[java-idp-plugin-oidc-rp] branch main updated: Switch to support class for ACR to requested claims construction
Phil Smart
philip.smart at jisc.ac.uk
Wed Dec 21 16:21:25 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=0097edaf14d5f0b402c38a7a47744c5e0769b7ef
The following commit(s) were added to refs/heads/main by this push:
new 0097eda Switch to support class for ACR to requested claims construction
0097eda is described below
commit 0097edaf14d5f0b402c38a7a47744c5e0769b7ef
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Dec 21 16:21:23 2022 +0000
Switch to support class for ACR to requested claims construction
---
.../authn/oidc/rp/impl/BuildRequestObject.java | 96 +---------------------
1 file changed, 2 insertions(+), 94 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
index 756ca3b..0c9ddeb 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
@@ -18,8 +18,6 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.time.Duration;
-import java.util.ArrayList;
-import java.util.List;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -39,11 +37,7 @@ import com.google.common.base.Predicates;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.id.Audience;
import com.nimbusds.oauth2.sdk.id.Issuer;
-import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
-import com.nimbusds.openid.connect.sdk.claims.ACR;
-import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
-import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.idp.authn.AbstractAuthenticationAction;
@@ -53,7 +47,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
-import net.shibboleth.oidc.security.jwt.claims.impl.IDTokenClaims;
+import net.shibboleth.oidc.profile.encoding.AuthenticationContextClassReferenceSupport;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -248,7 +242,7 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
setClaimIfPresent(requestObjectClaims, "prompt", authnRequest.getPrompt());
// Build the ACRs if set before adding the 'claims' claim
- buildACRClaimsRequest(requestObjectClaims);
+ AuthenticationContextClassReferenceSupport.buildACRClaimsRequest(authnRequest);
if (authnRequest.getRequestedClaims() != null) {
requestObjectClaims.setClaim("claims", authnRequest.getRequestedClaims());
@@ -271,92 +265,6 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
}
- /**
- * Build an ID Token requested claims request with any ACR values in the authentication request. Will add to any
- * requested claims that already exist, or create a new requested claims if none already exist. If the 'acr' claim
- * already exists, the new ACRs will be added to the existing set of values and the Claim Requirement for all will
- * be set to ESSENTIAL.
- *
- *
- * @param requestObjectClaims the request object claims
- */
- private void buildACRClaimsRequest(@Nonnull final ClaimsSet requestObjectClaims) {
-
- final List<ACR> acrs = authnRequest.getAcrs();
-
- if (!acrs.isEmpty()) {
-
- // Create new claim and value. All explicitly requested ACRs are essential
- final ClaimsSetRequest.Entry acrEntry =
- new ClaimsSetRequest.Entry(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE.getClaimName())
- .withValues(acrs).withClaimRequirement(ClaimRequirement.ESSENTIAL);
-
- if (authnRequest.getRequestedClaims() != null
- && authnRequest.getRequestedClaims().getIDTokenClaimsRequest() != null) {
- // Requested claims may already exist, if so add.
- final ClaimsSetRequest requestedIdTokenClaims =
- authnRequest.getRequestedClaims().getIDTokenClaimsRequest();
-
- if (requestedIdTokenClaims.get(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE.getClaimName())
- != null) {
-
- // Must add ACRs to existing requested claims
- final ClaimsSetRequest.Entry existingAcr =
- requestedIdTokenClaims.get(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE
- .getClaimName());
-
- // Copy over the existing ones
- final List<ACR> acrValues = new ArrayList<>();
- if (existingAcr != null) {
- if (existingAcr.getValuesAsRawList() != null) {
- existingAcr.getValuesAsRawList().stream().forEach(acr -> {
- if (acr instanceof ACR) {
- acrValues.add((ACR)acr);
- } else if (acr != null) {
- acrValues.add(new ACR(acr.toString()));
- }
- });
- }
- // Value and values hold distinct entries for some reason
- if (existingAcr.getRawValue() instanceof ACR) {
- acrValues.add((ACR)existingAcr.getRawValue());
- } else if (existingAcr.getRawValue() != null){
- acrValues.add(new ACR(existingAcr.getValueAsString()));
- }
- }
- // Add the new ones
- acrs.stream().forEach(acrValues::add);
-
- // New claimset without ACR
- final ClaimsSetRequest deletedAcr =
- requestedIdTokenClaims.delete(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE
- .getClaimName());
- // New claimset with new ACR
- final ClaimsSetRequest addedNewAcr = deletedAcr.add(
- new ClaimsSetRequest.Entry(IDTokenClaims.AUTHENTICATION_CONTEXT_CLASS_REFERENCE
- .getClaimName()).withValues(acrValues)
- .withClaimRequirement(ClaimRequirement.ESSENTIAL));
-
- authnRequest.setRequestedClaims(authnRequest.getRequestedClaims()
- .withIDTokenClaimsRequest(addedNewAcr));
- } else {
- // Add ACRs to existing set of requested claims
- final ClaimsSetRequest requestPlusAcr = requestedIdTokenClaims.add(acrEntry);
- authnRequest.setRequestedClaims(authnRequest.getRequestedClaims()
- .withIDTokenClaimsRequest(requestPlusAcr));
- }
- } else {
- // Else create new
- final ClaimsSetRequest idTokenClaimsRequest = new ClaimsSetRequest().add(acrEntry);
- final OIDCClaimsRequest requested =
- new OIDCClaimsRequest().withIDTokenClaimsRequest(idTokenClaimsRequest);
- authnRequest.setRequestedClaims(requested);
- }
-
- }
-
- }
-
/**
* Set the claim onto the claims set if not {@code null}. Calls toString on each value, assuming it
* will produce the correct value.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list