[java-oidc-common] branch dev/JCOMOIDC-41 updated: Add requested claims parameter to encoders and authn request object
Phil Smart
philip.smart at jisc.ac.uk
Thu Jul 21 09:03:13 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=7f4cc6ad6450e7de541c7efbcef7b72b7426d0b6
The following commit(s) were added to refs/heads/dev/JCOMOIDC-41 by this push:
new 7f4cc6a Add requested claims parameter to encoders and authn request object
7f4cc6a is described below
commit 7f4cc6ad6450e7de541c7efbcef7b72b7426d0b6
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Jul 21 10:03:07 2022 +0100
Add requested claims parameter to encoders and authn request object
---
.../profile/core/OIDCAuthenticationRequest.java | 23 +++++++++
.../encoder/impl/AbstractOIDCMessageEncoder.java | 23 ++++++---
.../impl/HTTPPostAuthnRequestEncoderTest.java | 24 ++++++++++
.../impl/HTTPRedirectAuthnRequestEncoderTest.java | 56 +++++++++++++++-------
.../resources/templates/oidc-request-form-post.vm | 6 ++-
5 files changed, 109 insertions(+), 23 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
index 21e7f59..4287306 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -49,6 +50,10 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
/** The request URI. Optional. */
@Nullable private URI requestURI;
+ /** Individual requested claims.*/
+ @Nullable private OIDCClaimsRequest requestedClaims;
+
+
/**
*
* Constructor.
@@ -121,6 +126,24 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
requestURI = uri;
}
+ /**
+ * Set any individual requested claims.
+ *
+ * @param claims the requested claims.
+ */
+ public void setRequestedClaims(@Nullable final OIDCClaimsRequest claims) {
+ requestedClaims = claims;
+ }
+
+ /**
+ * Get the requested claims.
+ *
+ * @return the requested claims.
+ */
+ @Nullable public OIDCClaimsRequest getRequestedClaims() {
+ return requestedClaims;
+ }
+
//TODO others relating to sections 5.2, 5.5, 6, and 7.2.1
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/AbstractOIDCMessageEncoder.java
index db4813e..6c1fab4 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/AbstractOIDCMessageEncoder.java
@@ -49,7 +49,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(AbstractOIDCMessageEncoder.class);
- /** A hook to allow additional checking of the authorization parameters after it is build.*/
+ /** A hook to allow additional checking of the authorization parameters after it is built.*/
@Nonnull private Predicate<List<Pair<String, String>>> authorizationParamsAreValidPredicate;
protected AbstractOIDCMessageEncoder() {
@@ -111,14 +111,17 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
/**
* Create a list of OAuth 2.0 authorization parameters from the {@link OIDCAuthenticationRequest} object.
*
+ * <p>Note, the parameters are not URL encoded here. This is left to the calling code e.g. the URLBuidler
+ * in the {@link #serializeAuthorizationParamsToQueryString(OIDCAuthenticationRequest)} method. </p>
+ *
* @param req the authentication request
*
* @return a list of authorization parameters.
*
* @throws MessageEncodingException on error building the parameters
*/
- protected List<Pair<String, String>> createParametersFromRequest(@Nonnull final OIDCAuthenticationRequest req)
- throws MessageEncodingException {
+ protected List<Pair<String, String>> createParametersFromRequest(
+ @Nonnull final OIDCAuthenticationRequest req) throws MessageEncodingException {
final List<Pair<String, String>> params = new ArrayList<>();
@@ -140,8 +143,12 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
if (req.getPrompt() != null) {
params.add(new Pair<>("prompt", req.getPrompt().toString()));
}
- if (req.getRequestObject() != null) {
- params.add(new Pair<>("request", req.getRequestObject().serialize()));
+ if (req.getRequestObject() != null) {
+ try {
+ params.add(new Pair<>("request", req.getRequestObject().serialize()));
+ } catch (final IllegalStateException e) {
+ throw new MessageEncodingException("Couldn't serialize request object to JWT: " + e.getMessage(), e);
+ }
}
if (req.getNonce() != null) {
params.add(new Pair<>("nonce", req.getNonce().getValue()));
@@ -149,6 +156,9 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
if (req.getMaxAge() != null && req.getMaxAge().toSeconds() > 0) {
params.add(new Pair<>("max_age", Long.toString(req.getMaxAge().toSeconds())));
}
+ if (req.getRequestedClaims() != null) {
+ params.add(new Pair<>("claims", req.getRequestedClaims().toJSONString()));
+ }
if (req.getAcrs() != null && !req.getAcrs().isEmpty()) {
final String acrString =String.join(" ", req.getAcrs()
.stream()
@@ -164,6 +174,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
return params;
}
+
/**
* Ensure the authorization parameters are valid.
@@ -198,7 +209,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
}
/**
- * Check if the value is contained (exactly) in the parameter map as the first item of any pair.
+ * Check if the value is contained (exact string match) in the parameter map as the first item of any pair.
*
* @param value the value to check exists
*
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoderTest.java
index ade26f4..d372654 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoderTest.java
@@ -14,6 +14,8 @@ import org.testng.annotations.Test;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.assurance.claims.VerifiedClaimsSetRequest;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -67,6 +69,28 @@ public class HTTPPostAuthnRequestEncoderTest {
encoder.setHttpServletResponse(mockResponse);
}
+ @Test
+ public void testSuccesfullEncoding_WithClaims() throws Exception {
+
+ final OIDCClaimsRequest requestedClaims = new OIDCClaimsRequest()
+ .withIDTokenClaimsRequest(new VerifiedClaimsSetRequest().add("given_name"))
+ .withUserInfoClaimsRequest(new VerifiedClaimsSetRequest().add("family_name"));
+ request.setRequestedClaims(requestedClaims);
+
+ encoder.initialize();
+ encoder.encode();
+ final String response = mockResponse.getContentAsString();
+ System.out.println(response);
+ assertNotNull(response);
+ // These are all required
+ assertTrue(response.contains("client_id"));
+ assertTrue(response.contains("response_type"));
+ assertTrue(response.contains("client_id"));
+ assertTrue(response.contains("scope"));
+ assertTrue(response.contains("claims"));
+
+ }
+
@Test
public void testSuccesfullEncoding() throws MessageEncodingException, ComponentInitializationException, UnsupportedEncodingException {
encoder.initialize();
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoder/impl/HTTPRedirectAuthnRequestEncoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoder/impl/HTTPRedirectAuthnRequestEncoderTest.java
index bcbe842..9cbc5e8 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoder/impl/HTTPRedirectAuthnRequestEncoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoder/impl/HTTPRedirectAuthnRequestEncoderTest.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.profile.encoder.impl;
import static org.testng.Assert.assertNotNull;
@@ -13,25 +30,11 @@ import org.testng.annotations.Test;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.assurance.claims.VerifiedClaimsSetRequest;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.utilities.java.support.component.UninitializedComponentException;
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
/** Test for the HTTPRedirectAuthnRequestEncoder.*/
public class HTTPRedirectAuthnRequestEncoderTest {
@@ -77,6 +80,27 @@ public class HTTPRedirectAuthnRequestEncoderTest {
}
+ @Test
+ public void testSuccesfullEncoding_WithClaims() throws Exception {
+
+ final OIDCClaimsRequest requestedClaims = new OIDCClaimsRequest()
+ .withIDTokenClaimsRequest(new VerifiedClaimsSetRequest().add("given_name"))
+ .withUserInfoClaimsRequest(new VerifiedClaimsSetRequest().add("family_name"));
+ request.setRequestedClaims(requestedClaims);
+
+ encoder.initialize();
+ encoder.encode();
+ final String response = mockResponse.getRedirectedUrl();
+ assertNotNull(response);
+ // These are all required
+ assertTrue(response.contains("client_id"));
+ assertTrue(response.contains("response_type"));
+ assertTrue(response.contains("client_id"));
+ assertTrue(response.contains("scope"));
+ assertTrue(response.contains("claims"));
+
+ }
+
@Test(expectedExceptions = UninitializedComponentException.class)
public void testUninitialized() throws MessageEncodingException {
encoder.encode();
diff --git a/oidc-common-profile-impl/src/test/resources/templates/oidc-request-form-post.vm b/oidc-common-profile-impl/src/test/resources/templates/oidc-request-form-post.vm
index 1a294c3..ff3955f 100644
--- a/oidc-common-profile-impl/src/test/resources/templates/oidc-request-form-post.vm
+++ b/oidc-common-profile-impl/src/test/resources/templates/oidc-request-form-post.vm
@@ -32,8 +32,12 @@
<input type="hidden" name="state" value="${state}" />#end #if($prompt)
<input type="hidden" name="prompt" value="${prompt}" />#end #if($request)
+
+ <input type="hidden" name="request" value="${request}" />#end #if($claims)
- <input type="hidden" name="request" value="${request}" />#end
+ <input type="hidden" name="claims" value="${claims}" />#end #if($nonce)
+
+ <input type="hidden" name="nonce" value="${nonce}" />#end
</div>
<noscript>
<div>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list