[java-oidc-common] branch main updated: JOIDC-92 - Support for refresh token rotation

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=df10c829c7156de21950082d0860a662645b5880

The following commit(s) were added to refs/heads/main by this push:
     new df10c82  JOIDC-92 - Support for refresh token rotation
df10c82 is described below

commit df10c829c7156de21950082d0860a662645b5880
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Jun 7 13:41:47 2022 +0300

    JOIDC-92 - Support for refresh token rotation
    
    https://shibboleth.atlassian.net/browse/JOIDC-92
    
    New profile configuration parameter for OAUTH2.Token and a
    helper function to fetch its value.
---
 .../EnforceRefreshTokenRotationPredicate.java      | 47 +++++++++++++++++++++
 .../oauth2/config/OAuth2TokenConfiguration.java    | 48 +++++++++++++++++++---
 2 files changed, 89 insertions(+), 6 deletions(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EnforceRefreshTokenRotationPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EnforceRefreshTokenRotationPredicate.java
new file mode 100644
index 0000000..d0d51b7
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EnforceRefreshTokenRotationPredicate.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OAuth2TokenConfiguration#isEnforceRefreshTokenRotation(ProfileRequestContext)}.
+ */
+public class EnforceRefreshTokenRotationPredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc instanceof OAuth2TokenConfiguration) {
+                return ((OAuth2TokenConfiguration) pc).isEnforceRefreshTokenRotation(input);
+            }
+        }
+        return false;
+    }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
index ee7bab8..2f75eb7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
@@ -53,25 +53,24 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
     /** Enabled grant types. */
     @Nonnull private Function<ProfileRequestContext,Set<String>> grantTypesLookupStrategy;
 
-    /** Whether always include c_hash into the id_token. */
-    @Nonnull private Predicate<ProfileRequestContext> alwaysIncludeCodeHashToIDTokenPredicate;
-
     /** Lookup function to supply strategy bi-function for manipulating refresh token claims set. */ 
     @Nonnull
     private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
         refreshTokenClaimsSetManipulationStrategyLookupStrategy;
 
+    /** Whether always revoke the refresh_token after it's used. */
+    @Nonnull private Predicate<ProfileRequestContext> enforceRefreshTokenRotationPredicate;
+
     /**
      * Constructor.
      */
     public OAuth2TokenConfiguration() {
         this(PROFILE_ID);
-        
+
         grantTypesLookupStrategy = FunctionSupport.constant(
                 Set.of(GrantType.AUTHORIZATION_CODE.toString(), GrantType.REFRESH_TOKEN.toString()));
-        alwaysIncludeCodeHashToIDTokenPredicate = Predicates.alwaysFalse();
-
         refreshTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
+        enforceRefreshTokenRotationPredicate = Predicates.alwaysFalse();
     }
 
     /**
@@ -168,4 +167,41 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
                 "Lookup strategy cannot be null");
     }
 
+    /**
+     * Get whether always revoke the refresh_token after it's used.
+     * 
+     * @param profileRequestContext profile request context
+     * 
+     * @return whether always revoke the refresh_token after it's used
+     * 
+     * @since 2.1.0
+     */
+    @Nonnull
+    public boolean isEnforceRefreshTokenRotation(
+            @Nullable final ProfileRequestContext profileRequestContext) {
+        return enforceRefreshTokenRotationPredicate.test(profileRequestContext);
+    }
+
+    /**
+     * Set whether always revoke the refresh_token after it's used.
+     * 
+     * @param flag flag to set
+     * 
+     * @since 2.1.0
+     */
+     public void setEnforceRefreshTokenRotation(final boolean flag) {
+         enforceRefreshTokenRotationPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+     }
+
+    /**
+     * Set condition for whether always revoke the refresh_token after it's used.
+     * 
+     * @param condition condition to set
+     * 
+     * @since 2.1.0
+     */
+     public void setEnforceRefreshTokenRotationPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+         enforceRefreshTokenRotationPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+     }
+
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.