[java-oidc-common] branch main updated: Add policy control over encryption.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=61c6a6cf3f15b34a8ceb2730ce9372d3b3aaf9a0

The following commit(s) were added to refs/heads/main by this push:
     new 61c6a6c  Add policy control over encryption.
61c6a6c is described below

commit 61c6a6cf3f15b34a8ceb2730ce9372d3b3aaf9a0
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 9 10:14:53 2022 -0500

    Add policy control over encryption.
---
 .../config/AbstractOIDCSSOConfiguration.java       | 32 +++++++++++++++
 .../config/logic/EncryptionOptionalPredicate.java  | 47 ++++++++++++++++++++++
 2 files changed, 79 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index ea9d2fc..42ab775 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -57,6 +57,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
     /** Whether attributes should be resolved in the course of the profile. */
     @Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
 
+    /** Whether encryption is optional in the face of no key, etc. */
+    @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
+    
     /** Whether client is required to use PKCE. */
     @Nonnull private Predicate<ProfileRequestContext> forcePKCEPredicate;
 
@@ -93,6 +96,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
         super(profileId);
         issuerLookupStrategy = FunctionSupport.constant(null);
         resolveAttributesPredicate = Predicates.alwaysTrue();
+        encryptionOptionalPredicate = Predicates.alwaysTrue();
 
         forcePKCEPredicate = Predicates.alwaysFalse();
         allowPKCEPlainPredicate = Predicates.alwaysFalse();
@@ -163,7 +167,35 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
     public void setResolveAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
         resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
     }
+
+    /**
+     * Get whether encryption is optional in the face of a missing key, etc.
+     * 
+     * @param profileRequestContext current profile request context
+     * 
+     * @return true iff encryption is optional
+     */
+    public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
+        return encryptionOptionalPredicate.test(profileRequestContext);
+    }
     
+    /**
+     * Set whether encryption is optional in the face of a missing key, etc.
+     * 
+     * @param flag  flag to set
+     */
+    public void setEncryptionOptional(final boolean flag) {
+        encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+    }
+
+    /**
+     * Set a condition to determine whether encryption is optional in the face of a missing key, etc.
+     *
+     * @param condition condition to set
+     */
+    public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
+    }
 
    /**
     * Get whether client is required to use PKCE.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
new file mode 100644
index 0000000..8aa835f
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link AbstractOIDCSSOConfiguration#isEncryptionOptional(ProfileRequestContext)}.
+ */
+public class EncryptionOptionalPredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc instanceof AbstractOIDCSSOConfiguration) {
+                return ((AbstractOIDCSSOConfiguration) pc).isEncryptionOptional(input);
+            }
+        }
+        return false;
+    }
+
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.