[java-oidc-common] branch main updated: Add base class and config for claims validation of issued tokens.
Scott Cantor
cantor.2 at osu.edu
Mon Jan 24 15:24:06 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=ce74d437ff6c8a6b8b89fe12866efbeda5803b17
The following commit(s) were added to refs/heads/main by this push:
new ce74d43 Add base class and config for claims validation of issued tokens.
ce74d43 is described below
commit ce74d437ff6c8a6b8b89fe12866efbeda5803b17
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 24 10:23:33 2022 -0500
Add base class and config for claims validation of issued tokens.
---
...AbstractOAuth2TokenValidatingConfiguration.java | 85 ++++++++++++++++++++++
.../OAuth2TokenIntrospectionConfiguration.java | 9 ++-
.../config/OAuth2TokenRevocationConfiguration.java | 9 +--
3 files changed, 94 insertions(+), 9 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2TokenValidatingConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2TokenValidatingConfiguration.java
new file mode 100644
index 0000000..229d7fd
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2TokenValidatingConfiguration.java
@@ -0,0 +1,85 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+
+/**
+ * Base class for profile configurations that validate previously issued OAuth2 tokens.
+ *
+ * @since 3.1.0
+ */
+public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2ClientAuthenticableProfileConfiguration {
+
+ /** Validation of JWT claims for issued tokens. */
+ @Nonnull private Function<ProfileRequestContext,ClaimsValidator> issuedClaimsValidatorLookupStrategy;
+
+ /**
+ * Creates a new configuration instance.
+ *
+ * @param profileId Unique profile identifier.
+ */
+ public AbstractOAuth2TokenValidatingConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+
+ issuedClaimsValidatorLookupStrategy = FunctionSupport.constant(null);
+ }
+
+ /**
+ * Get the {@link ClaimsValidator} to apply to issued JWT-based tokens being validated by this profile.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the validator to use
+ */
+ @Nullable public ClaimsValidator getIssuedClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuedClaimsValidatorLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the {@link ClaimsValidator} to apply to issued JWT-based tokens being validated by this profile.
+ *
+ * @param validator validator to use
+ */
+ public void setIssuedClaimsValidator(@Nullable final ClaimsValidator validator) {
+ issuedClaimsValidatorLookupStrategy = FunctionSupport.constant(validator);
+ }
+
+
+ /**
+ * Set a lookup strategy for the {@link ClaimsValidator} to apply to issued JWT-based tokens being validated by
+ * this profile.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuedClaimsValidatorLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,ClaimsValidator> strategy) {
+ issuedClaimsValidatorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
index e8211cb..8824315 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
@@ -17,6 +17,7 @@
package net.shibboleth.oidc.profile.oauth2.config;
+
import javax.annotation.Nonnull;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -24,14 +25,14 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
* Profile configuration for the OAuth2 Token Introspection.
*/
-public class OAuth2TokenIntrospectionConfiguration extends AbstractOAuth2ClientAuthenticableProfileConfiguration {
+public class OAuth2TokenIntrospectionConfiguration extends AbstractOAuth2TokenValidatingConfiguration {
/** OAuth2 Token Revocation URI. */
- public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
+ @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
/** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
-
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
+
/**
* Constructor.
*/
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
index bbba892..507e054 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
@@ -22,16 +22,15 @@ import javax.annotation.Nonnull;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
- * Profile configuration for the OAuth2 Token Revocation. The profile is required to define client authentication
- * methods.
+ * Profile configuration for the OAuth2 Token Revocation.
*/
-public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2ClientAuthenticableProfileConfiguration {
+public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValidatingConfiguration {
/** OAuth2 Token Revocation URI. */
- public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7009";
+ @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7009";
/** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/revocation";
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/revocation";
/**
* Constructor.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list