[java-oidc-common] branch dev/JCOMOIDC-41 updated: Change JWT credential resolvers to JOSEObjectCredentialResolver types
Phil Smart
philip.smart at jisc.ac.uk
Thu Jul 14 10:11:46 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=38ce70e6bffa4492dc5d61f706833b0d420dfb5a
The following commit(s) were added to refs/heads/dev/JCOMOIDC-41 by this push:
new 38ce70e Change JWT credential resolvers to JOSEObjectCredentialResolver types
38ce70e is described below
commit 38ce70e6bffa4492dc5d61f706833b0d420dfb5a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Jul 14 11:11:39 2022 +0100
Change JWT credential resolvers to JOSEObjectCredentialResolver types
---
.../oidc/security/DecryptionConfiguration.java | 7 +--
.../oidc/security/JWTDecryptionParameters.java | 9 ++--
.../context/JWTSecurityParametersContext.java | 39 +++++++++++++---
oidc-common-crypto-impl/pom.xml | 4 +-
.../impl/ChainingJOSEObjectCredentialResolver.java | 39 ++++++++--------
.../impl/CriterionCredentialResolver.java | 6 ++-
.../impl/ProviderMetadataCredentialResolver.java | 5 ++-
.../impl/BasicJWTDecryptionConfiguration.java | 14 +++---
.../DefaultJWTDecryptionParametersResolver.java | 6 ++-
...pulateJWTSignatureSigningParametersHandler.java | 17 +++++++
.../PopulateJWTSignatureValidationParameters.java | 12 ++---
...ateJWTSignatureValidationParametersHandler.java | 11 ++---
.../oidc/security/impl/JWTDecrypterTest.java | 15 ++++---
.../config/OIDCAuthorizationConfiguration.java | 52 ++++++++++++++++++++--
14 files changed, 162 insertions(+), 74 deletions(-)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
index 0fbf4e7..eb4b62b 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
@@ -19,9 +19,10 @@ package net.shibboleth.oidc.security;
import javax.annotation.Nullable;
-import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
+
public interface DecryptionConfiguration extends AlgorithmPolicyConfiguration {
/**
@@ -29,7 +30,7 @@ public interface DecryptionConfiguration extends AlgorithmPolicyConfiguration {
*
* @return the KeyInfoCredentialResolver instance
*/
- @Nullable CredentialResolver getContentEncryptionKeyCredentialResolver();
+ @Nullable JOSEObjectCredentialResolver getContentEncryptionKeyCredentialResolver();
/**
* Get the CredentialResolver to use when processing the EncryptedKey (the
@@ -37,5 +38,5 @@ public interface DecryptionConfiguration extends AlgorithmPolicyConfiguration {
*
* @return the CredentialResolver instance
*/
- @Nullable CredentialResolver getKEKCredentialResolver();
+ @Nullable JOSEObjectCredentialResolver getKEKCredentialResolver();
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
index 53004be..6b8d2e6 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
@@ -23,6 +23,7 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.xmlsec.AlgorithmPolicyParameters;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
/**
@@ -31,10 +32,10 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
/** The encrypted content encrypted key's (CEK) credential resolver. */
- @Nullable private CredentialResolver kekKeyCredentialResolver;
+ @Nullable private JOSEObjectCredentialResolver kekKeyCredentialResolver;
/** The content encryption key (CEK) resolver.*/
- @Nullable private CredentialResolver contentEncryptionKeyCredentialResolver;
+ @Nullable private JOSEObjectCredentialResolver contentEncryptionKeyCredentialResolver;
/** Carries additional criterion made available to the resolvers at runtime.*/
@Nonnull final CriteriaSet additionalCriteria;
@@ -66,7 +67,7 @@ public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
*
* @param resolver the CredentialResolver instance
*/
- public void setContentEncryptionKeyCredentialResolver(@Nullable final CredentialResolver resolver) {
+ public void setContentEncryptionKeyCredentialResolver(@Nullable final JOSEObjectCredentialResolver resolver) {
contentEncryptionKeyCredentialResolver = resolver;
}
@@ -86,7 +87,7 @@ public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
*
* @param resolver the CredentialResolver instance
*/
- public void setKEKCredentialResolver(@Nullable final CredentialResolver resolver) {
+ public void setKEKCredentialResolver(@Nullable final JOSEObjectCredentialResolver resolver) {
kekKeyCredentialResolver = resolver;
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
index 08892ee..1dfa595 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
@@ -21,6 +21,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.xmlsec.EncryptionParameters;
import org.opensaml.xmlsec.SignatureSigningParameters;
import com.nimbusds.jwt.SignedJWT;
@@ -32,7 +33,7 @@ import net.shibboleth.oidc.security.SignatureValidationParameters;
* A context implementation for storing parameter instances for JWT signature signing and validation, and JWT
* encryption and decryption.
*/
-public class JWTSecurityParametersContext extends BaseContext {
+public final class JWTSecurityParametersContext extends BaseContext {
/** Signature validation parameters. */
@Nullable private SignatureValidationParameters<SignedJWT> signatureValidationParameters;
@@ -42,9 +43,12 @@ public class JWTSecurityParametersContext extends BaseContext {
/** Decryption parameters. */
@Nullable private JWTDecryptionParameters decryptionParameters;
+
+ /** Encryption parameters.*/
+ @Nullable private EncryptionParameters encryptionParameters;
/**
- * Get the parameters to use for XML signature validation operations.
+ * Get the parameters to use for signature validation operations.
*
* @return the parameters
*/
@@ -53,7 +57,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Set the parameters to use for XML signature validation operations.
+ * Set the parameters to use for signature validation operations.
*
* @param params The signatureValidationParameters to set
*
@@ -66,7 +70,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Get the parameters to use for XML signature signing operations.
+ * Get the parameters to use for signature signing operations.
*
* @return the parameters
*/
@@ -75,7 +79,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Set the parameters to use for XML signature signing operations.
+ * Set the parameters to use for signature signing operations.
*
* @param params the parameters
*
@@ -88,7 +92,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Get the parameters to use for XML decryption operations.
+ * Get the parameters to use for decryption operations.
*
* @return the parameters
*/
@@ -97,7 +101,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Set the parameters to use for XML decryption operations.
+ * Set the parameters to use for decryption operations.
*
* @param params the parameters
*
@@ -107,5 +111,26 @@ public class JWTSecurityParametersContext extends BaseContext {
decryptionParameters = params;
return this;
}
+
+ /**
+ * Set the parameters to use for encryption operations.
+ *
+ * @param params the parameters
+ *
+ * @return this context
+ */
+ public JWTSecurityParametersContext setEncryptionParameters(@Nullable final EncryptionParameters params) {
+ encryptionParameters = params;
+ return this;
+ }
+
+ /**
+ * Get the parameters to use for encryption operations.
+ *
+ * @return the parameters
+ */
+ @Nullable public EncryptionParameters getEncryptionParameters() {
+ return encryptionParameters;
+ }
}
diff --git a/oidc-common-crypto-impl/pom.xml b/oidc-common-crypto-impl/pom.xml
index 7aa04f9..640b95c 100644
--- a/oidc-common-crypto-impl/pom.xml
+++ b/oidc-common-crypto-impl/pom.xml
@@ -20,11 +20,11 @@
<dependencies>
<!-- Do we need this? should not!! -->
- <dependency>
+ <!-- <dependency>
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-xmlsec-impl</artifactId>
<scope>provided</scope>
- </dependency>
+ </dependency> -->
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ChainingJOSEObjectCredentialResolver.java
similarity index 50%
copy from oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
copy to oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ChainingJOSEObjectCredentialResolver.java
index 0fbf4e7..aabf703 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ChainingJOSEObjectCredentialResolver.java
@@ -15,27 +15,30 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.security;
+package net.shibboleth.oidc.security.credential.impl;
-import javax.annotation.Nullable;
+import java.util.List;
-import org.opensaml.security.credential.CredentialResolver;
-import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.credential.impl.AbstractChainingCredentialResolver;
+
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
+
+/**
+ * A concrete implementation of {@link AbstractChainingCredentialResolver} which is scoped to
+ * the simple {@link JOSEObjectCredentialResolver} type.
+ */
+public class ChainingJOSEObjectCredentialResolver extends AbstractChainingCredentialResolver<JOSEObjectCredentialResolver>
+ implements JOSEObjectCredentialResolver {
-public interface DecryptionConfiguration extends AlgorithmPolicyConfiguration {
-
- /**
- * Get the CredentialResolver to use when processing the encrypted content.
- *
- * @return the KeyInfoCredentialResolver instance
- */
- @Nullable CredentialResolver getContentEncryptionKeyCredentialResolver();
-
/**
- * Get the CredentialResolver to use when processing the EncryptedKey (the
- * Key Encryption Key or KEK).
- *
- * @return the CredentialResolver instance
+ * Constructor.
+ *
+ * @param resolverChain the credential resolver chain
*/
- @Nullable CredentialResolver getKEKCredentialResolver();
+ public ChainingJOSEObjectCredentialResolver(@Nonnull final List<JOSEObjectCredentialResolver> resolverChain) {
+ super(resolverChain);
+ }
+
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CriterionCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
similarity index 94%
rename from oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CriterionCredentialResolver.java
rename to oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
index 4d93160..e86bdcb 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CriterionCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.security.impl;
+package net.shibboleth.oidc.security.credential.impl;
import java.util.Collections;
import java.util.List;
@@ -30,6 +30,7 @@ import org.opensaml.security.criteria.UsageCriterion;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -41,7 +42,8 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
*/
//TODO Docs
//TODO Algorithm filters?
-public class CriterionCredentialResolver extends AbstractCriteriaFilteringCredentialResolver {
+public class CriterionCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
+ implements JOSEObjectCredentialResolver {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(CriterionCredentialResolver.class);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
similarity index 97%
rename from oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java
rename to oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
index 9da94c1..da0f8ff 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.security.impl;
+package net.shibboleth.oidc.security.credential.impl;
import java.time.Duration;
import java.time.Instant;
@@ -43,6 +43,7 @@ import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
@@ -57,7 +58,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
//TODO Docs
//TODO Algorithm filters?
public class ProviderMetadataCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
- implements InitializableComponent {
+ implements InitializableComponent, JOSEObjectCredentialResolver {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ProviderMetadataCredentialResolver.class);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java
index 7d414fc..7fce719 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java
@@ -19,10 +19,10 @@ package net.shibboleth.oidc.security.impl;
import javax.annotation.Nullable;
-import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.xmlsec.impl.BasicAlgorithmPolicyConfiguration;
import net.shibboleth.oidc.security.DecryptionConfiguration;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
/**
* Basic implementation of {@link DecryptionConfiguration} for handling JWEs.
@@ -31,13 +31,13 @@ public class BasicJWTDecryptionConfiguration
extends BasicAlgorithmPolicyConfiguration implements DecryptionConfiguration {
/** The EncryptedKey's credential resolver. */
- @Nullable private CredentialResolver kekKeyCredentialResolver;
+ @Nullable private JOSEObjectCredentialResolver kekKeyCredentialResolver;
/** The content encryption key (CEK) resolver.*/
- @Nullable private CredentialResolver contentEncryptionKeyCredentialResolver;
+ @Nullable private JOSEObjectCredentialResolver contentEncryptionKeyCredentialResolver;
@Override
- @Nullable public CredentialResolver getContentEncryptionKeyCredentialResolver() {
+ @Nullable public JOSEObjectCredentialResolver getContentEncryptionKeyCredentialResolver() {
return contentEncryptionKeyCredentialResolver;
}
@@ -46,12 +46,12 @@ public class BasicJWTDecryptionConfiguration
*
* @param resolver the CredentialResolver instance
*/
- public void setContentEncryptionKeyCredentialResolver(@Nullable final CredentialResolver resolver) {
+ public void setContentEncryptionKeyCredentialResolver(@Nullable final JOSEObjectCredentialResolver resolver) {
contentEncryptionKeyCredentialResolver = resolver;
}
@Override
- @Nullable public CredentialResolver getKEKCredentialResolver() {
+ @Nullable public JOSEObjectCredentialResolver getKEKCredentialResolver() {
return kekKeyCredentialResolver;
}
@@ -61,7 +61,7 @@ public class BasicJWTDecryptionConfiguration
*
* @param resolver the CredentialResolver instance
*/
- public void setKEKCredentialResolver(@Nullable final CredentialResolver resolver) {
+ public void setKEKCredentialResolver(@Nullable final JOSEObjectCredentialResolver resolver) {
kekKeyCredentialResolver = resolver;
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
index 5022b9d..6217bd0 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
@@ -13,6 +13,7 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.security.DecryptionConfiguration;
import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.JWTDecryptionParametersResolver;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.criterion.DecryptionConfigurationCriterion;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -46,6 +47,7 @@ public class DefaultJWTDecryptionParametersResolver extends AbstractSecurityPara
params.setContentEncryptionKeyCredentialResolver(resolveContentEncryptionKeyCredentialResolver(criteria));
params.setKEKCredentialResolver(resolveKEKCredentialResolver(criteria));
+ //TODO why not this?
//params.setEncryptedKeyResolver(resolveEncryptedKeyResolver(criteria));
// Add all the runtime criteria into the parameters for later use by the resolvers.
@@ -63,7 +65,7 @@ public class DefaultJWTDecryptionParametersResolver extends AbstractSecurityPara
* @param criteria the input criteria being evaluated
* @return the effective resolver, or null
*/
- @Nullable protected CredentialResolver resolveKEKCredentialResolver(
+ @Nullable protected JOSEObjectCredentialResolver resolveKEKCredentialResolver(
@Nonnull final CriteriaSet criteria) {
for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
@@ -82,7 +84,7 @@ public class DefaultJWTDecryptionParametersResolver extends AbstractSecurityPara
* @param criteria the input criteria being evaluated
* @return the effective resolver, or null
*/
- @Nullable protected CredentialResolver resolveContentEncryptionKeyCredentialResolver(
+ @Nullable protected JOSEObjectCredentialResolver resolveContentEncryptionKeyCredentialResolver(
@Nonnull final CriteriaSet criteria) {
for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java
index e3df9da..d09da47 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.impl;
import java.util.Collections;
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java
index dd4fa77..76266c6 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java
@@ -129,14 +129,10 @@ public class PopulateJWTSignatureValidationParameters
if (resolver == null) {
throw new ComponentInitializationException("SignatureValidationParametersResolver cannot be null");
}
-// else if (configurationLookupStrategy == null) {
-// configurationLookupStrategy = new Function<>() {
-// public List<SignatureValidationConfiguration<?>> apply(final ProfileRequestContext input) {
-// return Collections.singletonList(
-// SecurityConfigurationSupport.getGlobalSignatureValidationConfiguration());
-// }
-// };
-// }
+ if (configurationLookupStrategy == null) {
+ // Does not support a default config lookup like the SAML case
+ throw new ComponentInitializationException("ConfigurationLookupStrategy cannot be null");
+ }
final PopulateJWTSignatureValidationParametersHandler delegate = getDelegate();
delegate.setSignatureValidationParametersResolver(resolver);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java
index 7384ac9..17f6eee 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java
@@ -118,14 +118,9 @@ public class PopulateJWTSignatureValidationParametersHandler extends AbstractMes
if (resolver == null) {
throw new ComponentInitializationException("SignatureValidationParametersResolver cannot be null");
}
-// else if (configurationLookupStrategy == null) {
-// configurationLookupStrategy = new Function<>() {
-// public List<SignatureValidationConfiguration> apply(final MessageContext input) {
-// return Collections.singletonList(
-// SecurityConfigurationSupport.getGlobalSignatureValidationConfiguration());
-// }
-// };
-// }
+ if (configurationLookupStrategy == null) {
+ throw new ComponentInitializationException("ConfigurationLookupStrategy cannot be null");
+ }
}
/** {@inheritDoc} */
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
index 5c2159e..9a0240b 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
@@ -47,6 +47,7 @@ import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.impl.JWKEncryptionCredentialContext;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -107,7 +108,7 @@ public class JWTDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setKEKCredentialResolver(new CredentialResolver() {
+ params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -143,7 +144,7 @@ public class JWTDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setContentEncryptionKeyCredentialResolver(new CredentialResolver() {
+ params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -181,7 +182,7 @@ public class JWTDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setContentEncryptionKeyCredentialResolver(new CredentialResolver() {
+ params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -225,7 +226,7 @@ public class JWTDecrypterTest {
final var params = new JWTDecryptionParameters();
// Wrong credential type used here
- params.setContentEncryptionKeyCredentialResolver(new CredentialResolver() {
+ params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -263,7 +264,7 @@ public class JWTDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setKEKCredentialResolver(new CredentialResolver() {
+ params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -305,7 +306,7 @@ public class JWTDecrypterTest {
jweObject.encrypt(new RSAEncrypter((RSAPublicKey) key.toPublicKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setKEKCredentialResolver(new CredentialResolver() {
+ params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -350,7 +351,7 @@ public class JWTDecrypterTest {
jweObject.encrypt(new ECDHEncrypter(key.toECPublicKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setKEKCredentialResolver(new CredentialResolver() {
+ params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index e98b98e..d1b005c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -71,6 +71,9 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
/** Predicate used to determine if the generated request object should be signed. Default returns true. */
@Nonnull private Predicate<ProfileRequestContext> signRequestObjectPredicate;
+
+ /** Predicate used to determine if the generated request object should be encrypted. Default returns false. */
+ @Nonnull private Predicate<ProfileRequestContext> encryptRequestObjectPredicate;
/** Lookup function to supply attribute IDs to omit from UserInfo token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
@@ -141,6 +144,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
encodeConsentInTokensPredicate = Predicates.alwaysFalse();
useRequestObjectPredicate = Predicates.alwaysFalse();
signRequestObjectPredicate = Predicates.alwaysTrue();
+ encryptRequestObjectPredicate = Predicates.alwaysFalse();
retrieveUserInfoEndpointClaims = Predicates.alwaysTrue();
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
@@ -176,6 +180,43 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
signRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
+ /**
+ * Set the predicate to determine if the RequestObject should be signed.
+ *
+ * @param condition the condition
+ */
+ public void setSignRequestObjectPredicate(final Predicate<ProfileRequestContext> condition) {
+ signRequestObjectPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Should the RequestObject (if configured) be encrypted?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return true iff the RequestObject should be encrypted, false otherwise.
+ */
+ public boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptRequestObjectPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether the RequestObject should be encrypted.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptRequestObject(final boolean flag) {
+ encryptRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set the predicate to determine if the RequestObject should be encrypted.
+ *
+ * @param condition the condition
+ */
+ public void setEncryptRequestObjectPredicate(final Predicate<ProfileRequestContext> condition) {
+ encryptRequestObjectPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
/**
* Set the strategy to locate a client_id.
@@ -241,7 +282,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
}
/**
- * Set the redirect_uri lookup strategy to use to locate an override redirect_rui.
+ * Set the redirect_uri lookup strategy used to locate an overridden redirect.
*
* @param strategy the strategy to use.
*/
@@ -255,9 +296,12 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @param uri the redirect_uri
*/
- public void setRedirectUriOverride(@Nonnull @NotEmpty final String uri) {
- redirectUriOverrideLookupStrategy = FunctionSupport.constant(
- Constraint.isNotNull(uri, "Redirect_uri can not be null or empty"));
+ public void setRedirectUriOverride(@Nullable final String uri) {
+ if (uri != null) {
+ redirectUriOverrideLookupStrategy = FunctionSupport.constant(uri);
+ } else {
+ redirectUriOverrideLookupStrategy= FunctionSupport.constant(null);
+ }
}
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list