[java-oidc-common] branch main updated: Add acr_values construction if provider does not support claims claim

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=abf8b4c6f1bd58a27c714da1bce7d6b944892ea5

The following commit(s) were added to refs/heads/main by this push:
     new abf8b4c  Add acr_values construction if provider does not support claims claim
abf8b4c is described below

commit abf8b4c6f1bd58a27c714da1bce7d6b944892ea5
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Dec 22 16:48:22 2022 +0000

    Add acr_values construction if provider does not support claims claim
    
    Which improves on earlier functionality that was removed.
---
 .../profile/core/OIDCAuthenticationRequest.java    | 23 +++++++++++++++++++-
 .../encoding/impl/AbstractOIDCMessageEncoder.java  | 25 ++++++++++++++++------
 2 files changed, 40 insertions(+), 8 deletions(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
index 613e3bd..0e42041 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -53,6 +53,8 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
     /** Individual requested claims.*/
     @Nullable private OIDCClaimsRequest requestedClaims;
     
+    /** Does the OpenID Provider support the claims parameter? Typically taken from its metadata.*/
+    private boolean providerSupportsClaimsParameter;
     
     /**
      * 
@@ -89,7 +91,6 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
         return null;
     }
 
-
     /**
      * Get the request object.
      * 
@@ -144,6 +145,26 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
         return requestedClaims;
     }
     
+    /**
+     * Does the OpenID Provider support the claims parameter?
+     * 
+     * @return true if it does, false otherwise.
+     */
+    public boolean providerSupportsClaimsParameter() {
+        return providerSupportsClaimsParameter;
+    }
+    
+    /**
+     * Sets the support for the {@code claims} authorisation request
+     * parameter.
+     *
+     * @param flag true if supported, false otherwise.
+     */
+    public void setProviderSupportsClaimsParameter(final boolean flag) {
+        providerSupportsClaimsParameter = flag;
+    }    
+    
+    
     //TODO others relating to sections 5.2, 5.5, 6, and 7.2.1
     
     
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
index 74b15af..725e980 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
@@ -21,6 +21,7 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Optional;
 import java.util.function.Predicate;
+import java.util.stream.Collectors;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -31,6 +32,7 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Predicates;
+import com.nimbusds.openid.connect.sdk.claims.ACR;
 
 import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
 import net.shibboleth.oidc.profile.encoding.AuthenticationContextClassReferenceSupport;
@@ -217,14 +219,23 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
         if (req.getMaxAge() != null && req.getMaxAge().toSeconds() > 0) {          
             params.add(new Pair<>("max_age", Long.toString(req.getMaxAge().toSeconds())));          
         }
-        // Add ACRs to claims if any before the claims are serialised
-        AuthenticationContextClassReferenceSupport.buildACRClaimsRequest(req);
-        if (req.getRequestedClaims() != null) {
-            params.add(new Pair<>("claims", req.getRequestedClaims().toJSONString()));
-        }
-        // acr_values param was removed in favour of adding ACRs to the requested claims as mandatory
         
-        //TODO: requestURI, includedGrantedScopes?, resource_uris
+        if (req.providerSupportsClaimsParameter()) {
+            // Add ACRs to claims if any before the claims are serialised
+            AuthenticationContextClassReferenceSupport.buildACRClaimsRequest(req);            
+            if (req.getRequestedClaims() != null) {
+                params.add(new Pair<>("claims", req.getRequestedClaims().toJSONString()));
+            }            
+        }
+        // Only add ACR values as acr_values if the provider does not support the 'claims' claim.
+        if (!req.providerSupportsClaimsParameter() && req.getAcrs() != null && !req.getAcrs().isEmpty()) {  
+            final String acrString =String.join(" ", req.getAcrs()
+                    .stream()
+                    .map(ACR::getValue)
+                    .collect(Collectors.toUnmodifiableList()));
+            params.add(new Pair<>("acr_values", acrString));          
+        }
+        //TODO: requestURI, includedGrantedScopes?, resource_uris, max_age?
         
         if (!validateParams(params)) {            
             throw new MessageEncodingException("Authorization parameters are not valid");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.