[java-oidc-common] branch main updated: Introduce separate profile config for OAuth token audiences.
Scott Cantor
cantor.2 at osu.edu
Thu Feb 10 16:53:44 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=71e594df77c5e802d893cef4cdf340c3f16e3e40
The following commit(s) were added to refs/heads/main by this push:
new 71e594d Introduce separate profile config for OAuth token audiences.
71e594d is described below
commit 71e594df77c5e802d893cef4cdf340c3f16e3e40
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 10 11:53:16 2022 -0500
Introduce separate profile config for OAuth token audiences.
---
.../config/AbstractOIDCSSOConfiguration.java | 111 ++--------
.../logic/AllowUntrustedAudiencePredicate.java | 47 ----
.../config/logic/EncryptionOptionalPredicate.java | 3 +
.../config/logic/ResolveAttributesPredicate.java | 3 +
.../AccessTokenLifetimeLookupFunction.java | 3 +
.../navigate/AccessTokenTypeLookupFunction.java | 5 +-
.../config/OAuth2TokenAudienceConfiguration.java | 244 +++++++++++++++++++++
7 files changed, 274 insertions(+), 142 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index 42ab775..288f714 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -65,18 +65,12 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** Whether client is allowed to use PKCE code challenge method plain. */
@Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainPredicate;
-
- /** Whether to issue access tokens to a primary audience with no client metadata. */
- @Nonnull private Predicate<ProfileRequestContext> allowUntrustedAudience;
/** Lookup function to supply ID token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
/** Lookup function to supply access token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
-
- /** Lookup functioon to supply access token type. */
- @Nonnull private Function<ProfileRequestContext,String> accessTokenTypeLookupStrategy;
/** Lookup function to supply refresh token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> refreshTokenLifetimeLookupStrategy;
@@ -101,9 +95,6 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
forcePKCEPredicate = Predicates.alwaysFalse();
allowPKCEPlainPredicate = Predicates.alwaysFalse();
- allowUntrustedAudience = Predicates.alwaysFalse();
- accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
-
idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
refreshTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(2));
@@ -204,27 +195,27 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
*
* @return whether client is required to use PKCE
*/
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
- return forcePKCEPredicate.test(profileRequestContext);
- }
+ public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
+ return forcePKCEPredicate.test(profileRequestContext);
+ }
/**
* Set whether client is required to use PKCE.
*
* @param flag flag to set
*/
- public void setForcePKCE(final boolean flag) {
- forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
+ public void setForcePKCE(final boolean flag) {
+ forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
/**
* Set condition for whether client is required to use PKCE.
*
* @param condition condition to set
*/
- public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
+ public void setForcePKCEPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
/**
* Get whether client is allowed to use PKCE code challenge method plain.
@@ -233,93 +224,27 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
*
* @return whether client is allowed to use PKCE code challenge method plain
*/
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
- return allowPKCEPlainPredicate.test(profileRequestContext);
- }
+ public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
+ return allowPKCEPlainPredicate.test(profileRequestContext);
+ }
/**
* Set whether client is allowed to use PKCE code challenge method plain.
*
* @param flag flag to set
*/
- public void setAllowPKCEPlain(final boolean flag) {
- allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
+ public void setAllowPKCEPlain(final boolean flag) {
+ allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
/**
* Set condition for whether client is allowed to use PKCE code challenge method plain.
*
* @param condition condition to set
*/
- public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether to issue access tokens to a primary audience that has no associated client metadata.
- *
- * <p>Defaults to "false".</p>
- *
- * <p>The "primary" audience is presumed to be the first in the case of multiple. The main impact of
- * this setting is whether to issue unencrypted JWT format tokens given no metadata to identify encryption
- * settings.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to issue access tokens to a primary audience that has no associated client metadata
- */
- public boolean isAllowUntrustedAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return allowUntrustedAudience.test(profileRequestContext);
- }
-
- /**
- * Set whether to issue access tokens to a primary audience that has no associated client metadata.
- *
- * @param flag flag to set
- */
- public void setAllowUntrustedAudience(final boolean flag) {
- allowUntrustedAudience = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a predicate to determine whether to issue access tokens to a primary audience that has no
- * associated client metadata.
- *
- * @param condition condition to set
- */
- public void setAllowUntrustedAudiencePredicate(
- @Nonnull final Predicate<ProfileRequestContext> condition) {
- allowUntrustedAudience = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get access token type.
- *
- * @param profileRequestContext profile request context
- *
- * @return access token type, or null for unspecified/opaque
- */
- @Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
- return accessTokenTypeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set access token type.
- *
- * @param type token type, or null for unspecified/opaque
- */
- public void setAccessTokenType(@Nullable @NotEmpty final String type) {
- accessTokenTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
- }
-
- /**
- * Set lookup strategy for access token type.
- *
- * @param strategy lookup strategy
- */
- public void setAccessTokenTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- accessTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
+ public void setAllowPKCEPlainPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
/**
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowUntrustedAudiencePredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowUntrustedAudiencePredicate.java
deleted file mode 100644
index 98e6ea2..0000000
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowUntrustedAudiencePredicate.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.oidc.profile.config.logic;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
-
-/**
- * A predicate implementation that forwards to
- * {@link AbstractOIDCSSOConfiguration#isAllowUntrustedAudience(ProfileRequestContext)}.
- */
-public class AllowUntrustedAudiencePredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).isAllowUntrustedAudience(input);
- }
- }
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
index 3ec4e17..9059830 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
@@ -26,6 +26,7 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
import net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
/**
* A predicate implementation that forwards to
@@ -43,6 +44,8 @@ public class EncryptionOptionalPredicate extends AbstractRelyingPartyPredicate {
return ((AbstractOIDCSSOConfiguration) pc).isEncryptionOptional(input);
} else if (pc instanceof OIDCUserInfoConfiguration) {
return ((OIDCUserInfoConfiguration) pc).isEncryptionOptional(input);
+ } else if (pc instanceof OAuth2TokenAudienceConfiguration) {
+ return ((OAuth2TokenAudienceConfiguration) pc).isEncryptionOptional(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ResolveAttributesPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ResolveAttributesPredicate.java
index 223b79b..e556a34 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ResolveAttributesPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ResolveAttributesPredicate.java
@@ -25,6 +25,7 @@ import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
/**
* A predicate implementation that forwards to
@@ -39,6 +40,8 @@ public class ResolveAttributesPredicate extends AbstractRelyingPartyPredicate {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc instanceof AbstractOIDCSSOConfiguration) {
return ((AbstractOIDCSSOConfiguration) pc).isResolveAttributes(input);
+ } else if (pc instanceof OAuth2TokenAudienceConfiguration) {
+ return ((OAuth2TokenAudienceConfiguration) pc).isResolveAttributes(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java
index 1f14b5c..ba36199 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java
@@ -27,6 +27,7 @@ import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
/**
* A function that returns
@@ -45,6 +46,8 @@ public class AccessTokenLifetimeLookupFunction extends AbstractRelyingPartyLooku
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc instanceof AbstractOIDCSSOConfiguration) {
return ((AbstractOIDCSSOConfiguration) pc).getAccessTokenLifetime(input);
+ } else if (pc instanceof OAuth2TokenAudienceConfiguration) {
+ return ((OAuth2TokenAudienceConfiguration) pc).getAccessTokenLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenTypeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenTypeLookupFunction.java
index a4e15f5..938a79b 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenTypeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenTypeLookupFunction.java
@@ -25,6 +25,7 @@ import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
/**
* A function that returns
@@ -41,8 +42,8 @@ public class AccessTokenTypeLookupFunction extends AbstractRelyingPartyLookupFun
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).getAccessTokenType(input);
+ if (pc instanceof OAuth2TokenAudienceConfiguration) {
+ return ((OAuth2TokenAudienceConfiguration) pc).getAccessTokenType(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
new file mode 100644
index 0000000..facc8ac
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
@@ -0,0 +1,244 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.time.Duration;
+import java.util.function.Function;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.google.common.base.Predicates;
+
+import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+
+/**
+ * Interface for OAuth 2 token "audience" profile configuration.
+ *
+ * <p>This applies to behavior controlling the characteristics of tokens issued
+ * to the parties intended to process them, as distinct from the clients that use them.</p>
+ */
+public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfileConfiguration
+ implements OAuth2ProfileConfiguration, OverriddenIssuerProfileConfiguration {
+
+ /** OAuth2 Token Revocation URI. */
+ @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc6749";
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token/audience";
+
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
+ /** Whether attributes should be resolved in the course of the profile. */
+ @Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
+
+ /** Whether encryption is optional in the face of no key, etc. */
+ @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
+
+ /** Lookup functioon to supply access token type. */
+ @Nonnull private Function<ProfileRequestContext,String> accessTokenTypeLookupStrategy;
+
+ /** Lookup function to supply access token lifetime. */
+ @Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
+
+ /** Constructor. */
+ public OAuth2TokenAudienceConfiguration() {
+ this(PROFILE_ID);
+ }
+
+ /**
+ * Creates a new configuration instance.
+ *
+ * @param profileId Unique profile identifier.
+ */
+ public OAuth2TokenAudienceConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+
+ issuerLookupStrategy = FunctionSupport.constant(null);
+
+ resolveAttributesPredicate = Predicates.alwaysTrue();
+ encryptionOptionalPredicate = Predicates.alwaysTrue();
+
+ accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
+ accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
+ }
+
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set overridden issuer value.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ issuerLookupStrategy = FunctionSupport.constant(issuer);
+ }
+
+ /**
+ * Sets lookup strategy for overridden issuer value.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
+ /**
+ * Get whether attributes should be resolved during the profile.
+ *
+ * <p>Default is true.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff attributes should be resolved
+ */
+ public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
+ return resolveAttributesPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether attributes should be resolved during the profile.
+ *
+ * @param flag flag to set
+ */
+ public void setResolveAttributes(final boolean flag) {
+ resolveAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether attributes should be resolved during the profile.
+ *
+ * @param condition condition to set
+ */
+ public void setResolveAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
+ }
+
+ /**
+ * Get whether encryption is optional in the face of a missing key, etc.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff encryption is optional
+ */
+ public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptionOptionalPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether encryption is optional in the face of a missing key, etc.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptionOptional(final boolean flag) {
+ encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether encryption is optional in the face of a missing key, etc.
+ *
+ * @param condition condition to set
+ */
+ public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
+ }
+
+
+ /**
+ * Get access token type.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return access token type, or null for unspecified/opaque
+ */
+ @Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
+ return accessTokenTypeLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set access token type.
+ *
+ * @param type token type, or null for unspecified/opaque
+ */
+ public void setAccessTokenType(@Nullable @NotEmpty final String type) {
+ accessTokenTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
+ }
+
+ /**
+ * Set lookup strategy for access token type.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAccessTokenTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ accessTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Get access token lifetime.
+ *
+ * <p>Defaults to 10 minutes.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return access token lifetime
+ */
+ @Positive @Nonnull
+ public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Duration lifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
+
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Access token lifetime must be greater than 0");
+ return lifetime;
+ }
+
+ /**
+ * Set the lifetime of an access token.
+ *
+ * @param lifetime lifetime of an access token in milliseconds
+ */
+ public void setAccessTokenLifetime(@Positive @Nonnull final Duration lifetime) {
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Access token lifetime must be greater than 0");
+
+ accessTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
+ }
+
+ /**
+ * Set a lookup strategy for the access token lifetime.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAccessTokenLifetimeLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,Duration> strategy) {
+ accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list