[java-oidc-common] branch dev/JCOMOIDC-41 updated: Improve RequestObject signing config

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=aef32a539ba341fcd90a2ff16a181c06ec5915b3

The following commit(s) were added to refs/heads/dev/JCOMOIDC-41 by this push:
     new aef32a5  Improve RequestObject signing config
aef32a5 is described below

commit aef32a539ba341fcd90a2ff16a181c06ec5915b3
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jul 6 10:52:00 2022 +0100

    Improve RequestObject signing config
---
 .../config/OIDCAuthorizationConfiguration.java     | 24 +++++++++++++++++
 .../profile/core/OIDCAuthenticationRequest.java    | 30 ++++++++++++++++++++++
 .../encoder/impl/HTTPPostAuthnRequestEncoder.java  |  5 +++-
 3 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 4afe8f4..e98b98e 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -68,6 +68,9 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
     
     /** Whether to encode authentication request parameters inside a JWT request object .*/
     @Nonnull private Predicate<ProfileRequestContext> useRequestObjectPredicate;
+    
+    /** Predicate used to determine if the generated request object should be signed. Default returns true. */
+    @Nonnull private Predicate<ProfileRequestContext> signRequestObjectPredicate;
 
     /** Lookup function to supply attribute IDs to omit from UserInfo token. */
     @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
@@ -137,6 +140,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
         acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
         encodeConsentInTokensPredicate = Predicates.alwaysFalse();
         useRequestObjectPredicate = Predicates.alwaysFalse();
+        signRequestObjectPredicate = Predicates.alwaysTrue();
         retrieveUserInfoEndpointClaims = Predicates.alwaysTrue();
 
         authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
@@ -152,6 +156,26 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
         httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
     }
     
+    /**
+     * Should the RequestObject (if configured) be signed?
+     * 
+     * @param profileRequestContext the profile request context
+     * 
+     * @return true iff the RequestObject should be signed, false otherwise.
+     */
+    public boolean isSignRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
+        return signRequestObjectPredicate.test(profileRequestContext);
+    }
+
+    /**
+     * Set whether the RequestObject should be signed.
+     * 
+     * @param flag flag to set
+     */
+    public void setSignRequestObject(final boolean flag) {
+        signRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+    }
+    
     
     /**
      * Set the strategy to locate a client_id.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
index 816c008..21e7f59 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
 
 import com.nimbusds.jwt.JWT;
 import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
 
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 
@@ -39,6 +40,12 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
     /** The request object. Optional. */
     @Nullable private JWT requestObject;
     
+    /** 
+     * The claims used to build a request object JWT. Is temporary in nature, once the requestObject is
+     * built these should be blanked or not used.
+     */
+    @Nullable private ClaimsSet requestObjectClaimsSet;
+    
     /** The request URI. Optional. */
     @Nullable private URI requestURI;
     
@@ -53,6 +60,29 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
         // Must contain the openid scope. 
         getScope().add(DEFAULT_OPENID_SCOPE);
     }
+    
+    /**
+     * Set the request object claims set.
+     * 
+     * @param claims the claims
+     */
+    public void setRequestObjectClaimsSet(@Nullable final ClaimsSet claims) {
+        requestObjectClaimsSet = claims;
+    }
+    
+    /**
+     * Get the request object claims set. If the requestObject JWT has already
+     * been built, {@literal null} is returned to indicate these claims are 
+     * no longer 'live' and will not be reused. 
+     * 
+     * @return the request object claims
+     */
+    @Nullable public ClaimsSet getRequestObjectClaimsSet() {
+        if (requestObject == null) {
+            return requestObjectClaimsSet;
+        }
+        return null;
+    }
 
 
     /**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java
index 409d53f..e639e05 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java
@@ -99,8 +99,11 @@ public class HTTPPostAuthnRequestEncoder extends AbstractOIDCMessageEncoder {
      * 
      * @param request the authentication request.
      * @return response message as velocity context.
+     * 
+     * @throws MessageEncodingException on error building the parameters
      */
-    private VelocityContext doPostEncode(@Nonnull final OIDCAuthenticationRequest request) {
+    private VelocityContext doPostEncode(@Nonnull final OIDCAuthenticationRequest request) 
+                                                                throws MessageEncodingException {
         final VelocityContext context = new VelocityContext();
         final List<Pair<String, String>> params = createParametersFromRequest(request);
         params.forEach(param -> context.put(param.getFirst(), param.getSecond()));

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.