[java-oidc-common] branch main updated: Remove redundant params from an authn request using a request object
Phil Smart
philip.smart at jisc.ac.uk
Fri Dec 16 16:59:26 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=149e615dda695997dbd27ea68933ecea0903e1ba
The following commit(s) were added to refs/heads/main by this push:
new 149e615 Remove redundant params from an authn request using a request object
149e615 is described below
commit 149e615dda695997dbd27ea68933ecea0903e1ba
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Dec 16 16:59:24 2022 +0000
Remove redundant params from an authn request using a request object
---
.../encoding/impl/AbstractOIDCMessageEncoder.java | 90 ++++++++++++++++++----
1 file changed, 75 insertions(+), 15 deletions(-)
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
index 0a7aeee..d539d17 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
@@ -108,7 +108,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
return builder.buildQueryString();
}
- // Checkstyle: CyclomaticComplexity OFF
+
/**
* Create a list of OAuth 2.0 authorization parameters from the {@link OIDCAuthenticationRequest} object.
*
@@ -126,6 +126,27 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
final List<Pair<String, String>> params = new ArrayList<>();
+ // Switch depending on whether a request object is used or not
+ if (req.getRequestObject() != null) {
+ createParametersFromRequestWithRequestObject(params, req);
+ } else {
+ createParametersFromRequestWithoutRequestObject(params,req);
+ }
+ return params;
+ }
+
+ /**
+ * Create the set of OAuth2.0 authorization and and OIDC authentication request parameters when a RequestObject
+ * is present.
+ *
+ * @param params the OAuth2.0 authorization and and OIDC authentication request parameters to set
+ * @param req the current authentication request
+ *
+ * @throws MessageEncodingException if there is an error building the parameters
+ */
+ private void createParametersFromRequestWithRequestObject(@Nonnull final List<Pair<String, String>> params,
+ @Nonnull final OIDCAuthenticationRequest req) throws MessageEncodingException {
+
// The following three parameters are *always* required, even if a request object is used.
params.add(new Pair<>("client_id", req.getClientID().getValue()));
if (req.getResponseType() != null) {
@@ -134,9 +155,55 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
// Must contain openid so the authz server knows it is an OIDC request
params.add(new Pair<>("scope", req.getScope().toString()));
- // These parameters are optional if already contained in the Request Object. Although
- // We add both here (currently).
-
+ // Only set the response_mode if not equal to the default for that response_type
+ if (req.getDefaultResponseMode() != null &&
+ !req.getDefaultResponseMode().equals(req.getResponseMode())){
+ params.add(new Pair<>("response_mode", req.getResponseMode().getValue()));
+ }
+ if (req.getRequestObject() != null) {
+ try {
+ params.add(new Pair<>("request", req.getRequestObject().serialize()));
+ } catch (final IllegalStateException e) {
+ throw new MessageEncodingException("Couldn't serialize request object to JWT: " + e.getMessage(), e);
+ }
+ }
+ // This would need to be a requested claim inside the request object, so keep as URL param
+ if (!req.getAcrs().isEmpty()) {
+ final String acrString =String.join(" ", req.getAcrs()
+ .stream()
+ .map(ACR::getValue)
+ .collect(Collectors.toUnmodifiableList()));
+ params.add(new Pair<>("acr_values", acrString));
+ }
+
+ if (!validateParams(params)) {
+ throw new MessageEncodingException("Authorization parameters are not valid");
+ }
+
+
+
+ }
+
+// Checkstyle: CyclomaticComplexity OFF
+ /**
+ * Create the set of OAuth2.0 authorization and and OIDC authentication request parameters when no
+ * RequestObject has been built.
+ *
+ * @param params the OAuth2.0 authorization and and OIDC authentication request parameters to set
+ * @param req the current authentication request
+ *
+ * @throws MessageEncodingException if there is an error building the parameters
+ */
+ private void createParametersFromRequestWithoutRequestObject(@Nonnull final List<Pair<String, String>> params,
+ @Nonnull final OIDCAuthenticationRequest req) throws MessageEncodingException {
+
+
+ params.add(new Pair<>("client_id", req.getClientID().getValue()));
+ if (req.getResponseType() != null) {
+ params.add(new Pair<>("response_type", req.getResponseType().toString()));
+ }
+ // Must contain openid so the authz server knows it is an OIDC request
+ params.add(new Pair<>("scope", req.getScope().toString()));
// Only set the response_mode if not equal to the default for that response_type
if (req.getDefaultResponseMode() != null &&
@@ -151,14 +218,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
}
if (req.getPrompt() != null) {
params.add(new Pair<>("prompt", req.getPrompt().toString()));
- }
- if (req.getRequestObject() != null) {
- try {
- params.add(new Pair<>("request", req.getRequestObject().serialize()));
- } catch (final IllegalStateException e) {
- throw new MessageEncodingException("Couldn't serialize request object to JWT: " + e.getMessage(), e);
- }
- }
+ }
if (req.getNonce() != null) {
params.add(new Pair<>("nonce", req.getNonce().getValue()));
}
@@ -175,16 +235,16 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
.collect(Collectors.toUnmodifiableList()));
params.add(new Pair<>("acr_values", acrString));
}
- //TODO: requestURI, includedGrantedScopes?, resource_uris?
+ //TODO: requestURI, includedGrantedScopes?, resource_uris, max_age?
if (!validateParams(params)) {
throw new MessageEncodingException("Authorization parameters are not valid");
}
- return params;
}
- // Checkstyle: CyclomaticComplexity ON
+// Checkstyle: CyclomaticComplexity ON
+
/**
* Ensure the authorization parameters are valid.
*
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list