[java-oidc-common] branch main updated: Add untrusted audience setting/predicate.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=c1517d90802fe5d105a264c4da9f3458f4df6952

The following commit(s) were added to refs/heads/main by this push:
     new c1517d9  Add untrusted audience setting/predicate.
c1517d9 is described below

commit c1517d90802fe5d105a264c4da9f3458f4df6952
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 3 11:19:50 2022 -0500

    Add untrusted audience setting/predicate.
---
 .../config/AbstractOIDCSSOConfiguration.java       | 41 +++++++++++++++++++
 .../logic/AllowUntrustedAudiencePredicate.java     | 47 ++++++++++++++++++++++
 2 files changed, 88 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index 8a17bfd..ea9d2fc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -63,6 +63,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
     /** Whether client is allowed to use PKCE code challenge method plain. */
     @Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
 
+    /** Whether to issue access tokens to a primary audience with no client metadata. */
+    @Nonnull private Predicate<ProfileRequestContext> allowUntrustedAudience;
+    
     /** Lookup function to supply ID token lifetime. */
     @Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
 
@@ -94,6 +97,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
         forcePKCEPredicate = Predicates.alwaysFalse();
         allowPKCEPlainPredicate = Predicates.alwaysFalse();
         
+        allowUntrustedAudience = Predicates.alwaysFalse();
         accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
         
         idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
@@ -219,6 +223,43 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
        allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
    }
    
+   /**
+    * Get whether to issue access tokens to a primary audience that has no associated client metadata.
+    * 
+    * <p>Defaults to "false".</p>
+    * 
+    * <p>The "primary" audience is presumed to be the first in the case of multiple. The main impact of
+    * this setting is whether to issue unencrypted JWT format tokens given no metadata to identify encryption
+    * settings.</p> 
+    * 
+    * @param profileRequestContext profile request context
+    * 
+    * @return whether to issue access tokens to a primary audience that has no associated client metadata
+    */
+   public boolean isAllowUntrustedAudience(@Nullable final ProfileRequestContext profileRequestContext) {
+       return allowUntrustedAudience.test(profileRequestContext);
+   }
+   
+   /**
+    * Set whether to issue access tokens to a primary audience that has no associated client metadata.
+    * 
+    * @param flag flag to set
+    */
+   public void setAllowUntrustedAudience(final boolean flag) {
+       allowUntrustedAudience = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+   }
+
+   /**
+    * Set a predicate to determine whether to issue access tokens to a primary audience that has no
+    * associated client metadata.
+    * 
+    * @param condition condition to set
+    */
+   public void setAllowUntrustedAudiencePredicate(
+           @Nonnull final Predicate<ProfileRequestContext> condition) {
+       allowUntrustedAudience = Constraint.isNotNull(condition, "Condition cannot be null");
+   }
+   
    /**
     * Get access token type.
     * 
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowUntrustedAudiencePredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowUntrustedAudiencePredicate.java
new file mode 100644
index 0000000..98e6ea2
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowUntrustedAudiencePredicate.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link AbstractOIDCSSOConfiguration#isAllowUntrustedAudience(ProfileRequestContext)}.
+ */
+public class AllowUntrustedAudiencePredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc instanceof AbstractOIDCSSOConfiguration) {
+                return ((AbstractOIDCSSOConfiguration) pc).isAllowUntrustedAudience(input);
+            }
+        }
+        return false;
+    }
+
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.