[java-idp-oidc] branch main updated: Deprecation cleanup.
Scott Cantor
cantor.2 at osu.edu
Mon Jan 10 21:47:29 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=98b41ae8bb8ecf3b51b390c834f8e3ac85b792fd
The following commit(s) were added to refs/heads/main by this push:
new 98b41ae8 Deprecation cleanup.
98b41ae8 is described below
commit 98b41ae8bb8ecf3b51b390c834f8e3ac85b792fd
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 10 16:47:26 2022 -0500
Deprecation cleanup.
---
.../context/OIDCAuthenticationResponseContext.java | 17 ++-
.../op/token/support/AccessTokenClaimsSet.java | 64 ++++++----
.../op/token/support/AuthorizeCodeClaimsSet.java | 5 +-
.../op/token/support/RefreshTokenClaimsSet.java | 52 +++++---
.../op/token/support/RegistrationClaimsSet.java | 2 +-
.../oidc/op/token/support/TokenClaimsSet.java | 135 ++++++++++++---------
.../impl/SetAccessTokenToResponseContext.java | 6 +-
.../impl/SetRefreshTokenToResponseContext.java | 5 +-
.../oidc/op/profile/impl/ValidateAccessToken.java | 4 +-
.../plugin/oidc/op/profile/impl/package-info.java | 21 ----
10 files changed, 180 insertions(+), 131 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContext.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContext.java
index 4657d71b..0e01d22a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContext.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/OIDCAuthenticationResponseContext.java
@@ -258,9 +258,24 @@ public class OIDCAuthenticationResponseContext extends BaseContext {
* @param lifeTime lifetime of the access token
*/
public void setAccessToken(@Nullable final String token, @Nonnull final Duration lifeTime) {
- accessToken = token == null ? null : new BearerAccessToken(token, lifeTime.getSeconds(), null);
+ setAccessToken(token, lifeTime, null);
}
+
+ /**
+ * Set access token.
+ *
+ * @param token string to form access token
+ * @param lifeTime lifetime of the access token
+ * @param scope scope of the access token
+ *
+ * @since 3.1.0
+ */
+ public void setAccessToken(@Nullable final String token, @Nonnull final Duration lifeTime,
+ @Nonnull final Scope scope) {
+ accessToken = token == null ? null : new BearerAccessToken(token, lifeTime.getSeconds(), scope);
+ }
+
/**
* Get refresh token.
*
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
index 68be3b0d..aa0b098a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
@@ -20,14 +20,13 @@ package net.shibboleth.idp.plugin.oidc.op.token.support;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.openid.connect.sdk.claims.ACR;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.security.DataSealer;
import net.shibboleth.utilities.java.support.security.DataSealerException;
import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
@@ -40,11 +39,7 @@ import java.time.Instant;
public final class AccessTokenClaimsSet extends TokenClaimsSet {
/** Value of access token claims set type. */
- private static final String VALUE_TYPE_AT = "at";
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(AccessTokenClaimsSet.class);
+ @Nonnull @NotEmpty protected static final String VALUE_TYPE_AT = "at";
/**
* Constructor for access token claims set when derived from existing claims set.
@@ -55,29 +50,26 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
* @param dlClaimsUI Claims set for token delivery, user info only.
* @param iat Issue time of the token
* @param exp Expiration time of the token
+ *
+ * @deprecated
*/
- // Checkstyle: ParameterNumber OFF
+// Checkstyle: ParameterNumber OFF
+ @Deprecated(since="3.1.0", forRemoval=true)
public AccessTokenClaimsSet(@Nonnull final TokenClaimsSet tokenClaimsSet, @Nonnull final Scope scope,
@Nullable final ClaimsSet dlClaims, @Nullable final ClaimsSet dlClaimsUI, @Nonnull final Instant iat,
@Nonnull final Instant exp) {
- final Builder builder = new Builder(tokenClaimsSet);
- builder.setScope(scope);
- builder.setDlClaims(dlClaims);
- builder.setDlClaimsUI(dlClaimsUI);
- builder.setIssuedAt(iat);
- builder.setExpiresAt(exp);
-
+ final Builder builder = new Builder(tokenClaimsSet, scope, dlClaims, dlClaimsUI, iat, exp);
setClaimsSet(builder.buildJWTClaimsSet(VALUE_TYPE_AT));
}
- // Checkstyle: ParameterNumber ON
+// Checkstyle: ParameterNumber ON
/**
* Private constructor for the parser.
*
* @param accessTokenClaimsSet access token claims set
*/
- private AccessTokenClaimsSet(final JWTClaimsSet accessTokenClaimsSet) {
+ protected AccessTokenClaimsSet(@Nonnull final JWTClaimsSet accessTokenClaimsSet) {
super(accessTokenClaimsSet);
}
@@ -88,7 +80,8 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
* @return AccessTokenClaimsSet instance if parsing is successful.
* @throws ParseException if parsing fails for example due to incompatible types.
*/
- public static AccessTokenClaimsSet parse(final String accessTokenClaimsSet) throws ParseException {
+ @Nonnull public static AccessTokenClaimsSet parse(@Nonnull @NotEmpty final String accessTokenClaimsSet)
+ throws ParseException {
final JWTClaimsSet atClaimsSet = JWTClaimsSet.parse(accessTokenClaimsSet);
// Throws exception if parsing result is not expected one.
verifyParsedClaims(VALUE_TYPE_AT, atClaimsSet);
@@ -104,7 +97,7 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
* @throws ParseException is thrown if unwrapped access token is not understood
* @throws DataSealerException is thrown if unwrapping fails
*/
- public static AccessTokenClaimsSet parse(@Nonnull final String wrappedAccessToken,
+ @Nonnull public static AccessTokenClaimsSet parse(@Nonnull @NotEmpty final String wrappedAccessToken,
@Nonnull final DataSealer dataSealer) throws ParseException, DataSealerException {
return parse(dataSealer.unwrap(wrappedAccessToken));
}
@@ -112,6 +105,15 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
/** Builder to create instance of AccessTokenClaimsSet. */
public static final class Builder extends TokenClaimsSet.Builder<AccessTokenClaimsSet> {
+ /**
+ * Default constructor.
+ *
+ * @since 3.1.0
+ */
+ public Builder() {
+
+ }
+
/**
* Constructor for access token builder.
*
@@ -145,16 +147,30 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
setRedirectURI(redirectURI);
setScope(scope);
}
-// Checkstyle: ParameterNumber ON
-
+
/**
- * Default constructor.
+ * Constructor for access token claims set when derived from existing claims set.
+ *
+ * @param existing Authorize Code / Refresh Token this token is based on
+ * @param scope Validated and possibly reduced scope of the authentication request
+ * @param dlClaims Claims set for token delivery.
+ * @param dlClaimsUI Claims set for token delivery, user info only.
+ * @param iat Issue time of the token
+ * @param exp Expiration time of the token
*
* @since 3.1.0
*/
- public Builder() {
-
+ public Builder(@Nonnull final TokenClaimsSet existing, @Nonnull final Scope scope,
+ @Nullable final ClaimsSet dlClaims, @Nullable final ClaimsSet dlClaimsUI, @Nonnull final Instant iat,
+ @Nonnull final Instant exp) {
+ this(existing);
+ setScope(scope);
+ setDlClaims(dlClaims);
+ setDlClaimsUI(dlClaimsUI);
+ setIssuedAt(iat);
+ setExpiresAt(exp);
}
+// Checkstyle: ParameterNumber ON
/**
* Bases a builder on an existing token claims set.
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
index 55310642..daca3855 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
@@ -23,6 +23,7 @@ import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.security.DataSealer;
import net.shibboleth.utilities.java.support.security.DataSealerException;
import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
@@ -34,7 +35,7 @@ import java.time.Instant;
public final class AuthorizeCodeClaimsSet extends TokenClaimsSet {
/** Value of authorize code claims set type. */
- public static final String VALUE_TYPE_AC = "ac";
+ @Nonnull @NotEmpty public static final String VALUE_TYPE_AC = "ac";
/**
* Private constructor for the parser.
@@ -131,4 +132,4 @@ public final class AuthorizeCodeClaimsSet extends TokenClaimsSet {
}
}
-}
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
index 316d537a..ca6577c7 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
@@ -18,11 +18,11 @@
package net.shibboleth.idp.plugin.oidc.op.token.support;
import javax.annotation.Nonnull;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.ACR;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.security.DataSealer;
import net.shibboleth.utilities.java.support.security.DataSealerException;
@@ -33,11 +33,7 @@ import java.time.Instant;
public final class RefreshTokenClaimsSet extends TokenClaimsSet {
/** Value of refresh token claims set type. */
- private static final String VALUE_TYPE_RF = "rf";
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(RefreshTokenClaimsSet.class);
+ @Nonnull @NotEmpty private static final String VALUE_TYPE_RF = "rf";
/**
* Constructor for refresh token claims set when derived from existing claim set.
@@ -45,14 +41,13 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
* @param tokenClaimsSet code or token this token is based on
* @param iat new issue time of the token
* @param exp new expiration time of the token
+ *
+ * @deprecated
*/
+ @Deprecated(since="3.1.0", forRemoval=true)
public RefreshTokenClaimsSet(@Nonnull final TokenClaimsSet tokenClaimsSet, @Nonnull final Instant iat,
@Nonnull final Instant exp) {
-
- final Builder builder = new Builder(tokenClaimsSet);
- builder.setIssuedAt(iat);
- builder.setExpiresAt(exp);
-
+ final Builder builder = new Builder(tokenClaimsSet, iat, exp);
setClaimsSet(builder.buildJWTClaimsSet(VALUE_TYPE_RF));
}
@@ -72,7 +67,8 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
* @return AccessTokenClaimsSet instance if parsing is successful.
* @throws ParseException if parsing fails for example due to incompatible types.
*/
- public static RefreshTokenClaimsSet parse(final String refreshTokenClaimsSet) throws ParseException {
+ @Nonnull public static RefreshTokenClaimsSet parse(@Nonnull @NotEmpty final String refreshTokenClaimsSet)
+ throws ParseException {
final JWTClaimsSet atClaimsSet = JWTClaimsSet.parse(refreshTokenClaimsSet);
// Throws exception if parsing result is not expected one.
verifyParsedClaims(VALUE_TYPE_RF, atClaimsSet);
@@ -88,7 +84,7 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
* @throws ParseException is thrown if unwrapped refresh token is not understood
* @throws DataSealerException is thrown if unwrapping fails
*/
- public static RefreshTokenClaimsSet parse(@Nonnull final String wrappedAccessToken,
+ @Nonnull public static RefreshTokenClaimsSet parse(@Nonnull @NotEmpty final String wrappedAccessToken,
@Nonnull final DataSealer dataSealer)
throws ParseException, DataSealerException {
return parse(dataSealer.unwrap(wrappedAccessToken));
@@ -101,6 +97,32 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
*/
public static final class Builder extends TokenClaimsSet.Builder<RefreshTokenClaimsSet> {
+ /**
+ * Default constructor.
+ *
+ * @since 3.1.0
+ */
+ public Builder() {
+
+ }
+
+// Checkstyle: ParameterNumber OFF
+ /**
+ * Constructor for refresh token claims set when derived from existing claims set.
+ *
+ * @param existing Authorize Code / Refresh Token this token is based on
+ * @param iat Issue time of the token
+ * @param exp Expiration time of the token
+ *
+ * @since 3.1.0
+ */
+ public Builder(@Nonnull final TokenClaimsSet existing, @Nonnull final Instant iat, @Nonnull final Instant exp) {
+ this(existing);
+ setIssuedAt(iat);
+ setExpiresAt(exp);
+ }
+// Checkstyle: ParameterNumber ON
+
/**
* Bases a builder on an existing token claims set.
*
@@ -130,7 +152,7 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
*
* @return RefreshTokenClaimsSet instance
*/
- public RefreshTokenClaimsSet build() {
+ @Nonnull public RefreshTokenClaimsSet build() {
return new RefreshTokenClaimsSet(buildJWTClaimsSet(VALUE_TYPE_RF));
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RegistrationClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RegistrationClaimsSet.java
index 54bbb5b4..30fef29e 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RegistrationClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RegistrationClaimsSet.java
@@ -32,7 +32,7 @@ import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
/**
* Class wrapping claims for the initial registration access token.
*/
-public class RegistrationClaimsSet {
+public final class RegistrationClaimsSet {
/** Value of initial registration access token claims set type. */
private static final String VALUE_TYPE_RT = "rt";
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
index 2c9733cf..cbbf4196 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
@@ -61,73 +61,73 @@ import java.time.Instant;
public class TokenClaimsSet {
/** Identifier for the token. */
- public static final String KEY_AC_ID = "jti";
+ @Nonnull @NotEmpty public static final String KEY_AC_ID = "jti";
/** Type of the token. */
- public static final String KEY_TYPE = "type";
+ @Nonnull @NotEmpty public static final String KEY_TYPE = "type";
/** OP issuer. */
- public static final String KEY_ISSUER = "iss";
+ @Nonnull @NotEmpty public static final String KEY_ISSUER = "iss";
/** User principal representing authenticated user. */
- public static final String KEY_USER_PRINCIPAL = "prncpl";
+ @Nonnull @NotEmpty public static final String KEY_USER_PRINCIPAL = "prncpl";
/** Subject of the user. */
- public static final String KEY_SUBJECT = "sub";
+ @Nonnull @NotEmpty public static final String KEY_SUBJECT = "sub";
/** Client id of the rp the token is generated for. */
- public static final String KEY_CLIENTID = "clid";
+ @Nonnull @NotEmpty public static final String KEY_CLIENTID = "clid";
/** Expiration time of the token. */
- public static final String KEY_EXPIRATION_TIME = "exp";
+ @Nonnull @NotEmpty public static final String KEY_EXPIRATION_TIME = "exp";
/** Not before time of the token. */
- public static final String KEY_NOTBEFORE_TIME = "nbt";
+ @Nonnull @NotEmpty public static final String KEY_NOTBEFORE_TIME = "nbt";
/** Issue time of the token. */
- public static final String KEY_ISSUED_AT = "iat";
+ @Nonnull @NotEmpty public static final String KEY_ISSUED_AT = "iat";
/** Authentication context class reference value of the performed authentication. */
- public static final String KEY_ACR = "acr";
+ @Nonnull @NotEmpty public static final String KEY_ACR = "acr";
/** Nonce of the original authentication request. */
- public static final String KEY_NONCE = "nonce";
+ @Nonnull @NotEmpty public static final String KEY_NONCE = "nonce";
/** Authentication time of the performed authentication. */
- public static final String KEY_AUTH_TIME = "auth_time";
+ @Nonnull @NotEmpty public static final String KEY_AUTH_TIME = "auth_time";
/** Redirect uri of the original authentication request. */
- public static final String KEY_REDIRECT_URI = "redirect_uri";
+ @Nonnull @NotEmpty public static final String KEY_REDIRECT_URI = "redirect_uri";
/** Scope of the token request. */
- public static final String KEY_SCOPE = "scope";
+ @Nonnull @NotEmpty public static final String KEY_SCOPE = "scope";
/** Audiences of the token request. */
- public static final String KEY_AUDIENCE = "aud";
+ @Nonnull @NotEmpty public static final String KEY_AUDIENCE = "aud";
/** Claims request of the original authentication request. */
- public static final String KEY_CLAIMS = "claims";
+ @Nonnull @NotEmpty public static final String KEY_CLAIMS = "claims";
/** Claims set for token delivery. */
- public static final String KEY_DELIVERY_CLAIMS = "dl_claims";
+ @Nonnull @NotEmpty public static final String KEY_DELIVERY_CLAIMS = "dl_claims";
/** Claims set for token delivery, id token only. */
- public static final String KEY_DELIVERY_CLAIMS_IDTOKEN = "dl_claims_id";
+ @Nonnull @NotEmpty public static final String KEY_DELIVERY_CLAIMS_IDTOKEN = "dl_claims_id";
/** Claims set for token delivery, user info only. */
- public static final String KEY_DELIVERY_CLAIMS_USERINFO = "dl_claims_ui";
+ @Nonnull @NotEmpty public static final String KEY_DELIVERY_CLAIMS_USERINFO = "dl_claims_ui";
/** Claims/Attributes having consent. */
- public static final String KEY_CONSENTED_CLAIMS = "cnsntd_claims";
+ @Nonnull @NotEmpty public static final String KEY_CONSENTED_CLAIMS = "cnsntd_claims";
/** Whether consent has been enabled. */
- public static final String KEY_CONSENT_ENABLED = "cnsnt";
+ @Nonnull @NotEmpty public static final String KEY_CONSENT_ENABLED = "cnsnt";
/** Code Challenge. */
- public static final String KEY_CODE_CHALLENGE = "cc";
+ @Nonnull @NotEmpty public static final String KEY_CODE_CHALLENGE = "cc";
/** Claims set for the claim. */
- private JWTClaimsSet tokenClaimsSet;
+ @Nullable private JWTClaimsSet tokenClaimsSet;
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(TokenClaimsSet.class);
@@ -159,14 +159,17 @@ public class TokenClaimsSet {
* @throws ParseException if claims set is not expected one.
*/
// Checkstyle: CyclomaticComplexity OFF
- protected static void verifyParsedClaims(@Nonnull final String tokenType,
+ protected static void verifyParsedClaims(@Nonnull @NotEmpty final String tokenType,
@Nonnull final JWTClaimsSet tokenClaimsSet) throws ParseException {
+ if (tokenClaimsSet == null) {
+ throw new ParseException("JWT claims set is unset", 0);
+ }
+
// Check existence and type of mandatory fields and values
if (!tokenType.equals(tokenClaimsSet.getClaims().get(KEY_TYPE))) {
throw new ParseException("claim type value not matching", 0);
}
- // Mandatory fields
if (tokenClaimsSet.getStringClaim(KEY_ISSUER) == null) {
throw new ParseException("claim iss must exist and not be null", 0);
}
@@ -234,7 +237,8 @@ public class TokenClaimsSet {
*
* @return token as JSON String
*/
- public String serialize() {
+ @Nonnull @NotEmpty public String serialize() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
return JSONObjectUtils.toJSONObject(tokenClaimsSet).toJSONString();
}
@@ -245,7 +249,7 @@ public class TokenClaimsSet {
* @return token as JSON String wrapped with sealer
* @throws DataSealerException is thrown if unwrapping fails
*/
- public String serialize(@Nonnull final DataSealer dataSealer) throws DataSealerException {
+ @Nonnull public String serialize(@Nonnull final DataSealer dataSealer) throws DataSealerException {
return dataSealer.wrap(serialize(), Instant.ofEpochMilli(tokenClaimsSet.getExpirationTime().getTime()));
}
@@ -254,8 +258,8 @@ public class TokenClaimsSet {
*
* @param claimsSet What to set
*/
- public void setClaimsSet(final @Nonnull JWTClaimsSet claimsSet) {
- tokenClaimsSet = claimsSet;
+ public void setClaimsSet(@Nonnull final JWTClaimsSet claimsSet) {
+ tokenClaimsSet = Constraint.isNotNull(claimsSet, "JWTClaimsSet cannot be null");
}
/**
@@ -263,8 +267,7 @@ public class TokenClaimsSet {
*
* @return token claims set
*/
- @Nonnull
- public JWTClaimsSet getClaimsSet() {
+ @Nullable public JWTClaimsSet getClaimsSet() {
return tokenClaimsSet;
}
@@ -279,6 +282,7 @@ public class TokenClaimsSet {
*/
@Deprecated(since="3.1.0", forRemoval=true)
public boolean isExpired() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
return tokenClaimsSet.getExpirationTime().before(new Date());
}
@@ -287,8 +291,8 @@ public class TokenClaimsSet {
*
* @return expiration time of the token
*/
- @Nonnull
- public Instant getExp() {
+ @Nonnull public Instant getExp() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
return tokenClaimsSet.getExpirationTime().toInstant();
}
@@ -317,6 +321,7 @@ public class TokenClaimsSet {
* @since 3.1.0
*/
@Nullable public Instant getNotBefore() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
final Date d = tokenClaimsSet.getNotBeforeTime();
return d != null ? d.toInstant() : null;
}
@@ -326,8 +331,8 @@ public class TokenClaimsSet {
*
* @return redirect uri of the request, null if not located.
*/
- @Nonnull
- public URI getRedirectURI() {
+ @Nullable public URI getRedirectURI() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
try {
return URI.create(tokenClaimsSet.getStringClaim(KEY_REDIRECT_URI));
} catch (final ParseException|IllegalArgumentException e) {
@@ -342,8 +347,8 @@ public class TokenClaimsSet {
*
* @return acr of the performed authentication.
*/
- @Nonnull
- public String getACR() {
+ @Nullable public String getACR() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
return (String) tokenClaimsSet.getClaim(KEY_ACR);
}
@@ -352,8 +357,8 @@ public class TokenClaimsSet {
*
* @return Type of the claims set.
*/
- @Nonnull
- public String getType() {
+ @Nullable public String getType() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
return (String) tokenClaimsSet.getClaim(KEY_TYPE);
}
@@ -362,8 +367,8 @@ public class TokenClaimsSet {
*
* @return principal of the user.
*/
- @Nonnull
- public String getPrincipal() {
+ @Nullable public String getPrincipal() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
return (String) tokenClaimsSet.getClaim(KEY_USER_PRINCIPAL);
}
@@ -372,8 +377,8 @@ public class TokenClaimsSet {
*
* @return auth time of the user.
*/
- @Nonnull
- public Instant getAuthenticationTime() {
+ @Nullable public Instant getAuthenticationTime() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
try {
return tokenClaimsSet.getDateClaim(KEY_AUTH_TIME).toInstant();
} catch (final ParseException e) {
@@ -388,8 +393,8 @@ public class TokenClaimsSet {
*
* @return nonce of the authentication request.
*/
- @Nonnull
- public Nonce getNonce() {
+ @Nullable public Nonce getNonce() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
if (tokenClaimsSet.getClaim(KEY_NONCE) == null) {
return null;
}
@@ -401,8 +406,8 @@ public class TokenClaimsSet {
*
* @return claims request in authentication request, null if not existing.
*/
- @Nullable
- public OIDCClaimsRequest getClaimsRequest() {
+ @Nullable public OIDCClaimsRequest getClaimsRequest() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
if (tokenClaimsSet.getClaim(KEY_CLAIMS) == null) {
return null;
}
@@ -419,7 +424,8 @@ public class TokenClaimsSet {
*
* @return token delivery claims
*/
- public ClaimsSet getDeliveryClaims() {
+ @Nullable public ClaimsSet getDeliveryClaims() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
final TokenDeliveryClaimsClaimsSet claimsSet = new TokenDeliveryClaimsClaimsSet();
try {
final Map<String, Object> claims = tokenClaimsSet.getJSONObjectClaim(KEY_DELIVERY_CLAIMS);
@@ -439,7 +445,8 @@ public class TokenClaimsSet {
*
* @return id token token delivery claims
*/
- public ClaimsSet getIDTokenDeliveryClaims() {
+ @Nullable public ClaimsSet getIDTokenDeliveryClaims() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
final TokenDeliveryClaimsClaimsSet claimsSet = new TokenDeliveryClaimsClaimsSet();
try {
final Map<String, Object> claims = tokenClaimsSet.getJSONObjectClaim(KEY_DELIVERY_CLAIMS_IDTOKEN);
@@ -460,7 +467,8 @@ public class TokenClaimsSet {
*
* @return user info response token delivery claims
*/
- public ClaimsSet getUserinfoDeliveryClaims() {
+ @Nullable public ClaimsSet getUserinfoDeliveryClaims() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
final TokenDeliveryClaimsClaimsSet claimsSet = new TokenDeliveryClaimsClaimsSet();
try {
final Map<String, Object> claims = tokenClaimsSet.getJSONObjectClaim(KEY_DELIVERY_CLAIMS_USERINFO);
@@ -481,7 +489,8 @@ public class TokenClaimsSet {
*
* @return consented claims
*/
- public List<Object> getConsentedClaims() {
+ @Nullable @NonnullElements public List<Object> getConsentedClaims() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
return (List<Object>) tokenClaimsSet.getClaim(KEY_CONSENTED_CLAIMS);
}
@@ -491,6 +500,7 @@ public class TokenClaimsSet {
* @return whether consent has been enabled
*/
public boolean isConsentEnabled() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
if (tokenClaimsSet.getClaim(KEY_CONSENT_ENABLED) != null) {
try {
return tokenClaimsSet.getBooleanClaim(KEY_CONSENT_ENABLED).booleanValue();
@@ -511,8 +521,8 @@ public class TokenClaimsSet {
*
* @return scope of the token request.
*/
- @Nonnull
- public Scope getScope() {
+ @Nullable public Scope getScope() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
try {
return Scope.parse(tokenClaimsSet.getStringClaim(KEY_SCOPE));
} catch (final ParseException e) {
@@ -531,6 +541,7 @@ public class TokenClaimsSet {
*/
@Nonnull @NonnullElements @NotLive @Unmodifiable
public List<String> getAudience() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
return tokenClaimsSet.getAudience();
}
@@ -539,8 +550,8 @@ public class TokenClaimsSet {
*
* @return code challenge of the authentication request.
*/
- @Nonnull
- public String getCodeChallenge() {
+ @Nullable public String getCodeChallenge() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
if (tokenClaimsSet.getClaim(KEY_CODE_CHALLENGE) == null) {
return null;
}
@@ -552,8 +563,8 @@ public class TokenClaimsSet {
*
* @return id of the token
*/
- @Nonnull
- public String getID() {
+ @Nullable public String getID() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
return tokenClaimsSet.getJWTID();
}
@@ -562,9 +573,13 @@ public class TokenClaimsSet {
*
* @return Client ID of the token
*/
- @Nonnull
- public ClientID getClientID() {
- return new ClientID((String) tokenClaimsSet.getClaim(KEY_CLIENTID));
+ @Nullable public ClientID getClientID() {
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final Object id = tokenClaimsSet.getClaim(KEY_CLIENTID);
+ if (id instanceof String) {
+ return new ClientID((String) id);
+ }
+ return null;
}
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
index 87f03fb3..672365ad 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAccessTokenToResponseContext.java
@@ -219,7 +219,7 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
return false;
}
- tokenClaimsSet = getOidcResponseContext().getTokenClaimsSet();
+ tokenClaimsSet = getOidcResponseContext().getAuthorizationGrantClaimsSet();
if (tokenClaimsSet != null && !(tokenClaimsSet instanceof RefreshTokenClaimsSet)
&& !(tokenClaimsSet instanceof AuthorizeCodeClaimsSet)) {
log.error("{} No token grant if of illegal type", getLogPrefix());
@@ -271,9 +271,9 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
final AccessTokenClaimsSet claimsSet;
if (tokenClaimsSet != null) {
// We may not use original claims as input for scope / delivery claims as they may have been reduced.
- claimsSet = new AccessTokenClaimsSet(tokenClaimsSet,
+ claimsSet = new AccessTokenClaimsSet.Builder(tokenClaimsSet,
getOidcResponseContext().getScope() != null ? getOidcResponseContext().getScope() : new Scope(),
- claims, claimsUI, Instant.now(), dateExp);
+ claims, claimsUI, Instant.now(), dateExp).build();
} else {
final OIDCAuthenticationResponseConsentContext consentCtx =
consentContextLookupStrategy.apply(profileRequestContext);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java
index 52361944..81afb7d4 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java
@@ -111,7 +111,7 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
return false;
}
- tokenClaimsSet = getOidcResponseContext().getTokenClaimsSet();
+ tokenClaimsSet = getOidcResponseContext().getAuthorizationGrantClaimsSet();
if (tokenClaimsSet == null || !(tokenClaimsSet instanceof RefreshTokenClaimsSet)
&& !(tokenClaimsSet instanceof AuthorizeCodeClaimsSet)) {
log.error("{} No token to base refresh on", getLogPrefix());
@@ -126,7 +126,8 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final Instant dateExp = Instant.now().plus(refreshTokenLifetime);
- final RefreshTokenClaimsSet claimsSet = new RefreshTokenClaimsSet(tokenClaimsSet, Instant.now(), dateExp);
+ final RefreshTokenClaimsSet claimsSet =
+ new RefreshTokenClaimsSet.Builder(tokenClaimsSet, Instant.now(), dateExp).build();
try {
getOidcResponseContext().setRefreshToken(claimsSet.serialize(dataSealer));
log.debug("{} Setting refresh token {} as {} to response context ", getLogPrefix(), claimsSet.serialize(),
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessToken.java
index 1efff679..d9157438 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateAccessToken.java
@@ -96,8 +96,8 @@ public class ValidateAccessToken extends AbstractOIDCUserInfoValidationResponseA
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
- if (accessTokenClaimsSet.isExpired()) {
- log.error("{} access token exp is in the past {}", getLogPrefix(), accessTokenClaimsSet.getExp());
+ if (!accessTokenClaimsSet.isTimeValid()) {
+ log.error("{} access token is expired or future dated {}", getLogPrefix(), accessTokenClaimsSet.getExp());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/package-info.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/package-info.java
deleted file mode 100644
index 32f6334a..00000000
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/package-info.java
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Unit tests for profile action implementations related to OIDC.
- */
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list