[java-oidc-common] branch main updated: Expose ClaimsValidator via profile config.
Scott Cantor
cantor.2 at osu.edu
Mon Jan 3 14:39:51 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=7a93ee31316b8e649ae2cc5226e2faf9b4d4209b
The following commit(s) were added to refs/heads/main by this push:
new 7a93ee3 Expose ClaimsValidator via profile config.
7a93ee3 is described below
commit 7a93ee31316b8e649ae2cc5226e2faf9b4d4209b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 3 09:39:48 2022 -0500
Expose ClaimsValidator via profile config.
---
oidc-common-profile-api/pom.xml | 5 ++
.../navigate/ClaimsValidatorLookupFunction.java | 55 ++++++++++++++++++++++
...th2ClientAuthenticableProfileConfiguration.java | 44 ++++++++++++++++-
3 files changed, 103 insertions(+), 1 deletion(-)
diff --git a/oidc-common-profile-api/pom.xml b/oidc-common-profile-api/pom.xml
index 11a6fad..adbec69 100644
--- a/oidc-common-profile-api/pom.xml
+++ b/oidc-common-profile-api/pom.xml
@@ -18,6 +18,11 @@
</properties>
<dependencies>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-crypto-api</artifactId>
+ <scope>compile</scope>
+ </dependency>
<dependency>
<groupId>net.shibboleth.idp</groupId>
<artifactId>idp-core</artifactId>
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClaimsValidatorLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClaimsValidatorLookupFunction.java
new file mode 100644
index 0000000..2c58a50
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClaimsValidatorLookupFunction.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2ClientAuthenticableProfileConfiguration;
+
+/**
+ * A function that obtains
+ * {@link AbstractOAuth2ClientAuthenticableProfileConfiguration#getClaimsValidator(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 3.1.0
+ */
+public class ClaimsValidatorLookupFunction extends AbstractRelyingPartyLookupFunction<ClaimsValidator> {
+
+ /** {@inheritDoc} */
+ @Nullable public ClaimsValidator apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof AbstractOAuth2ClientAuthenticableProfileConfiguration) {
+ return ((AbstractOAuth2ClientAuthenticableProfileConfiguration) pc).getClaimsValidator(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index 321ad8b..933e751 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -36,6 +36,7 @@ import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -53,6 +54,9 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
/** Enabled token endpoint authentication methods. */
@Nonnull private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy;
+
+ /** Validation of JWT claims for subset of client auth methods. */
+ @Nonnull private Function<ProfileRequestContext,ClaimsValidator> claimsValidatorLookupStrategy;
/** Whether to mandate forced authentication for the request. */
@Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
@@ -84,7 +88,8 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
ClientAuthenticationMethod.CLIENT_SECRET_POST.toString(),
ClientAuthenticationMethod.CLIENT_SECRET_JWT.toString(),
ClientAuthenticationMethod.PRIVATE_KEY_JWT.toString()));
-
+ claimsValidatorLookupStrategy = FunctionSupport.constant(null);
+
forceAuthnPredicate = Predicates.alwaysFalse();
proxyCountLookupStrategy = FunctionSupport.constant(null);
defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
@@ -134,6 +139,43 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
@Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
tokenEndpointAuthMethodsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
+ /**
+ * Get the {@link ClaimsValidator} to apply to JWT-based client authentication.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the validator to use
+ *
+ * @since 3.1.0
+ */
+ @Nullable public ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext) {
+ return claimsValidatorLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the {@link ClaimsValidator} to apply to JWT-based client authentication.
+ *
+ * @param validator validator to use
+ *
+ * @since 3.1.0
+ */
+ public void setClaimsValidator(@Nullable final ClaimsValidator validator) {
+ claimsValidatorLookupStrategy = FunctionSupport.constant(validator);
+ }
+
+
+ /**
+ * Set a lookup strategy for the {@link ClaimsValidator} to apply to JWT-based client authentication.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.1.0
+ */
+ public void setClaimsValidatorLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,ClaimsValidator> strategy) {
+ claimsValidatorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
/** {@inheritDoc} */
public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list