[java-oidc-common] branch main updated: Fix extension element handling in OAuth metadata ext.
Scott Cantor
cantor.2 at osu.edu
Thu Feb 10 21:41:49 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=23a4026ff538a22fa43668c16fcaa2595c368dcb
The following commit(s) were added to refs/heads/main by this push:
new 23a4026 Fix extension element handling in OAuth metadata ext.
23a4026 is described below
commit 23a4026ff538a22fa43668c16fcaa2595c368dcb
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 10 16:41:46 2022 -0500
Fix extension element handling in OAuth metadata ext.
---
.../impl/ClientInformationNodeProcessor.java | 60 +++++++++++++++-------
.../impl/OAuthRPExtensionsUnmarshaller.java | 2 +-
2 files changed, 42 insertions(+), 20 deletions(-)
diff --git a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
index 255e729..7708f80 100644
--- a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
+++ b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/ClientInformationNodeProcessor.java
@@ -31,10 +31,12 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.core.xml.XMLObject;
+import org.opensaml.core.xml.schema.XSURI;
import org.opensaml.saml.criterion.RoleDescriptorCriterion;
import org.opensaml.saml.metadata.resolver.RoleDescriptorResolver;
import org.opensaml.saml.metadata.resolver.filter.FilterException;
import org.opensaml.saml.metadata.resolver.filter.MetadataNodeProcessor;
+import org.opensaml.saml.saml2.core.Audience;
import org.opensaml.saml.saml2.metadata.AssertionConsumerService;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.opensaml.saml.saml2.metadata.Extensions;
@@ -215,6 +217,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
if (metadata.getJWKSetURI() == null) {
metadata.setJWKSet(parseJwkSet(credentials, clientId));
}
+ metadata.setCustomField("audience", parseAudiences(extensions));
} else {
log.debug("No {} found to be processed", OAuthRPExtensions.TYPE_LOCAL_NAME);
}
@@ -227,7 +230,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param roleDescriptor The role descriptor to get the extensions from.
* @return The extensions, if they were found from the role descriptor. <code>null</code> otherwise.
*/
- protected @Nullable OAuthRPExtensions getOAuthRPExtensions(final SPSSODescriptor roleDescriptor) {
+ protected @Nullable OAuthRPExtensions getOAuthRPExtensions(@Nonnull final SPSSODescriptor roleDescriptor) {
final Extensions extensions = roleDescriptor.getExtensions();
if (extensions == null) {
log.debug("No extensions found from the given SPSSODescriptor");
@@ -256,7 +259,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param roleDescriptor The role descriptor to parse the credentials from.
* @return All the resolved credentials. Or empty set if none was found.
*/
- protected @Nonnull Iterable<Credential> resolveCredentials(final SPSSODescriptor roleDescriptor) {
+ protected @Nonnull Iterable<Credential> resolveCredentials(@Nonnull final SPSSODescriptor roleDescriptor) {
final MetadataCredentialResolver credentialResolver = new MetadataCredentialResolver();
credentialResolver.setKeyInfoCredentialResolver(keyInfoCredentialResolver);
credentialResolver.setRoleDescriptorResolver(new SkeletonEchoingRoleDescriptorResolver() {
@@ -291,7 +294,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param clientId The client ID related to the credentials.
* @return The given credentials converted into a JWKSet.
*/
- protected @Nullable JWKSet parseJwkSet(final @Nonnull Iterable<Credential> credentials,
+ @Nullable protected JWKSet parseJwkSet(@Nonnull final Iterable<Credential> credentials,
final @Nonnull String clientId) {
final List<JWK> jwks = new ArrayList<>();
for (final Credential credential : credentials) {
@@ -313,7 +316,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param clientId The client ID related to the credentials.
* @return The given credentials converted into a JWKS URI
*/
- protected @Nullable URI parseJwkUri(final @Nonnull Iterable<Credential> credentials,
+ @Nullable protected URI parseJwkUri(@Nonnull final Iterable<Credential> credentials,
final @Nonnull String clientId) {
for (final Credential credential : credentials) {
if (credential instanceof JWKReferenceCredential) {
@@ -331,7 +334,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param extensions The extensions to parse from.
* @return The client authentication method, or <code>null</code> it was not found.
*/
- protected @Nullable ClientAuthenticationMethod parseClientAuthenticationMethod(
+ @Nullable protected ClientAuthenticationMethod parseClientAuthenticationMethod(
final @Nonnull OAuthRPExtensions extensions) {
final String metadataValue = StringSupport.trimOrNull(extensions.getTokenEndpointAuthMethod());
if (metadataValue == null) {
@@ -347,7 +350,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @return {@link ApplicationType#NATIVE} if it was defined in the extensions, {@link ApplicationType#WEB}
* otherwise.
*/
- protected @Nonnull ApplicationType parseApplicationType(final @Nonnull OAuthRPExtensions extensions) {
+ @Nonnull protected ApplicationType parseApplicationType(@Nonnull final OAuthRPExtensions extensions) {
final String metadataValue = StringSupport.trimOrNull(extensions.getApplicationType());
if (ApplicationType.NATIVE.toString().equalsIgnoreCase(metadataValue)) {
return ApplicationType.NATIVE;
@@ -363,7 +366,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @return {@link SubjectType#PAIRWISE} if <code>pairwise</code> was defined as the name ID format.
* {@link SubjectType#PUBLIC} otherwise.
*/
- protected @Nonnull SubjectType parseSubjectType(final @Nonnull SPSSODescriptor roleDescriptor) {
+ @Nonnull protected SubjectType parseSubjectType(@Nonnull final SPSSODescriptor roleDescriptor) {
final List<NameIDFormat> nameIdFormats = roleDescriptor.getNameIDFormats();
if (nameIdFormats == null || nameIdFormats.isEmpty()) {
log.warn("No NameIDFormat defined, using 'public'");
@@ -393,7 +396,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param extensions The extensions to parse from.
* @return The list of ACR values that were found.
*/
- protected @Nonnull List<ACR> parseDefaultAcrValues(final @Nonnull OAuthRPExtensions extensions) {
+ @Nonnull protected List<ACR> parseDefaultAcrValues(@Nonnull final OAuthRPExtensions extensions) {
final List<ACR> acrs = new ArrayList<>();
for (final DefaultAcrValue acr : extensions.getDefaultAcrValues()) {
final String value = StringSupport.trimOrNull(acr.getValue());
@@ -410,7 +413,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param extensions The extensions to parse from.
* @return The set of grant types that were found.
*/
- protected @Nonnull Set<GrantType> parseGrantTypes(final @Nonnull OAuthRPExtensions extensions) {
+ @Nonnull protected Set<GrantType> parseGrantTypes(@Nonnull final OAuthRPExtensions extensions) {
final Set<GrantType> grantTypes = new HashSet<>();
final Collection<String> values = getListValues(extensions.getGrantTypes());
for (final String value : values) {
@@ -425,7 +428,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param extensions The extensions to parse from.
* @return The set of response types that were found.
*/
- protected @Nonnull Set<ResponseType> parseResponseTypes(final @Nonnull OAuthRPExtensions extensions) {
+ @Nonnull protected Set<ResponseType> parseResponseTypes(@Nonnull final OAuthRPExtensions extensions) {
final Set<ResponseType> responseTypes = new HashSet<>();
final Collection<String> values = getListValues(extensions.getResponseTypes());
for (final String value : values) {
@@ -440,7 +443,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param extensions The extensions to parse from.
* @return The scope that was found.
*/
- protected @Nonnull Scope parseScopes(final @Nonnull OAuthRPExtensions extensions) {
+ @Nonnull protected Scope parseScopes(@Nonnull final OAuthRPExtensions extensions) {
final Scope scope = new Scope();
final Collection<String> values = getListValues(extensions.getScopes());
for (final String value : values) {
@@ -455,7 +458,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param value The metadata value to parse from.
* @return The JWE algorithm, or <code>null</code> if no value was found.
*/
- protected @Nullable JWEAlgorithm parseJweAlgorithm(final @Nullable String value) {
+ @Nullable protected JWEAlgorithm parseJweAlgorithm(@Nullable final String value) {
if (value != null) {
return new JWEAlgorithm(value);
}
@@ -468,7 +471,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param value The metadata value to parse from.
* @return The JWS algorithm, or <code>null</code> if no value was found.
*/
- protected @Nullable JWSAlgorithm parseJwsAlgorithm(final @Nullable String value) {
+ @Nullable protected JWSAlgorithm parseJwsAlgorithm(@Nullable final String value) {
if (value != null) {
return new JWSAlgorithm(value);
}
@@ -481,7 +484,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param value The metadata value to parse from.
* @return The encryption method, or <code>null</code> if no value was found.
*/
- protected @Nullable EncryptionMethod parseEncryptionMethod(final @Nullable String value) {
+ @Nullable protected EncryptionMethod parseEncryptionMethod(@Nullable final String value) {
if (value != null) {
return new EncryptionMethod(value);
}
@@ -495,7 +498,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param roleDescriptor The role descriptor to parse from.
* @return The set of redirection URIs that were successfully parsed.
*/
- protected @Nonnull Set<URI> parseRedirectUris(final @Nonnull SPSSODescriptor roleDescriptor) {
+ @Nonnull protected Set<URI> parseRedirectUris(@Nonnull final SPSSODescriptor roleDescriptor) {
final Set<URI> uris = new HashSet<>();
for (final AssertionConsumerService acs : roleDescriptor.getAssertionConsumerServices()) {
if (BINDING_ID_REDIRECT_URI.equals(acs.getBinding())) {
@@ -514,7 +517,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param listOfValues The list to parse from.
* @return Set of URIs that were successfully parsed from the list.
*/
- protected @Nonnull Set<URI> parseUris(final @Nonnull List<? extends MetadataValueSAMLObject> listOfValues) {
+ @Nonnull protected Set<URI> parseUris(final @Nonnull List<? extends MetadataValueSAMLObject> listOfValues) {
final Set<URI> uris = new HashSet<>();
for (final MetadataValueSAMLObject value : listOfValues) {
final URI uri = getSingleURIValue(value);
@@ -525,6 +528,25 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
return uris;
}
+ /**
+ * Parse the SAML Audience elements.
+ *
+ * @param extensions extension container
+ *
+ * @return audience collection or null
+ */
+ @Nullable @NonnullElements protected List<String> parseAudiences(@Nonnull final OAuthRPExtensions extensions) {
+ final List<String> auds = new ArrayList<>();
+ for (final XMLObject aud : extensions.getUnknownXMLObjects(Audience.DEFAULT_ELEMENT_NAME)) {
+ if (aud instanceof Audience) {
+ if (((Audience) aud).getURI() != null) {
+ auds.add(((Audience) aud).getURI());
+ }
+ }
+ }
+ return auds.isEmpty() ? null : auds;
+ }
+
/**
* Parse an XML value list from a metadata value object into a collection of strings.
*
@@ -533,7 +555,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @return possibly empty value collection
*/
@Nonnull @NonnullElements
- protected Collection<String> getListValues(final @Nullable String metadataValue) {
+ protected Collection<String> getListValues(@Nullable final String metadataValue) {
if (metadataValue != null) {
return StringSupport.stringToList(metadataValue, " \t\n\r");
}
@@ -546,7 +568,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param metadataValue The metadata object value to convert from.
* @return The value as URI if it was successfully parsed, <code>null</code> otherwise.
*/
- protected @Nullable URI getSingleURIValue(final @Nonnull MetadataValueSAMLObject metadataValue) {
+ @Nullable protected URI getSingleURIValue(@Nonnull final MetadataValueSAMLObject metadataValue) {
return getSingleURIValue(metadataValue.getValue());
}
@@ -556,7 +578,7 @@ public class ClientInformationNodeProcessor implements MetadataNodeProcessor {
* @param value The raw string value.
* @return The value as URI if it was successfully parsed, <code>null</code> otherwise.
*/
- protected @Nullable URI getSingleURIValue(final @Nullable String value) {
+ @Nullable protected URI getSingleURIValue(@Nullable final String value) {
if (value != null) {
try {
return new URI(value);
diff --git a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java
index a97c02b..e080bbf 100644
--- a/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java
+++ b/oidc-common-saml-impl/src/main/java/net/shibboleth/oidc/saml/xmlobject/impl/OAuthRPExtensionsUnmarshaller.java
@@ -47,7 +47,7 @@ public class OAuthRPExtensionsUnmarshaller extends AbstractSAMLObjectUnmarshalle
} else if (childSAMLObject instanceof PostLogoutRedirectUri) {
descriptor.getPostLogoutRedirectUris().add((PostLogoutRedirectUri) childSAMLObject);
} else {
- super.processChildElement(parentSAMLObject, childSAMLObject);
+ descriptor.getUnknownXMLObjects().add(childSAMLObject);
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list