[java-oidc-common] branch main updated: Add JWK keyset to publish lookup strategy to commons

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=7e574a1b425f7587e1c004b91de30c4c12e5c9b1

The following commit(s) were added to refs/heads/main by this push:
     new 7e574a1  Add JWK keyset to publish lookup strategy to commons
7e574a1 is described below

commit 7e574a1b425f7587e1c004b91de30c4c12e5c9b1
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Dec 2 11:42:30 2022 +0000

    Add JWK keyset to publish lookup strategy to commons
---
 .../JWKCredentialsToPublishLookupStrategy.java     | 68 ++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWKCredentialsToPublishLookupStrategy.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWKCredentialsToPublishLookupStrategy.java
new file mode 100644
index 0000000..a83a971
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWKCredentialsToPublishLookupStrategy.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.security.credential.Credential;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * Strategy to locate the set of JWK credentials to publish in a KeySet document.
+ */
+public class JWKCredentialsToPublishLookupStrategy implements Function<OIDCSecurityConfiguration, List<Credential>> {
+    
+    /** Class logger. */
+    @Nonnull private final Logger log = LoggerFactory.getLogger(JWKCredentialsToPublishLookupStrategy.class);
+
+    @Override
+    @Nonnull public List<Credential> apply(@Nullable final OIDCSecurityConfiguration config) {
+        
+        if (config == null) {
+            return Collections.emptyList();
+        }
+        final List<Credential> credentials = new ArrayList<>();
+        
+        if (config.getJwtSignatureSigningConfiguration() != null) {
+            credentials.addAll(config.getJwtSignatureSigningConfiguration().getSigningCredentials());
+        }
+        if (config.getJwtDecryptionConfiguration() != null) {
+            try {
+                final Iterable<Credential> resolvedCreds = 
+                        config.getJwtDecryptionConfiguration().getKEKCredentialResolver().resolve(new CriteriaSet());
+                resolvedCreds.forEach(credentials::add);
+            } catch (final ResolverException e) {
+               log.debug("Unable to resolve decryption credentials", e);
+            }
+
+        }
+        return credentials;
+    }
+
+}

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.