[java-idp-oidc] branch main updated: JOIDC-35 - Add missing audit fields
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Mar 12 17:54:33 UTC 2021
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=1acf89f546afcb61240d836f237dd222375906a3
The following commit(s) were added to refs/heads/main by this push:
new 1acf89f5 JOIDC-35 - Add missing audit fields
1acf89f5 is described below
commit 1acf89f546afcb61240d836f237dd222375906a3
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 12 19:53:23 2021 +0200
JOIDC-35 - Add missing audit fields
https://issues.shibboleth.net/jira/browse/JOIDC-35
Added id_token issuance time (d) and nonce (RS) fields.
---
.../idp/plugin/oidc/op/audit/AuditFields.java | 6 ++
.../AuthenticationRequestClaimsAuditExtractor.java | 75 ++++++++++++++++++++++
.../op/audit/impl/IdTokenClaimsAuditExtractor.java | 72 +++++++++++++++++++++
.../flows/oidc/abstract/oidc-abstract-beans.xml | 16 +++++
4 files changed, 169 insertions(+)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/AuditFields.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/AuditFields.java
index 641346f8..394e56d4 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/AuditFields.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/AuditFields.java
@@ -59,6 +59,12 @@ public final class AuditFields {
/** auth_time value. */
@Nonnull @NotEmpty public static final String AUTHN_INSTANT = SAMLAuditFields.AUTHN_INSTANT;
+ /** id_token issue instant. */
+ @Nonnull @NotEmpty public static final String ID_TOKEN_ISSUE_INSTANT = SAMLAuditFields.ASSERTION_ISSUE_INSTANT;
+
+ /** id_token nonce. */
+ @Nonnull @NotEmpty public static final String NONCE = SAMLAuditFields.RELAY_STATE;
+
/** Revoked Token. */
@Nonnull @NotEmpty public static final String REVOKED_TOKEN = "R";
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java
new file mode 100644
index 00000000..5f9aeb3d
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.audit.impl;
+
+import java.text.ParseException;
+import java.util.List;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+
+import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.AbstractAuthenticationRequestLookupFunction;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * A function that resolves a claim value from the authentication request. If request object was involved and contains
+ * a value for the claim, it will be returned. Otherwise it's fetched from the authentication request parameters.
+ */
+public class AuthenticationRequestClaimsAuditExtractor extends AbstractAuthenticationRequestLookupFunction<String>
+ implements Function<ProfileRequestContext,String> {
+
+ /** Class logger. */
+ @Nonnull
+ private Logger log = LoggerFactory.getLogger(AuthenticationRequestClaimsAuditExtractor.class);
+
+ /** The claim whose value is to be extracted. */
+ @Nonnull @NotEmpty private final String key;
+
+ /**
+ * Constructor.
+ *
+ * @param claim The claim whose value is to be resolved from the id_token claims set.
+ */
+ public AuthenticationRequestClaimsAuditExtractor(@Nonnull @NotEmpty final String claim) {
+ key = claim;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected String doLookup(AuthenticationRequest request) {
+ try {
+ if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim(key) != null) {
+ return getRequestObject().getJWTClaimsSet().getStringClaim(key);
+ }
+ } catch (final ParseException e) {
+ log.error("Unable to parse response mode from request object response_mode value");
+ return null;
+ }
+ final List<String> value = request.toParameters().get(key);
+ if (value == null || value.isEmpty()) {
+ return null;
+ }
+ return value.get(0);
+ }
+}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/IdTokenClaimsAuditExtractor.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/IdTokenClaimsAuditExtractor.java
new file mode 100644
index 00000000..ceff21d7
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/IdTokenClaimsAuditExtractor.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+
+import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultResponseClaimsSetLookupFunction;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * A function that resolves a claim value from the id_token claims set.
+ */
+public class IdTokenClaimsAuditExtractor implements Function<ProfileRequestContext,String> {
+
+ /** Lookup strategy for id token claims to read from. */
+ @Nonnull private Function<ProfileRequestContext, ClaimsSet> idTokenClaimsLookupStrategy;
+
+ /** The claim whose value is to be extracted. */
+ @Nonnull @NotEmpty private final String key;
+
+ /**
+ * Constructor.
+ *
+ * @param claim The claim whose value is to be resolved from the id_token claims set.
+ */
+ public IdTokenClaimsAuditExtractor(@Nonnull @NotEmpty final String claim) {
+ idTokenClaimsLookupStrategy = new DefaultResponseClaimsSetLookupFunction();
+ key = Constraint.isNotEmpty(claim, "The claim cannot be empty");
+ }
+
+ /**
+ * Set the lookup strategy for id token claims to read from.
+ * @param strategy What to set.
+ */
+ public void setIdTokenClaimsLookupStrategy(final Function<ProfileRequestContext, ClaimsSet> strategy) {
+ idTokenClaimsLookupStrategy =
+ Constraint.isNotNull(strategy, "IdTokenClaimsStrategy lookup strategy cannot be null");
+
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String apply(ProfileRequestContext input) {
+ final ClaimsSet claims = idTokenClaimsLookupStrategy.apply(input);
+ if (claims != null) {
+ return claims.toJSONObject().getAsString(key);
+ }
+ return null;
+ }
+}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index f78adfa5..232a61a1 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -170,6 +170,22 @@
</key>
<bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultAuthTimeLookupFunction" />
</entry>
+ <entry>
+ <key>
+ <util:constant
+ static-field="net.shibboleth.idp.plugin.oidc.op.audit.AuditFields.ID_TOKEN_ISSUE_INSTANT"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.audit.impl.IdTokenClaimsAuditExtractor"
+ c:claim="iat" />
+ </entry>
+ <entry>
+ <key>
+ <util:constant
+ static-field="net.shibboleth.idp.plugin.oidc.op.audit.AuditFields.NONCE"/>
+ </key>
+ <bean class="net.shibboleth.idp.plugin.oidc.op.audit.impl.AuthenticationRequestClaimsAuditExtractor"
+ c:claim="nonce" />
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.USERNAME"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list