
validator.setId("test-validator");
- validator.setAudienceLookupStrategy(prc -> "client-id-different");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id-different");
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -95,7 +95,7 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().audience("client-id").build();
validator.setId("test-validator");
- validator.setAudienceLookupStrategy(prc -> null);
+ validator.setAudienceLookupStrategy((prc,claims) -> null);
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -104,7 +104,7 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
public void doInValidateTestNullAudienceInJWT() throws JWTValidationException, ComponentInitializationException {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().build();
validator.setId("test-validator");
- validator.setAudienceLookupStrategy(prc -> "client-id");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id");
validator.initialize();
validator.validate(claimsSet, prc);
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ChainingJWTClaimsValidationTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ChainingJWTClaimsValidationTest.java
index 31f0761..c5403c3 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ChainingJWTClaimsValidationTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ChainingJWTClaimsValidationTest.java
@@ -53,7 +53,7 @@ public class ChainingJWTClaimsValidationTest extends AbstractClaimsValidatorTest
//aud validator
final AudienceClaimsValidator audV = new AudienceClaimsValidator();
- audV.setAudienceLookupStrategy(prc -> "audience");
+ audV.setAudienceLookupStrategy((prc,claims) -> "audience");
audV.setId("audience-check");
audV.initialize();
validators.add(audV);
@@ -82,7 +82,7 @@ public class ChainingJWTClaimsValidationTest extends AbstractClaimsValidatorTest
final ExactMatchClaimsValidator usernameExactV = new ExactMatchClaimsValidator();
usernameExactV.setId("username-validation");
usernameExactV.setClaimName("username");
- usernameExactV.setValueToMatchLookupStrategy(prc -> "jdoe");
+ usernameExactV.setValueToMatchLookupStrategy((prc,claims) -> "jdoe");
usernameExactV.initialize();
validators.add(usernameExactV);
@@ -99,7 +99,7 @@ public class ChainingJWTClaimsValidationTest extends AbstractClaimsValidatorTest
nonceV.setId("nonce-validator");
nonceV.setActivationCondition((prc,claims) -> true);
nonceV.setClaimName(IDTokenClaims.NONCE.getClaimName());
- nonceV.setValueToMatchLookupStrategy(prc -> "nonce");
+ nonceV.setValueToMatchLookupStrategy((prc,claims) -> "nonce");
validators.add(nonceV);
//required claims
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidatorTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidatorTest.java
index 3013972..eeaec68 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidatorTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidatorTest.java
@@ -46,7 +46,7 @@ public class ExactMatchClaimsValidatorTest extends AbstractClaimsValidatorTest {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().claim("username", "jdoe").build();
validator.setId("test-validator");
validator.setClaimName("username");
- validator.setValueToMatchLookupStrategy(prc -> "jdoe");
+ validator.setValueToMatchLookupStrategy((prc,claims) -> "jdoe");
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -57,7 +57,7 @@ public class ExactMatchClaimsValidatorTest extends AbstractClaimsValidatorTest {
IDTokenClaims.NONCE.getClaimName(), "a-nonce").build();
validator.setId("test-validator");
validator.setClaimName("nonce");
- validator.setValueToMatchLookupStrategy(prc -> "a-nonce");
+ validator.setValueToMatchLookupStrategy((prc,claims) -> "a-nonce");
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -73,7 +73,7 @@ public class ExactMatchClaimsValidatorTest extends AbstractClaimsValidatorTest {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().build();
validator.setId("test-validator");
validator.setClaimName("nonce");
- validator.setValueToMatchLookupStrategy(prc -> "a-nonce");
+ validator.setValueToMatchLookupStrategy((prc,claims) -> "a-nonce");
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -90,7 +90,7 @@ public class ExactMatchClaimsValidatorTest extends AbstractClaimsValidatorTest {
IDTokenClaims.NONCE.getClaimName(), "a-nonce").build();
validator.setId("test-validator");
validator.setClaimName("nonce");
- validator.setValueToMatchLookupStrategy(prc -> null);
+ validator.setValueToMatchLookupStrategy((prc,claims) -> null);
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -110,7 +110,7 @@ public class ExactMatchClaimsValidatorTest extends AbstractClaimsValidatorTest {
validator.setActivationCondition((prc,claims) -> false);
validator.setId("test-validator");
validator.setClaimName("nonce");
- validator.setValueToMatchLookupStrategy(prc -> "wrong-nonce-should-not-matter");
+ validator.setValueToMatchLookupStrategy((prc,claims) -> "wrong-nonce-should-not-matter");
validator.initialize();
validator.validate(claimsSet, prc);
}
@@ -130,7 +130,7 @@ public class ExactMatchClaimsValidatorTest extends AbstractClaimsValidatorTest {
validator.setActivationCondition((prc,claims) -> true);
validator.setId("test-validator");
validator.setClaimName("nonce");
- validator.setValueToMatchLookupStrategy(prc -> "wrong-nonce");
+ validator.setValueToMatchLookupStrategy((prc,claims) -> "wrong-nonce");
validator.initialize();
validator.validate(claimsSet, prc);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list