[java-oidc-common] branch main updated: Add encryption setting to UserInfo config.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=872c4d94ecc55213adce5c56558ef5950cdd9dd6

The following commit(s) were added to refs/heads/main by this push:
     new 872c4d9  Add encryption setting to UserInfo config.
872c4d9 is described below

commit 872c4d94ecc55213adce5c56558ef5950cdd9dd6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 9 11:39:20 2022 -0500

    Add encryption setting to UserInfo config.
---
 .../profile/config/OIDCUserInfoConfiguration.java  | 36 ++++++++++++++++++++++
 .../config/logic/EncryptionOptionalPredicate.java  |  6 +++-
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
index 0c815f3..5d51bd4 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
@@ -21,12 +21,15 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
 import java.util.function.Function;
+import java.util.function.Predicate;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.profile.context.ProfileRequestContext;
 
+import com.google.common.base.Predicates;
+
 import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
 import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
@@ -51,6 +54,9 @@ public class OIDCUserInfoConfiguration extends AbstractConditionalProfileConfigu
     /** Lookup function to override issuer value. */
     @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
 
+    /** Whether encryption is optional in the face of no key, etc. */
+    @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
+
     /** Lookup function to supply attribute IDs to omit from UserInfo token. */
     @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
     
@@ -70,6 +76,7 @@ public class OIDCUserInfoConfiguration extends AbstractConditionalProfileConfigu
         super(profileId);
         
         issuerLookupStrategy = FunctionSupport.constant(null);
+        encryptionOptionalPredicate = Predicates.alwaysTrue();
         deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
     }
 
@@ -95,6 +102,35 @@ public class OIDCUserInfoConfiguration extends AbstractConditionalProfileConfigu
     public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
         issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
     }
+
+    /**
+     * Get whether encryption is optional in the face of a missing key, etc.
+     * 
+     * @param profileRequestContext current profile request context
+     * 
+     * @return true iff encryption is optional
+     */
+    public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
+        return encryptionOptionalPredicate.test(profileRequestContext);
+    }
+    
+    /**
+     * Set whether encryption is optional in the face of a missing key, etc.
+     * 
+     * @param flag  flag to set
+     */
+    public void setEncryptionOptional(final boolean flag) {
+        encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+    }
+
+    /**
+     * Set a condition to determine whether encryption is optional in the face of a missing key, etc.
+     *
+     * @param condition condition to set
+     */
+    public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
+    }
     
     /**
      * Get the set of attribute IDs which should be omitted from the UserInfo token.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
index 8aa835f..3ec4e17 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
@@ -25,10 +25,12 @@ import net.shibboleth.idp.profile.config.ProfileConfiguration;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
 import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration;
 
 /**
  * A predicate implementation that forwards to
- * {@link AbstractOIDCSSOConfiguration#isEncryptionOptional(ProfileRequestContext)}.
+ * {@link AbstractOIDCSSOConfiguration#isEncryptionOptional(ProfileRequestContext)} or
+ * {@link OIDCUserInfoConfiguration#isEncryptionOptional(ProfileRequestContext)}.
  */
 public class EncryptionOptionalPredicate extends AbstractRelyingPartyPredicate {
     
@@ -39,6 +41,8 @@ public class EncryptionOptionalPredicate extends AbstractRelyingPartyPredicate {
             final ProfileConfiguration pc = rpc.getProfileConfig();
             if (pc instanceof AbstractOIDCSSOConfiguration) {
                 return ((AbstractOIDCSSOConfiguration) pc).isEncryptionOptional(input);
+            } else if (pc instanceof OIDCUserInfoConfiguration) {
+                return ((OIDCUserInfoConfiguration) pc).isEncryptionOptional(input);
             }
         }
         return false;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.