[java-oidc-common] branch main updated: Add an activation condition that checks the number of values for a claim
Phil Smart
philip.smart at jisc.ac.uk
Thu Feb 3 11:46:17 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=eea09ce85fe695b49e00054e6242ac4905c327c1
The following commit(s) were added to refs/heads/main by this push:
new eea09ce Add an activation condition that checks the number of values for a claim
eea09ce is described below
commit eea09ce85fe695b49e00054e6242ac4905c327c1
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Feb 3 11:46:12 2022 +0000
Add an activation condition that checks the number of values for a claim
---
.../NumberOfClaimValuesActivationCondition.java | 87 ++++++++++++++++++++
...NumberOfClaimValuesActivationConditionTest.java | 94 ++++++++++++++++++++++
2 files changed, 181 insertions(+)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationCondition.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationCondition.java
new file mode 100644
index 0000000..2be4084
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationCondition.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.jwt.claims.impl;
+
+import java.util.List;
+import java.util.function.BiPredicate;
+import java.util.function.IntPredicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.concurrent.ThreadSafe;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Activation condition to check the number of values a claim has against a given predicate.
+ *
+ * <p>A claim that does not exist will still be tested with a size of 0.</p>
+ * <p>A claim that exists but not as a list will be assumed to have a single value (size = 1).</p>
+ *
+ */
+ at ThreadSafe
+public class NumberOfClaimValuesActivationCondition implements BiPredicate<ProfileRequestContext, JWTClaimsSet> {
+
+ /** The name of the claim to check exists in the claims set.*/
+ @Nonnull @NotEmpty private final String claimToCheck;
+
+ /** The predicate used to determine if the claim has the correct number of values.*/
+ @Nonnull private final IntPredicate numberOfValuesPredicate;
+
+
+ /**
+ *
+ * Constructor.
+ *
+ * @param claimName the name of the claim to check exists in the claims set.
+ * @param predicate the predicate used to determine if the claim has the correct number of values.
+ */
+ public NumberOfClaimValuesActivationCondition(
+ @Nonnull @NotEmpty @ParameterName(name="claimToCheck") final String claimName,
+ @Nonnull @ParameterName(name="numberOfValuesPredicate") final IntPredicate predicate) {
+ claimToCheck = Constraint.isNotEmpty(claimName, "Claim to check can not be empty or null");
+ numberOfValuesPredicate = Constraint.isNotNull(predicate, "Has Size Predicate can not be null");
+ }
+
+ @Override
+ public boolean test(@Nonnull final ProfileRequestContext context, @Nonnull final JWTClaimsSet claims) {
+
+ if (claims.getClaim(claimToCheck) == null) {
+ return numberOfValuesPredicate.test(0);
+ }
+ final Object claimAsObject = claims.getClaim(claimToCheck);
+
+ final List<?> claimAsList;
+
+ try {
+ claimAsList = (List<?>)claimAsObject;
+ return numberOfValuesPredicate.test(claimAsList.size());
+
+ } catch (final ClassCastException e) {
+ // if not list/JSONArray, must be a single value, although that value itself could be
+ // another object
+ return numberOfValuesPredicate.test(1);
+ }
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationConditionTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationConditionTest.java
new file mode 100644
index 0000000..f28d6f0
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationConditionTest.java
@@ -0,0 +1,94 @@
+package net.shibboleth.oidc.security.jwt.claims.impl;
+
+import static org.junit.Assert.assertTrue;
+import static org.testng.Assert.assertFalse;
+
+import java.text.ParseException;
+import java.util.List;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+
+/** Tests for ClaimExistsWithMultipleValuesActivationCondition.*/
+public class NumberOfClaimValuesActivationConditionTest {
+
+ /** The condition to test.*/
+ private NumberOfClaimValuesActivationCondition condition;
+
+
+ @Test
+ public void testMulitvaluedList() throws ParseException {
+
+ condition = new NumberOfClaimValuesActivationCondition("aud", size -> size > 1);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("jdoe")
+ .audience(List.of("rp_1","rp_2","rp3")).build();
+
+ assertTrue(condition.test(new ProfileRequestContext(), claimsSet));
+ }
+
+ @Test
+ public void testSingleValuedList() throws ParseException {
+
+ condition = new NumberOfClaimValuesActivationCondition("aud", size -> size == 1);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("jdoe")
+ .audience(List.of("rp_1")).build();
+
+ assertTrue(condition.test(new ProfileRequestContext(), claimsSet));
+ }
+
+ @Test
+ public void testSingleValuedList_LookingForMultivalued() throws ParseException {
+
+ condition = new NumberOfClaimValuesActivationCondition("aud", size -> size > 1);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("jdoe")
+ .audience(List.of("rp_1")).build();
+
+ assertFalse(condition.test(new ProfileRequestContext(), claimsSet));
+ }
+
+ @Test
+ public void testEmptyClaim_LookingForMultivalued() throws ParseException {
+
+ condition = new NumberOfClaimValuesActivationCondition("aud", size -> size > 1);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("jdoe").build();
+
+ assertFalse(condition.test(new ProfileRequestContext(), claimsSet));
+ }
+
+ @Test
+ public void testEmptyClaim_LookingForEmpty() throws ParseException {
+
+ condition = new NumberOfClaimValuesActivationCondition("aud", size -> size == 0);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("jdoe").build();
+
+ assertTrue(condition.test(new ProfileRequestContext(), claimsSet));
+ }
+
+ @Test
+ public void testClaimSingleValued() throws ParseException {
+
+ condition = new NumberOfClaimValuesActivationCondition("sub", size -> size == 1);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("jdoe").build();
+
+ assertTrue(condition.test(new ProfileRequestContext(), claimsSet));
+ }
+
+ @Test
+ public void testClaimNullValued() throws ParseException {
+
+ condition = new NumberOfClaimValuesActivationCondition("nullClaim", size -> size == 0);
+
+ final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("jdoe")
+ .claim("nullClaim", null).build();
+
+ assertTrue(condition.test(new ProfileRequestContext(), claimsSet));
+ }
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list