[java-oidc-common] branch main updated: JCOMOIDC-35 - Add OAuth 2.0 authorization and OIDC authentication request objects
Phil Smart
philip.smart at jisc.ac.uk
Fri Jan 7 14:09:18 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=be3078c985c387dc79c057029cbec07c860c790d
The following commit(s) were added to refs/heads/main by this push:
new be3078c JCOMOIDC-35 - Add OAuth 2.0 authorization and OIDC authentication request objects
be3078c is described below
commit be3078c985c387dc79c057029cbec07c860c790d
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jan 7 14:09:11 2022 +0000
JCOMOIDC-35 - Add OAuth 2.0 authorization and OIDC authentication
request objects
- Add first version of both objects.
https://shibboleth.atlassian.net/browse/JCOMOIDC-35
---
.../profile/core/OAuthAuthorizationRequest.java | 313 +++++++++++++++++++++
.../profile/core/OIDCAuthenticationRequest.java | 98 +++++++
.../shibboleth/oidc/profile/core/package-info.java | 21 ++
oidc-common-profile-impl/pom.xml | 37 +++
.../src/test/resources/logback-test.xml | 32 +++
pom.xml | 12 +-
6 files changed, 512 insertions(+), 1 deletion(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java
new file mode 100644
index 0000000..9ef16de
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java
@@ -0,0 +1,313 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.core;
+
+import java.net.URI;
+import java.time.Duration;
+import java.util.Collections;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import com.nimbusds.oauth2.sdk.ResponseMode;
+import com.nimbusds.oauth2.sdk.ResponseType;
+import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.oauth2.sdk.id.State;
+import com.nimbusds.openid.connect.sdk.Display;
+import com.nimbusds.openid.connect.sdk.Nonce;
+import com.nimbusds.openid.connect.sdk.Prompt;
+import com.nimbusds.openid.connect.sdk.claims.ACR;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * An OAuth 2.0 authorization request.
+ * <p> This class is mutable and not thread-safe.</p>
+ */
+public class OAuthAuthorizationRequest {
+
+ /** The client identifier. Required.*/
+ @Nonnull private final ClientID clientID;
+
+ /** The state. */
+ @Nullable private State state;
+
+ /** The redirect URI to which the response will be sent. */
+ @Nullable private URI redirectURI;
+
+ /** The authorization processing flow to use.*/
+ @Nullable private ResponseType responseType;
+
+ /** The request endpoint. */
+ @Nullable private URI endpointURI;
+
+ /** The nonce. */
+ @Nullable private Nonce nonce;
+
+ /** The requested scopes.*/
+ @Nonnull private final Scope scope;
+
+ /**
+ * ASCII string value that specifies how the Authorization Server
+ * displays the authentication and consent user interface pages to the End-User.
+ */
+ @Nullable private Display display;
+
+ /**
+ * Space delimited, case sensitive list of ASCII string values that
+ * specifies whether the Authorization Server prompts the End-User
+ * for reauthentication and consent.
+ */
+ @Nullable private Prompt prompt;
+
+ /**
+ * Specifies the allowable elapsed time in seconds since the last time
+ * the End-User was actively authenticated by the OP.
+ */
+ @Nullable private Duration maxAge;
+
+ /**
+ * List of requested authentication context class reference values.
+ * Values appear in order of preference. Optional.
+ */
+ @Nonnull @NotLive private List<ACR> acrs;
+
+ /** The response mode. Optional. */
+ @Nullable private ResponseMode responseMode;
+
+ //TODO there are a few others.
+
+ /**
+ *
+ * Constructor.
+ *
+ * @param id the clientID. Never {@literal null}.
+ */
+ public OAuthAuthorizationRequest(@Nonnull final ClientID id) {
+ clientID = Constraint.isNotNull(id, "ClientID can not be null");
+ acrs = Collections.emptyList();
+ scope = new Scope();
+
+ }
+
+ /**
+ * Get the client ID.
+ *
+ * @return the clientID.
+ */
+ @Nonnull public ClientID getClientID() {
+ return clientID;
+ }
+
+ /**
+ * Get the state.
+ *
+ * @return the state.
+ */
+ @Nullable public State getState() {
+ return state;
+ }
+
+ /**
+ * Set the state. Optional.
+ *
+ * @param theState The state to set.
+ */
+ public void setState(@Nullable final State theState) {
+ state = theState;
+ }
+
+ /**
+ * Get the redirect_uri.
+ *
+ * @return the redirectURI.
+ */
+ @Nullable public URI getRedirectURI() {
+ return redirectURI;
+ }
+
+ /**
+ * Set the redirect_uri.
+ *
+ * @param uri The redirect_uri to set.
+ */
+ public void setRedirectURI(@Nonnull final URI uri) {
+ redirectURI = Constraint.isNotNull(uri,"RedirectURI can not be null");
+ }
+
+ /**
+ * Get the response type.
+ *
+ * @return the responseType.
+ */
+ @Nullable public ResponseType getResponseType() {
+ return responseType;
+ }
+
+ /**
+ * Set the response type.
+ *
+ * @param type The responseType to set.
+ */
+ public void setResponseType(@Nonnull final ResponseType type) {
+ responseType = Constraint.isNotNull(type,"ResponseType can not be null");
+ }
+
+ /**
+ * Get the endpoint_uri.
+ *
+ * @return the endpoint_uri.
+ */
+ @Nullable public URI getEndpointURI() {
+ return endpointURI;
+ }
+
+ /**
+ * Set the endpoint_uri.
+ *
+ * @param uri The endpointURI to set.
+ */
+ public void setEndpointURI(@Nonnull final URI uri) {
+ endpointURI = Constraint.isNotNull(uri,"EndpointURI can not be null");
+ }
+
+ /**
+ * Get the nonce.
+ *
+ * @return the nonce.
+ */
+ @Nullable public Nonce getNonce() {
+ return nonce;
+ }
+
+ /**
+ * Set the nonce.
+ *
+ * @param theNonce The nonce to set.
+ */
+ public void setNonce(@Nullable final Nonce theNonce) {
+ nonce = theNonce;
+ }
+
+ /**
+ * Get the scope.
+ *
+ * @return the scope.
+ */
+ @Nonnull public Scope getScope() {
+ return scope;
+ }
+
+ /**
+ * Get the display.
+ *
+ * @return the display.
+ */
+ @Nullable public Display getDisplay() {
+ return display;
+ }
+
+ /**
+ * Set the display.
+ *
+ * @param theDisplay The display to set.
+ */
+ public void setDisplay(@Nullable final Display theDisplay) {
+ display = theDisplay;
+ }
+
+ /**
+ * Get the prompt.
+ *
+ * @return the prompt.
+ */
+ @Nullable public Prompt getPrompt() {
+ return prompt;
+ }
+
+ /**
+ * Set the prompt.
+ *
+ * @param thePrompt The prompt to set.
+ */
+ public void setPrompt(@Nullable final Prompt thePrompt) {
+ prompt = thePrompt;
+ }
+
+ /**
+ * Get the max age.
+ *
+ * @return the maxAge.
+ */
+ @Nullable public Duration getMaxAge() {
+ return maxAge;
+ }
+
+ /**
+ * Set the max age.
+ *
+ * @param max The maxAge to set.
+ */
+ public void setMaxAge(@Nullable final Duration max) {
+ maxAge = max;
+ }
+
+ /**
+ * Get the ACRs.
+ *
+ * @return the acrs.
+ */
+ @Nonnull @NotLive @Unmodifiable public List<ACR> getAcrs() {
+ return Collections.unmodifiableList(acrs);
+ }
+
+ /**
+ * Set the ACRs.
+ *
+ * @param theAcrs The acrs to set.
+ */
+ public void setAcrs(@Nullable final List<ACR> theAcrs) {
+ if (theAcrs != null) {
+ acrs = Collections.unmodifiableList(theAcrs);
+ }
+ }
+
+ /**
+ * Get the response mode.
+ *
+ * @return the responseMode.
+ */
+ @Nullable public ResponseMode getResponseMode() {
+ return responseMode;
+ }
+
+ /**
+ * Set the response mode.
+ *
+ * @param mode The responseMode to set.
+ */
+ public void setResponseMode(@Nullable final ResponseMode mode) {
+ responseMode = mode;
+ }
+
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
new file mode 100644
index 0000000..816c008
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.core;
+
+import java.net.URI;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * OpenID Connect Authentication Request. Extends the OAuth 2.0 authorization request.
+ * <p> This class is mutable and not thread-safe.</p>
+ */
+public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
+
+ /** The default OpenID scope. */
+ @Nonnull @NotEmpty private static final String DEFAULT_OPENID_SCOPE = "openid";
+
+ /** The request object. Optional. */
+ @Nullable private JWT requestObject;
+
+ /** The request URI. Optional. */
+ @Nullable private URI requestURI;
+
+ /**
+ *
+ * Constructor.
+ *
+ * @param id the clientID.
+ */
+ public OIDCAuthenticationRequest(@Nonnull final ClientID id) {
+ super(id);
+ // Must contain the openid scope.
+ getScope().add(DEFAULT_OPENID_SCOPE);
+ }
+
+
+ /**
+ * Get the request object.
+ *
+ * @return Returns the request object.
+ */
+ @Nullable public JWT getRequestObject() {
+ return requestObject;
+ }
+
+ /**
+ * Set the request object.
+ *
+ * @param object The request object to set.
+ */
+ public void setRequestObject(@Nullable final JWT object) {
+ requestObject = object;
+ }
+
+ /**
+ * Get the URI to fetch the request object from.
+ *
+ * @return Returns the requestURI.
+ */
+ @Nullable public URI getRequestURI() {
+ return requestURI;
+ }
+
+ /**
+ * Set the URI to fetch the request object from.
+ *
+ * @param uri The requestURI to set.
+ */
+ public void setRequestURI(@Nullable final URI uri) {
+ requestURI = uri;
+ }
+
+ //TODO others relating to sections 5.2, 5.5, 6, and 7.2.1
+
+
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/package-info.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/package-info.java
new file mode 100644
index 0000000..87dab3b
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Core profile classes.
+ */
+package net.shibboleth.oidc.profile.core;
\ No newline at end of file
diff --git a/oidc-common-profile-impl/pom.xml b/oidc-common-profile-impl/pom.xml
index ba89f60..0c34d9e 100644
--- a/oidc-common-profile-impl/pom.xml
+++ b/oidc-common-profile-impl/pom.xml
@@ -18,11 +18,48 @@
</properties>
<dependencies>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-profile-api</artifactId>
+ </dependency>
<dependency>
<groupId>net.shibboleth.idp</groupId>
<artifactId>idp-core</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp</groupId>
+ <artifactId>idp-profile-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp</groupId>
+ <artifactId>idp-authn-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>javax.servlet</groupId>
+ <artifactId>javax.servlet-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>com.nimbusds</groupId>
+ <artifactId>oauth2-oidc-sdk</artifactId>
+ <scope>provided</scope>
+ </dependency>
+
+ <!-- Test Dependencies -->
+ <dependency>
+ <groupId>${spring.groupId}</groupId>
+ <artifactId>spring-test</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp</groupId>
+ <artifactId>idp-profile-api</artifactId>
+ <scope>test</scope>
+ <type>test-jar</type>
+ </dependency>
</dependencies>
diff --git a/oidc-common-profile-impl/src/test/resources/logback-test.xml b/oidc-common-profile-impl/src/test/resources/logback-test.xml
new file mode 100644
index 0000000..5b165b1
--- /dev/null
+++ b/oidc-common-profile-impl/src/test/resources/logback-test.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<configuration>
+
+
+ <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+ <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+ <pattern>%level [%logger:%line] - %msg%n</pattern>
+ <charset>UTF-8</charset>
+ </encoder>
+ </appender>
+
+ <logger name="net.shibboleth" level="DEBUG" additivity="false">
+ <appender-ref ref="STDOUT" />
+ </logger>
+
+ <logger name="net.shibboleth.oidc" level="TRACE" additivity="false">
+ <appender-ref ref="STDOUT" />
+ </logger>
+
+
+ <logger name="org.springframework.webflow" level="TRACE" additivity="false">
+ <appender-ref ref="STDOUT" />
+ </logger>
+
+
+ <root>
+ <level value="INFO" />
+ <appender-ref ref="STDOUT" />
+ </root>
+
+</configuration>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index d52a00c..32471fb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -125,6 +125,16 @@
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-metadata-impl</artifactId>
<version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-profile-api</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-profile-impl</artifactId>
+ <version>${project.version}</version>
</dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
@@ -205,7 +215,7 @@
<module>oidc-common-metadata-api</module>
<module>oidc-common-metadata-impl</module>
<module>oidc-common-profile-api</module>
- <!-- Remove until the module has classes <module>oidc-common-profile-impl</module> -->
+ <module>oidc-common-profile-impl</module>
<module>oidc-common-saml-api</module>
<module>oidc-common-saml-impl</module>
<module>oidc-common-plugin</module>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list