[java-oidc-common] branch main updated: Add ACR support class to profile API
Phil Smart
philip.smart at jisc.ac.uk
Wed Dec 21 15:46:29 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=b356fe5111d9135daed029aa27114776371be02b
The following commit(s) were added to refs/heads/main by this push:
new b356fe5 Add ACR support class to profile API
b356fe5 is described below
commit b356fe5111d9135daed029aa27114776371be02b
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Dec 21 15:46:27 2022 +0000
Add ACR support class to profile API
---
...AuthenticationContextClassReferenceSupport.java | 122 +++++++++++++++++++++
1 file changed, 122 insertions(+)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/AuthenticationContextClassReferenceSupport.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/AuthenticationContextClassReferenceSupport.java
new file mode 100644
index 0000000..f21a864
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/AuthenticationContextClassReferenceSupport.java
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.encoding;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.claims.ACR;
+import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/**
+ * Support class for ACR operations.
+ */
+public final class AuthenticationContextClassReferenceSupport {
+
+ /** Private constructor.*/
+ private AuthenticationContextClassReferenceSupport() {
+
+ }
+
+ // Checkstyle: CyclomaticComplexity OFF
+ /**
+ * Build an ID Token requested claims request with any ACR values in the authentication request. Will add to any
+ * requested claims that already exist, or create a new requested claims if none already exist. If the 'acr' claim
+ * already exists, the new ACRs will be added to the existing set of values and the Claim Requirement for all will
+ * be set to ESSENTIAL.
+ *
+ * @param authnRequest the authentication request
+ */
+ public static final void buildACRClaimsRequest(@Nonnull final OIDCAuthenticationRequest authnRequest) {
+
+ final List<ACR> acrs = authnRequest.getAcrs();
+
+ if (!acrs.isEmpty()) {
+ // Create new claim and value. All explicitly requested ACRs are essential
+ final ClaimsSetRequest.Entry acrEntry =
+ new ClaimsSetRequest.Entry("acr")
+ .withValues(acrs).withClaimRequirement(ClaimRequirement.ESSENTIAL);
+
+ if (authnRequest.getRequestedClaims() != null
+ && authnRequest.getRequestedClaims().getIDTokenClaimsRequest() != null) {
+ // Requested claims may already exist, if so add.
+ final ClaimsSetRequest requestedIdTokenClaims =
+ authnRequest.getRequestedClaims().getIDTokenClaimsRequest();
+
+ if (requestedIdTokenClaims.get("acr")
+ != null) {
+
+ // Must add ACRs to existing requested claims
+ final ClaimsSetRequest.Entry existingAcr =
+ requestedIdTokenClaims.get("acr");
+
+ // Copy over the existing ones
+ final List<ACR> acrValues = new ArrayList<>();
+ if (existingAcr != null) {
+ if (existingAcr.getValuesAsRawList() != null) {
+ existingAcr.getValuesAsRawList().stream().forEach(acr -> {
+ if (acr instanceof ACR) {
+ acrValues.add((ACR)acr);
+ } else if (acr != null) {
+ acrValues.add(new ACR(acr.toString()));
+ }
+ });
+ }
+ // Value and values hold distinct entries for some reason
+ if (existingAcr.getRawValue() instanceof ACR) {
+ acrValues.add((ACR)existingAcr.getRawValue());
+ } else if (existingAcr.getRawValue() != null){
+ acrValues.add(new ACR(existingAcr.getValueAsString()));
+ }
+ }
+ // Add the new ones
+ acrs.stream().forEach(acrValues::add);
+
+ // New claimset without ACR
+ final ClaimsSetRequest deletedAcr =
+ requestedIdTokenClaims.delete("acr");
+ // New claimset with new ACR
+ final ClaimsSetRequest addedNewAcr = deletedAcr.add(
+ new ClaimsSetRequest.Entry("acr").withValues(acrValues)
+ .withClaimRequirement(ClaimRequirement.ESSENTIAL));
+
+ authnRequest.setRequestedClaims(authnRequest.getRequestedClaims()
+ .withIDTokenClaimsRequest(addedNewAcr));
+ } else {
+ // Add ACRs to existing set of requested claims
+ final ClaimsSetRequest requestPlusAcr = requestedIdTokenClaims.add(acrEntry);
+ authnRequest.setRequestedClaims(authnRequest.getRequestedClaims()
+ .withIDTokenClaimsRequest(requestPlusAcr));
+ }
+ } else {
+ // Else create new
+ final ClaimsSetRequest idTokenClaimsRequest = new ClaimsSetRequest().add(acrEntry);
+ final OIDCClaimsRequest requested =
+ new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
+ authnRequest.setRequestedClaims(requested);
+ }
+ }
+ }
+ // Checkstyle: CyclomaticComplexity ON
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list