[java-oidc-common] branch main updated: JOIDC-61 Support metadata policies in the dyn. reg. profile configuration
Henri Mikkonen
henri.mikkonen at iki.fi
Tue Jan 4 11:28:00 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=485dfe4b62f468d93314927fe3053122350e7870
The following commit(s) were added to refs/heads/main by this push:
new 485dfe4 JOIDC-61 Support metadata policies in the dyn. reg. profile configuration
485dfe4 is described below
commit 485dfe4b62f468d93314927fe3053122350e7870
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Jan 4 13:26:33 2022 +0200
JOIDC-61 Support metadata policies in the dyn. reg. profile configuration
https://shibboleth.atlassian.net/browse/JOIDC-61
Initial wiring of metadata policy support for dynamic registration with
supporting lookup functions.
---
oidc-common-profile-api/pom.xml | 7 +-
.../OIDCDynamicRegistrationConfiguration.java | 37 ++++++++++
.../RegistrationMetadataPolicyLookupFunction.java | 54 ++++++++++++++
...edRegistrationMetadataPolicyLookupFunction.java | 83 ++++++++++++++++++++++
4 files changed, 180 insertions(+), 1 deletion(-)
diff --git a/oidc-common-profile-api/pom.xml b/oidc-common-profile-api/pom.xml
index adbec69..44e0742 100644
--- a/oidc-common-profile-api/pom.xml
+++ b/oidc-common-profile-api/pom.xml
@@ -38,6 +38,11 @@
<artifactId>idp-authn-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-metadata-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>oauth2-oidc-sdk</artifactId>
@@ -69,4 +74,4 @@
</plugins>
</build>
-</project>
\ No newline at end of file
+</project>
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
index dc43a88..3fb4243 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
@@ -18,6 +18,7 @@
package net.shibboleth.oidc.profile.config;
import java.time.Duration;
+import java.util.Map;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -26,6 +27,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -53,6 +55,9 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
/** Lookup function to supply client secret expiration period. */
@Nullable private Function<ProfileRequestContext,Duration> secretExpirationPeriodLookupStrategy;
+ /** Lookup function to the default metadata policy. */
+ @Nullable private Function<ProfileRequestContext,Map<String,MetadataPolicy>> metadataPolicyLookupStrategy;
+
/**
* Constructor.
*/
@@ -70,6 +75,7 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
issuerLookupStrategy = FunctionSupport.constant(null);
setRegistrationValidityPeriod(Duration.ofHours(24));
setSecretExpirationPeriod(Duration.ofDays(365));
+ metadataPolicyLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -180,4 +186,35 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
secretExpirationPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /**
+ * Get the metadata policy.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return metadata policy
+ */
+ @Nullable
+ public Map<String,MetadataPolicy> getMetadataPolicy(@Nullable final ProfileRequestContext profileRequestContext) {
+ return metadataPolicyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Sets the metadata policy.
+ *
+ * @param policy metadata policy
+ */
+ public void setMetadataPolicy(@Nonnull Map<String,MetadataPolicy> policy) {
+ metadataPolicyLookupStrategy = FunctionSupport.constant(policy);
+ }
+
+ /**
+ * Set a lookup strategy for the metadata policy.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setMetadataPolicyLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Map<String,MetadataPolicy>> strategy) {
+ metadataPolicyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationMetadataPolicyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationMetadataPolicyLookupFunction.java
new file mode 100644
index 0000000..6ccd9cc
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationMetadataPolicyLookupFunction.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.Map;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
+import net.shibboleth.oidc.profile.config.OIDCDynamicRegistrationConfiguration;
+
+/**
+ * A function that returns
+ * {@link OIDCDynamicRegistrationConfiguration#getMetadataPolicy(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class RegistrationMetadataPolicyLookupFunction
+ extends AbstractRelyingPartyLookupFunction<Map<String,MetadataPolicy>> {
+
+ /** {@inheritDoc} */
+ @Nullable public Map<String,MetadataPolicy> apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null && pc instanceof OIDCDynamicRegistrationConfiguration) {
+ return ((OIDCDynamicRegistrationConfiguration) pc).getMetadataPolicy(input);
+ }
+ }
+ return null;
+ }
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ResolverBasedRegistrationMetadataPolicyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ResolverBasedRegistrationMetadataPolicyLookupFunction.java
new file mode 100644
index 0000000..c8310ad
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ResolverBasedRegistrationMetadataPolicyLookupFunction.java
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.Map;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
+import net.shibboleth.oidc.metadata.policy.MetadataPolicyResolver;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * A lookup function for the map of {@link MetadataPolicy} objects, resolved via configurable
+ * {@link MetadataPolicyResolver} and optionally configurable {@link CriteriaSet}. First object returned by the
+ * resolver is returned.
+ */
+public class ResolverBasedRegistrationMetadataPolicyLookupFunction
+ extends AbstractRelyingPartyLookupFunction<Map<String,MetadataPolicy>> {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(ResolverBasedRegistrationMetadataPolicyLookupFunction.class);
+
+ /** The metadata policy resolver. */
+ @Nullable private MetadataPolicyResolver metadataPolicyResolver;
+
+ /** The criteria set used for the metadata policy resolver. */
+ @Nullable private CriteriaSet criteriaSet;
+
+ /**
+ * Set the metadata policy resolver.
+ * @param resolver What to set.
+ */
+ public void setMetadataPolicyResolver(@Nullable final MetadataPolicyResolver resolver) {
+ metadataPolicyResolver = resolver;
+ }
+
+ /**
+ * Set the criteria set used for the metadata policy resolver.
+ * @param criteria What to set.
+ */
+ public void setCriteriaSet(@Nullable final CriteriaSet criteria) {
+ criteriaSet = criteria;
+ }
+
+ /** {@inheritDoc} */
+ @Override @Nullable public Map<String, MetadataPolicy> apply(@Nullable final ProfileRequestContext input) {
+ if (metadataPolicyResolver == null) {
+ log.debug("No metadata policy resolver configured, returning null");
+ return null;
+ }
+ log.debug("Starting to resolve single metadata policy");
+ try {
+ return metadataPolicyResolver.resolveSingle(criteriaSet == null ? new CriteriaSet() : criteriaSet);
+ } catch (final ResolverException e) {
+ log.error("Resolver exception catched while resolving metadata policy", e);
+ }
+ return null;
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list