[java-idp-oidc] branch main updated: Javadoc and Checkstyle warning fixes.

Henri Mikkonen henri.mikkonen at iki.fi
Mon Mar 15 16:01:56 UTC 2021


This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e32acda6c6a0fc5864c5bbdf7b47ce7c211d5b83

The following commit(s) were added to refs/heads/main by this push:
       new  e32acda6  Javadoc and Checkstyle warning fixes.
e32acda6 is described below

commit e32acda6c6a0fc5864c5bbdf7b47ce7c211d5b83
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Mar 15 18:01:39 2021 +0200

    Javadoc and Checkstyle warning fixes.
---
 ...bstractAuthenticationRequestLookupFunction.java |  2 +-
 .../op/token/support/AccessTokenClaimsSet.java     |  2 +-
 .../op/token/support/AuthorizeCodeClaimsSet.java   |  2 +-
 .../op/token/support/RefreshTokenClaimsSet.java    |  2 +-
 .../oidc/op/token/support/TokenClaimsSet.java      | 15 ++++++++++++-
 .../AuthenticationRequestClaimsAuditExtractor.java |  2 +-
 .../op/audit/impl/IdTokenClaimsAuditExtractor.java |  2 +-
 .../plugin/oidc/op/audit/impl/package-info.java    | 19 ++++++++++++++++
 .../impl/OAuth2RevocationErrorResponse.java        |  2 +-
 .../op/profile/impl/AddAttributesToClaimsSet.java  |  4 ++++
 ...bjectSecurityConfigurationToClientMetadata.java |  4 ++++
 .../AddSecurityConfigurationToClientMetadata.java  | 12 ++++++++--
 .../oidc/op/profile/impl/CheckRedirectURIs.java    |  8 +++++--
 .../oidc/op/profile/impl/DecryptRequestObject.java | 26 +++++++++++++---------
 ...tboundAuthenticationResponseMessageContext.java |  5 +++++
 .../impl/PopulateOIDCEncryptionParameters.java     |  6 ++++-
 .../profile/impl/PopulateOIDCMetadataContext.java  |  1 +
 ...tionContextClassReferenceToResponseContext.java |  4 ++++
 .../SetSectorIdentifierForAttributeResolution.java |  2 +-
 ...etTokenDeliveryAttributesToResponseContext.java |  4 ++++
 .../impl/ValidateEndpointAuthentication.java       |  4 ++++
 .../plugin/oidc/op/profile/impl/ValidateGrant.java |  3 +++
 .../op/profile/impl/ValidateRequestObject.java     |  5 +++++
 .../AttributeResolutionSubjectLookupFunction.java  | 10 ++++++---
 ...entInformationEncryptionParametersResolver.java |  8 +++++++
 ...ormationSignatureSigningParametersResolver.java |  1 +
 ...ationSignatureValidationParametersResolver.java |  1 +
 .../plugin/oidc/op/security/impl/package-info.java | 21 +++++++++++++++++
 28 files changed, 149 insertions(+), 28 deletions(-)

diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java
index d0efec9a..76dc1111 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java
@@ -46,7 +46,7 @@ public abstract class AbstractAuthenticationRequestLookupFunction<T>
      * @param req authentication request to perform the lookup from.
      * @return lookup value.
      */
-    @Nullable abstract protected T doLookup(@Nonnull AuthenticationRequest req);
+    @Nullable protected abstract T doLookup(@Nonnull AuthenticationRequest req);
 
     /** {@inheritDoc} */
     @Nullable
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
index 07ba0c7f..7830d7fc 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
@@ -116,7 +116,7 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
      * @param accessTokenClaimsSet access token claims set
      */
     private AccessTokenClaimsSet(final JWTClaimsSet accessTokenClaimsSet) {
-        tokenClaimsSet = accessTokenClaimsSet;
+        setClaimsSet(accessTokenClaimsSet);
     }
 
     /**
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
index 1850c7fa..44a383fd 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
@@ -87,7 +87,7 @@ public final class AuthorizeCodeClaimsSet extends TokenClaimsSet {
      * @param authzCodeClaimsSet authorize code claims set
      */
     private AuthorizeCodeClaimsSet(final JWTClaimsSet authzCodeClaimsSet) {
-        tokenClaimsSet = authzCodeClaimsSet;
+        setClaimsSet(authzCodeClaimsSet);
     }
 
     /**
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
index 8518241d..1a551348 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
@@ -64,7 +64,7 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
      * @param refreshTokenClaimsSet refresh token claims set
      */
     private RefreshTokenClaimsSet(final JWTClaimsSet refreshTokenClaimsSet) {
-        tokenClaimsSet = refreshTokenClaimsSet;
+        setClaimsSet(refreshTokenClaimsSet);
     }
 
     /**
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
index 3a3298f1..0124c4eb 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
@@ -112,7 +112,7 @@ public class TokenClaimsSet {
     public static final String KEY_CODE_CHALLENGE = "cc";
 
     /** Claims set for the claim. */
-    protected JWTClaimsSet tokenClaimsSet;
+    private JWTClaimsSet tokenClaimsSet;
 
     /** Class logger. */
     @Nonnull private Logger log = LoggerFactory.getLogger(TokenClaimsSet.class);
@@ -278,6 +278,15 @@ public class TokenClaimsSet {
     public String serialize(@Nonnull final DataSealer dataSealer) throws DataSealerException {
         return dataSealer.wrap(serialize(), Instant.ofEpochMilli(tokenClaimsSet.getExpirationTime().getTime()));
     }
+    
+    /**
+     * Set the token claims set.
+     * 
+     * @param claimsSet What to set.
+     */
+    public void setClaimsSet(final @Nonnull JWTClaimsSet claimsSet) {
+        tokenClaimsSet = claimsSet;
+    }
 
     /**
      * Get the token claims set.
@@ -543,6 +552,8 @@ public class TokenClaimsSet {
      */
     public abstract static class Builder<T extends TokenClaimsSet> {
 
+        // Checkstyle: VisibilityModifier OFF
+
         /** Generator for pseudo unique identifier for the claims set. */
         @Nonnull
         protected IdentifierGenerationStrategy idGen;
@@ -617,6 +628,8 @@ public class TokenClaimsSet {
         /** Code challenge. */
         @Nullable
         protected String codeChallenge;
+        
+        // Checkstyle: VisibilityModifier ON
 
         /**
          * Constructor for authorize code builder.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java
index 5f9aeb3d..ba6663e9 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java
@@ -57,7 +57,7 @@ public class AuthenticationRequestClaimsAuditExtractor extends AbstractAuthentic
     
     /** {@inheritDoc} */
     @Override
-    protected String doLookup(AuthenticationRequest request) {
+    protected String doLookup(@Nonnull final AuthenticationRequest request) {
         try {
             if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim(key) != null) {
                 return getRequestObject().getJWTClaimsSet().getStringClaim(key);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/IdTokenClaimsAuditExtractor.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/IdTokenClaimsAuditExtractor.java
index ceff21d7..58045871 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/IdTokenClaimsAuditExtractor.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/IdTokenClaimsAuditExtractor.java
@@ -62,7 +62,7 @@ public class IdTokenClaimsAuditExtractor implements Function<ProfileRequestConte
 
     /** {@inheritDoc} */
     @Override
-    public String apply(ProfileRequestContext input) {
+    public String apply(@Nonnull final ProfileRequestContext input) {
         final ClaimsSet claims = idTokenClaimsLookupStrategy.apply(input);
         if (claims != null) {
             return claims.toJSONObject().getAsString(key);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/package-info.java
new file mode 100644
index 00000000..fd902c92
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/package-info.java
@@ -0,0 +1,19 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** Package for audit extractors related to OIDC. */
+package net.shibboleth.idp.plugin.oidc.op.audit.impl;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/messaging/impl/OAuth2RevocationErrorResponse.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/messaging/impl/OAuth2RevocationErrorResponse.java
index 13d8d2a0..52118083 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/messaging/impl/OAuth2RevocationErrorResponse.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/messaging/impl/OAuth2RevocationErrorResponse.java
@@ -29,7 +29,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
 public class OAuth2RevocationErrorResponse implements ErrorResponse {
 
     /** Error Object. */
-    ErrorObject errorObject;
+    private ErrorObject errorObject;
 
     /**
      * Constructor.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
index c3b05180..06077fdb 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
@@ -303,6 +303,8 @@ public class AddAttributesToClaimsSet extends AbstractOIDCResponseAction {
         return true;
     }
 
+    // Checkstyle: CyclomaticComplexity OFF
+
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -404,4 +406,6 @@ public class AddAttributesToClaimsSet extends AbstractOIDCResponseAction {
         }
     }
 
+    // Checkstyle: CyclomaticComplexity ON
+
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
index 044a4ff8..3d24db0b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
@@ -160,6 +160,8 @@ public class AddRequestObjectSecurityConfigurationToClientMetadata extends Abstr
         return true;
     }
 
+    // Checkstyle: CyclomaticComplexity OFF
+
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -213,4 +215,6 @@ public class AddRequestObjectSecurityConfigurationToClientMetadata extends Abstr
         }
     }
 
+    // Checkstyle: CyclomaticComplexity ON
+
 }
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
index 22f7240e..2dc28af7 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
@@ -145,6 +145,10 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
         }
         return true;
     }
+    
+    // Checkstyle: CyclomaticComplexity OFF
+    // Checkstyle: MethodLength OFF
+    // Checkstyle: ReturnCount OFF
 
     /** {@inheritDoc} */
     @Override
@@ -167,8 +171,8 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
             }
             if (getOutputMetadata().getIDTokenJWSAlg().equals(Algorithm.NONE) && implicitOrHybrid) {
                 log.warn(
-                        "{} The requested id_token_signed_response_alg 'none' is not supported when implicit or hybrid flow in response type",
-                        getLogPrefix());
+                        "{} The requested id_token_signed_response_alg 'none' is not supported "
+                        + "when implicit or hybrid flow in response type", getLogPrefix());
                 ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
                 return;
             }
@@ -259,5 +263,9 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
 
         // org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_MAC_HMAC_SHA512;
     }
+    
+    // Checkstyle: CyclomaticComplexity ON
+    // Checkstyle: MethodLength ON
+    // Checkstyle: ReturnCount ON
 
 }
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/CheckRedirectURIs.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/CheckRedirectURIs.java
index b8f19b82..a93f0c3e 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/CheckRedirectURIs.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/CheckRedirectURIs.java
@@ -145,7 +145,9 @@ public class CheckRedirectURIs extends AbstractProfileAction {
         request = (OIDCClientRegistrationRequest) message;
         return true;
     }
-    
+
+    // Checkstyle: CyclomaticComplexity OFF
+
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -201,7 +203,7 @@ public class CheckRedirectURIs extends AbstractProfileAction {
             }
             for (final URI redirectUri : redirectURIs) {
                 final String scheme = redirectUri.getScheme();
-                if (scheme.equalsIgnoreCase("http") && !redirectUri.getHost().equalsIgnoreCase("localhost")) {
+                if ("http".equalsIgnoreCase(scheme) && !"localhost".equalsIgnoreCase(redirectUri.getHost())) {
                     log.warn("{} http-scheme is only allowed to localhost for a native application", getLogPrefix());
                     ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_REDIRECT_URIS);
                     return;                                        
@@ -213,6 +215,8 @@ public class CheckRedirectURIs extends AbstractProfileAction {
         log.debug("{} Redirect URIs ({}) checked", getLogPrefix(), redirectURIs.size());
     }
     
+    // Checkstyle: CyclomaticComplexity ON
+
     /**
      * Verifies that all the given redirect URIs are found from the contents of the given sector identifier URI.
      * @param sectorIdUri The sector identifier URI.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/DecryptRequestObject.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/DecryptRequestObject.java
index 5e1f54d0..2f1bf849 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/DecryptRequestObject.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/DecryptRequestObject.java
@@ -112,7 +112,7 @@ public class DecryptRequestObject extends AbstractOIDCAuthenticationResponseActi
         if (encryptCtx == null
                 || !(encryptCtx.getAttributeEncryptionParameters() instanceof OIDCDecryptionParameters)) {
             log.error(
-                    "{} Encrypted request object but no EncryptionContext/OIDCDecryptionParameters parameters available",
+                    "{} Encrypted request object but no EncryptionContext/OIDCDecryptionParameters available",
                     getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
             return false;
@@ -121,24 +121,26 @@ public class DecryptRequestObject extends AbstractOIDCAuthenticationResponseActi
         return true;
     }
 
+    // Checkstyle: CyclomaticComplexity OFF
+
     /**
      * Decrypt request object.
      * 
-     * @param requestObject request object to decrypt.
+     * @param encryptedObject request object to decrypt.
      * @return Decrypted request object. Null if decrypting failed.
      */
-    private JWT decryptRequestObject(@Nonnull final EncryptedJWT requestObject) {
-        if (!requestObject.getHeader().getAlgorithm().getName().equals(params.getKeyTransportEncryptionAlgorithm())) {
+    private JWT decryptRequestObject(@Nonnull final EncryptedJWT encryptedObject) {
+        if (!encryptedObject.getHeader().getAlgorithm().getName().equals(params.getKeyTransportEncryptionAlgorithm())) {
             log.error("{} Request object alg {} not matching expected {}", getLogPrefix(),
-                    requestObject.getHeader().getAlgorithm().getName(), params.getKeyTransportEncryptionAlgorithm());
+                    encryptedObject.getHeader().getAlgorithm().getName(), params.getKeyTransportEncryptionAlgorithm());
             return null;
         }
-        if (!requestObject.getHeader().getEncryptionMethod().getName().equals(params.getDataEncryptionAlgorithm())) {
+        if (!encryptedObject.getHeader().getEncryptionMethod().getName().equals(params.getDataEncryptionAlgorithm())) {
             log.error("{} Request object enc {} not matching expected {}", getLogPrefix(),
-                    requestObject.getHeader().getEncryptionMethod().getName(), params.getDataEncryptionAlgorithm());
+                    encryptedObject.getHeader().getEncryptionMethod().getName(), params.getDataEncryptionAlgorithm());
             return null;
         }
-        final JWEAlgorithm encAlg = requestObject.getHeader().getAlgorithm();
+        final JWEAlgorithm encAlg = encryptedObject.getHeader().getAlgorithm();
         final Iterator<Credential> it = params.getKeyTransportDecryptionCredentials().iterator();
         while (it.hasNext()) {
             final Credential credential = it.next();
@@ -155,11 +157,11 @@ public class DecryptRequestObject extends AbstractOIDCAuthenticationResponseActi
                 }
                 if (decrypter == null) {
                     log.error("{} No decrypter for request object for encAlg {}", getLogPrefix(),
-                            requestObject.getHeader().getEncryptionMethod().getName());
+                            encryptedObject.getHeader().getEncryptionMethod().getName());
                     return null;
                 }
-                requestObject.decrypt(decrypter);
-                return JWTParser.parse(requestObject.getPayload().toString());
+                encryptedObject.decrypt(decrypter);
+                return JWTParser.parse(encryptedObject.getPayload().toString());
             } catch (final JOSEException | ParseException e) {
                 if (it.hasNext()) {
                     log.debug("{} Unable to decrypt request object with credential, {}, picking next key",
@@ -174,6 +176,8 @@ public class DecryptRequestObject extends AbstractOIDCAuthenticationResponseActi
         // Should never come here
         return null;
     }
+    
+    // Checkstyle: CyclomaticComplexity ON
 
     /** {@inheritDoc} */
     @Override
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
index 8a745536..49734cd3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
@@ -227,6 +227,8 @@ public class InitializeOutboundAuthenticationResponseMessageContext
         return true;
     }
 
+    // Checkstyle: CyclomaticComplexity OFF
+
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -297,4 +299,7 @@ public class InitializeOutboundAuthenticationResponseMessageContext
 
         relyingPartyCtx.setRelyingPartyIdContextTree(samlContext);
     }
+    
+    // Checkstyle: CyclomaticComplexity ON
+    
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParameters.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParameters.java
index 0469f20f..7166ae90 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParameters.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCEncryptionParameters.java
@@ -177,6 +177,8 @@ public class PopulateOIDCEncryptionParameters extends AbstractProfileAction {
         }
     }
 
+    // Checkstyle: CyclomaticComplexity OFF
+
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -221,6 +223,8 @@ public class PopulateOIDCEncryptionParameters extends AbstractProfileAction {
         }
         ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
     }
+    
+    // Checkstyle: CyclomaticComplexity ON
 
     /**
      * Build the criteria used as input to the {@link EncryptionParametersResolver}.
@@ -236,7 +240,7 @@ public class PopulateOIDCEncryptionParameters extends AbstractProfileAction {
         final OIDCMetadataContext oidcMetadataCtx = oidcMetadataContextLookupStrategy.apply(profileRequestContext);
         if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
             log.debug(
-                    "{} Adding oidc client information to resolution criteria for key transport / encryption algorithms",
+                    "{} Adding oidc client information to resolution criteria for key transport/encryption algorithms",
                     getLogPrefix());
             criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
         } else {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCMetadataContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCMetadataContext.java
index f6c7dc88..3bea04f6 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCMetadataContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/PopulateOIDCMetadataContext.java
@@ -53,6 +53,7 @@ public class PopulateOIDCMetadataContext extends AbstractProfileAction {
     @Nonnull
     private final Logger log = LoggerFactory.getLogger(PopulateOIDCMetadataContext.class);
     
+    /** Set the strategy used to look up the {@link SAMLMetadataContext} to draw from. */
     @Nonnull private Function<ProfileRequestContext, SAMLMetadataContext> samlMetadataContextLookupStrategy;
     
     /** SAML metadata context to populate from. */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java
index afb25c2c..1bc27b89 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java
@@ -109,6 +109,8 @@ public class SetAuthenticationContextClassReferenceToResponseContext extends Abs
         return true;
     }
 
+    // Checkstyle: CyclomaticComplexity OFF
+
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -138,5 +140,7 @@ public class SetAuthenticationContextClassReferenceToResponseContext extends Abs
             log.debug("{} Setting acr to {}", getLogPrefix(), name);
         }
     }
+    
+    // Checkstyle: CyclomaticComplexity ON
 
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSectorIdentifierForAttributeResolution.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSectorIdentifierForAttributeResolution.java
index 0ca780ec..72fd5f0d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSectorIdentifierForAttributeResolution.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSectorIdentifierForAttributeResolution.java
@@ -99,7 +99,7 @@ public class SetSectorIdentifierForAttributeResolution extends AbstractOIDCAuthe
         ((AttributeResolutionContext) profileRequestContext.getSubcontext(AttributeResolutionContext.class, true))
                 .setAttributeRecipientGroupID(sectorIdentifier);
         log.debug(
-                "{} Attribute recipient group id set to sector identifier value {} for generating subject of type pairwise",
+                "{} Attribute recipient group id set to sector identifier value {} for subject of type pairwise",
                 getLogPrefix(), sectorIdentifier);
     }
 
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
index b8932ee7..9ca49aae 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
@@ -259,6 +259,8 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
         }
     }
 
+    // Checkstyle: CyclomaticComplexity OFF
+
     /**
      * Access the registry of transcoding rules to transform the input attribute into claims.
      * 
@@ -322,4 +324,6 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
         }
     }
 
+    // Checkstyle: CyclomaticComplexity ON
+
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateEndpointAuthentication.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateEndpointAuthentication.java
index 137db9c9..24443f3d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateEndpointAuthentication.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateEndpointAuthentication.java
@@ -168,6 +168,8 @@ public class ValidateEndpointAuthentication extends AbstractOIDCRequestAction<Ab
         return true;
     }
     
+    // Checkstyle: CyclomaticComplexity OFF
+
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -219,6 +221,8 @@ public class ValidateEndpointAuthentication extends AbstractOIDCRequestAction<Ab
         ActionSupport.buildEvent(profileRequestContext, EventIds.ACCESS_DENIED);
     }
     
+    // Checkstyle: CyclomaticComplexity ON
+    
     /**
      * Checks whether the requested authentication method is enabled and matching to the desired method.
      * @param enabledMethods The list of enabled authentication method.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
index 1e5b53fb..2f372fb4 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
@@ -152,6 +152,8 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
         
         return true;
     }
+    
+    // Checkstyle: CyclomaticComplexity OFF
 
     /** {@inheritDoc} */
     @Override
@@ -223,4 +225,5 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
         getOidcResponseContext().setTokenClaimsSet(tokenClaimsSet);
     }
     
+    // Checkstyle: CyclomaticComplexity ON
 }
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRequestObject.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRequestObject.java
index 8c792ed1..221b80ae 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRequestObject.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRequestObject.java
@@ -93,6 +93,8 @@ public class ValidateRequestObject extends AbstractOIDCAuthenticationResponseAct
         }
         return true;
     }
+    
+    // Checkstyle: CyclomaticComplexity OFF
 
     /** {@inheritDoc} */
     @Override
@@ -142,4 +144,7 @@ public class ValidateRequestObject extends AbstractOIDCAuthenticationResponseAct
             return;
         }
     }    
+    
+    // Checkstyle: CyclomaticComplexity ON
+
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeResolutionSubjectLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeResolutionSubjectLookupFunction.java
index 650477ad..0dc85d46 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeResolutionSubjectLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeResolutionSubjectLookupFunction.java
@@ -62,7 +62,7 @@ public class AttributeResolutionSubjectLookupFunction extends AbstractIdentifiab
     /**
      * Name of the sub claim.
      */
-    @Nonnull @NotEmpty private static final String subClaimName = "sub";
+    @Nonnull @NotEmpty private static final String SUB_CLAIM_NAME = "sub";
     
     /** Class logger. */
     @Nonnull private Logger log = LoggerFactory.getLogger(AttributeResolutionSubjectLookupFunction.class);
@@ -119,6 +119,8 @@ public class AttributeResolutionSubjectLookupFunction extends AbstractIdentifiab
         }
     }
     
+    // Checkstyle: CyclomaticComplexity OFF
+
     /** {@inheritDoc} */
     @Nullable public String apply(@Nullable final ProfileRequestContext input) {
         final AttributeContext attributeCtx = attributeContextLookupStrategy.apply(input);
@@ -147,7 +149,7 @@ public class AttributeResolutionSubjectLookupFunction extends AbstractIdentifiab
                     
                     for (final TranscodingRule rule : transcodingRules) {
                         try {
-                            if (!subClaimName.equals(rule.getOrDefault(
+                            if (!SUB_CLAIM_NAME.equals(rule.getOrDefault(
                                     OIDCAttributeTranscoder.PROP_NAME, String.class, attribute.getId()))) {
                                 continue;
                             }
@@ -159,7 +161,7 @@ public class AttributeResolutionSubjectLookupFunction extends AbstractIdentifiab
                             final JSONObject encodedAttribute =
                                     transcoder.encode(input, attribute, JSONObject.class, rule);
                             if (encodedAttribute != null) {
-                                final String sub = encodedAttribute.getAsString(subClaimName);
+                                final String sub = encodedAttribute.getAsString(SUB_CLAIM_NAME);
                                 if (sub != null) {
                                     log.debug("Attribute '{}' produced usable value for sub claim", attribute.getId());
                                     return sub;
@@ -180,5 +182,7 @@ public class AttributeResolutionSubjectLookupFunction extends AbstractIdentifiab
         log.warn("Unable to produce a viable 'sub' claim");
         return null;
     }
+    
+    // Checkstyle: CyclomaticComplexity ON
 
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolver.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolver.java
index 2dac699c..47d30b3b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolver.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationEncryptionParametersResolver.java
@@ -171,6 +171,10 @@ public class OIDCClientInformationEncryptionParametersResolver extends BasicEncr
         }
 
     }
+    
+    // Checkstyle: CyclomaticComplexity OFF
+    // Checkstyle: MethodLength OFF
+    // Checkstyle: ReturnCount OFF
 
     /** {@inheritDoc} */
     @Override
@@ -342,6 +346,10 @@ public class OIDCClientInformationEncryptionParametersResolver extends BasicEncr
             super.resolveAndPopulateCredentialsAndAlgorithms(params, criteria, whitelistBlacklistPredicate);
         }
     }
+    
+    // Checkstyle: CyclomaticComplexity ON
+    // Checkstyle: MethodLength ON
+    // Checkstyle: ReturnCount ON
 
     /**
      * Generate symmetric key from client secret.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolver.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolver.java
index 674791c4..a4bad0f0 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolver.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureSigningParametersResolver.java
@@ -73,6 +73,7 @@ public class OIDCClientInformationSignatureSigningParametersResolver extends Bas
         USERINFO_SIGNING
     }
 
+    /** The type of signing: id_token or userinfo response. */
     private ParameterType target = ParameterType.IDTOKEN_SIGNING;
 
     /**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolver.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolver.java
index a7113a12..e03f7d4b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolver.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/OIDCClientInformationSignatureValidationParametersResolver.java
@@ -86,6 +86,7 @@ public class OIDCClientInformationSignatureValidationParametersResolver
         TOKEN_ENDPOINT_JWT_VALIDATION;
     }
 
+    /** The type of validation. */
     private ParameterType target = ParameterType.REQUEST_OBJECT_VALIDATION;
     
     /** The cache for remote JWK key sets. */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/package-info.java
new file mode 100644
index 00000000..b50a5285
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/impl/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Classes related to signing, signature validation, encryption and decryption parameter resolution.
+ */
+package net.shibboleth.idp.plugin.oidc.op.security.impl;
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list