[java-oidc-common] branch main updated: Add all ACR claims as mandatory claims to the requested claims

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=9291f71c8d05439179cd5ef13078a047ea629fdc

The following commit(s) were added to refs/heads/main by this push:
     new 9291f71  Add all ACR claims as mandatory claims to the requested claims
9291f71 is described below

commit 9291f71c8d05439179cd5ef13078a047ea629fdc
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Dec 21 16:14:12 2022 +0000

    Add all ACR claims as mandatory claims to the requested claims
    
     - And remove the voluntary acr_values request parameter
---
 .../encoding/impl/AbstractOIDCMessageEncoder.java     | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
index 774eea2..74b15af 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
@@ -21,7 +21,6 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Optional;
 import java.util.function.Predicate;
-import java.util.stream.Collectors;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -32,9 +31,9 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Predicates;
-import com.nimbusds.openid.connect.sdk.claims.ACR;
 
 import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.oidc.profile.encoding.AuthenticationContextClassReferenceSupport;
 import net.shibboleth.oidc.profile.encoding.OIDCMessageEncoder;
 import net.shibboleth.utilities.java.support.collection.Pair;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -179,7 +178,8 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
 // Checkstyle: CyclomaticComplexity OFF
     /**
      * Create the set of OAuth2.0 authorization and and OIDC authentication request parameters when no 
-     * RequestObject has been built. 
+     * RequestObject has been built. Note, ACRs are encoded into the requested claims as essential claims, the
+     * acr_values parameter is not used.
      * 
      * @param params the OAuth2.0 authorization and and OIDC authentication request parameters to set
      * @param req the current authentication request
@@ -217,17 +217,14 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
         if (req.getMaxAge() != null && req.getMaxAge().toSeconds() > 0) {          
             params.add(new Pair<>("max_age", Long.toString(req.getMaxAge().toSeconds())));          
         }
+        // Add ACRs to claims if any before the claims are serialised
+        AuthenticationContextClassReferenceSupport.buildACRClaimsRequest(req);
         if (req.getRequestedClaims() != null) {
             params.add(new Pair<>("claims", req.getRequestedClaims().toJSONString()));
         }
-        if (req.getAcrs() != null && !req.getAcrs().isEmpty()) {  
-            final String acrString =String.join(" ", req.getAcrs()
-                    .stream()
-                    .map(ACR::getValue)
-                    .collect(Collectors.toUnmodifiableList()));
-            params.add(new Pair<>("acr_values", acrString));          
-        }
-        //TODO: requestURI, includedGrantedScopes?, resource_uris, max_age?
+        // acr_values param was removed in favour of adding ACRs to the requested claims as mandatory
+        
+        //TODO: requestURI, includedGrantedScopes?, resource_uris
         
         if (!validateParams(params)) {            
             throw new MessageEncodingException("Authorization parameters are not valid");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.