[java-oidc-common] branch main updated: Add a revocation claims validator.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=20b04a43ecde5cfce2e5b6ade0e03c45d9801881

The following commit(s) were added to refs/heads/main by this push:
     new 20b04a4  Add a revocation claims validator.
20b04a4 is described below

commit 20b04a43ecde5cfce2e5b6ade0e03c45d9801881
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jan 26 14:44:25 2022 -0500

    Add a revocation claims validator.
---
 .../impl/JWTIdentifierRevocationValidator.java     | 98 ++++++++++++++++++++++
 1 file changed, 98 insertions(+)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierRevocationValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierRevocationValidator.java
new file mode 100644
index 0000000..7414b74
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierRevocationValidator.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.jwt.claims.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.storage.RevocationCache;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+
+import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
+import net.shibboleth.oidc.jwt.claims.JWTValidationException;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+
+/**
+ * Verifies the identifier (jit) from the JWT against revocation via configurable {@link RevocationCache}.
+ * 
+ * <p>Single identifier is stored in the cache for the lifetime of the JWT (expiration instant is
+ * taken from the 'exp' -claim).</p>
+ */
+public class JWTIdentifierRevocationValidator extends AbstractClaimsValidator {
+
+    /** Message replay cache instance to use. */
+    @NonnullAfterInit private RevocationCache revocationCache;
+    
+    /** Context in revocation cache. */
+    @NonnullAfterInit @NotEmpty private String context;
+    
+    /**
+     * Set the revocation cache instance to use.
+     * 
+     * @param cache revocation cache to set
+     */
+    public void setRevocationCache(@Nonnull final RevocationCache cache) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        revocationCache = Constraint.isNotNull(cache, "RevocationCache cannot be null");
+    }
+    
+    /**
+     * Set the revocation cache context that partitions entries.
+     * 
+     * @param s context value
+     */
+    public void setContext(@Nonnull @NotEmpty final String s) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        context = Constraint.isNotNull(StringSupport.trimOrNull(s), "Context cannot be null or empty");
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    protected void doInitialize() throws ComponentInitializationException {
+        super.doInitialize();
+        
+        if (revocationCache == null) {
+            throw new ComponentInitializationException("RevocationCache cannot be null");
+        } else if (context == null) {
+            throw new ComponentInitializationException("Context cannot be null");
+        }
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    protected void doValidate(@Nonnull final JWTClaimsSet claims,
+            @Nullable final ProfileRequestContext profileRequestContext) throws JWTValidationException {
+
+        final String jti = claims.getJWTID();
+        if (StringSupport.trimOrNull(jti) == null) {
+            throw new JWTValidationException("Claims set is missing required JWT identifier claim");
+        }
+        
+        if (revocationCache.isRevoked(context, jti)) {
+            throw new JWTValidationException("JWT ID '" + jti + "' has been revoked");
+        }
+    }
+
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.