[java-oidc-common] branch dev/JCOMOIDC-41 updated: Add userinfo signature and encrypt/decrypt configuration
Phil Smart
philip.smart at jisc.ac.uk
Fri Jun 17 13:14:59 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=73095445b7ec2f4992c7dab8d42b4b42405a2134
The following commit(s) were added to refs/heads/dev/JCOMOIDC-41 by this push:
new 7309544 Add userinfo signature and encrypt/decrypt configuration
7309544 is described below
commit 73095445b7ec2f4992c7dab8d42b4b42405a2134
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jun 17 14:14:53 2022 +0100
Add userinfo signature and encrypt/decrypt configuration
Add authentication request params to RP OIDC config.
---
.../oidc/security/JWTDecryptionParameters.java | 2 +-
.../impl/ExplicitKeySignedJWTTrustEngine.java | 4 +-
.../config/OIDCAuthorizationConfiguration.java | 144 +++++++++++++++------
.../profile/config/OIDCSecurityConfiguration.java | 57 +++++++-
4 files changed, 160 insertions(+), 47 deletions(-)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
index 5a996b6..53004be 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
@@ -30,7 +30,7 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
*/
public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
- /** The EncryptedKey's credential resolver. */
+ /** The encrypted content encrypted key's (CEK) credential resolver. */
@Nullable private CredentialResolver kekKeyCredentialResolver;
/** The content encryption key (CEK) resolver.*/
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
index 367e63a..f4d8869 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
@@ -31,6 +31,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.google.common.base.Strings;
+import com.nimbusds.jose.JOSEObject;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
@@ -57,8 +58,7 @@ public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<It
* Constructor.
*
* @param resolver credential resolver used to resolve trusted credentials.
- * @param keyInfoResolver KeyInfo credential resolver used to obtain the (advisory) signing credential from a
- * Signature's KeyInfo element.
+ * @param joseObjectResolver resolver which resolve credentials from the headers of a {@link JOSEObject} instance.
*/
public ExplicitKeySignedJWTTrustEngine(@Nonnull final @ParameterName(name="resolver") CredentialResolver resolver,
@Nonnull final @ParameterName(name="JOSEObjectResolver") JOSEObjectCredentialResolver joseObjectResolver) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index cb0e65d..4afe8f4 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -109,10 +109,15 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*/
@Nonnull private Function<ProfileRequestContext, Credential> clientCredentialLookupStrategy;
- /** Lookup function to determine the client_authentication method. */
-// @Nonnull private Function<ProfileRequestContext, ClientAuthentication> clientAuthenticationLookupStrategy;
- //TODO same as tokenEndpointAuthMethodsLookupStrategy?
- @Nonnull private Function<ProfileRequestContext, String> clientAuthenticationMethodLookupStrategy;
+ /** Lookup function to override the default response_mode for a given response_type.*/
+ @Nonnull private Function<ProfileRequestContext, String> responseModeLookupStrategy;
+
+ /** Lookup function to retrieve the response_type.*/
+ @Nonnull private Function<ProfileRequestContext, String> responseTypeLookupStrategy;
+
+ /** Lookup function to retrieve the scopes requested during authentication.*/
+ @Nonnull private Function<ProfileRequestContext, Set<String>> scopesLookupStrategy;
+
/**
* Constructor.
@@ -140,11 +145,14 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
clientIdLookupStrategy = FunctionSupport.constant(null);
- clientAuthenticationMethodLookupStrategy = FunctionSupport.constant(null);
clientCredentialLookupStrategy = FunctionSupport.constant(null);
+ responseModeLookupStrategy = FunctionSupport.constant(null);
+ responseTypeLookupStrategy = FunctionSupport.constant("code");
+ scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
}
+
/**
* Set the strategy to locate a client_id.
*
@@ -175,40 +183,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
return clientIdLookupStrategy.apply(profileRequestContext);
}
- /**
- * Set the client authentication method lookup strategy which will locate the client_authentication method
- * for a given client.
- *
- * @param strategy the strategy to use
- */
- public void setClientAuthenticationMethodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, String> strategy) {
- clientAuthenticationMethodLookupStrategy =
- Constraint.isNotNull(strategy, "Client authentication strategy can not be null");
- }
-
- /**
- * Set the client authentication method.
- *
- * @param clientAuthMethod the client_authentication method
- */
- public void setClientAuthenticationMethod(@Nullable final String clientAuthMethod) {
- clientAuthenticationMethodLookupStrategy = FunctionSupport.constant(clientAuthMethod);
- }
-
- /**
- * Get the client_authentication for the given context. Typically that associated with the
- * current client_id.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client_authentication method
- */
- public String getClientAuthenticationMethod(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return clientAuthenticationMethodLookupStrategy.apply(profileRequestContext);
- }
-
/**
* Set the client credential lookup strategy.
*
@@ -562,5 +536,97 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
@Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
+ /**
+ * Set the lookup strategy to determine the response_mode for authentication requests.
+ *
+ * @param strategy the strategy to use
+ */
+ public void setResponseModeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
+ responseModeLookupStrategy = Constraint.isNotNull(strategy, "ResponseMode lookup strategy can not be null");
+ }
+
+ /**
+ * Get the response_mode to use for authentication requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_mode
+ */
+ public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext) {
+ return responseModeLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the response_mode to use for authentication requests.
+ *
+ * @param responseMode the response_mode to use
+ */
+ public void setResponseMode(@Nonnull final String responseMode) {
+ responseModeLookupStrategy = FunctionSupport.constant(responseMode);
+ }
+
+ /**
+ * Set the lookup strategy to determine the response_type for authentication requests.
+ *
+ * @param strategy the strategy to use
+ */
+ public void setResponseTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
+ responseTypeLookupStrategy = Constraint.isNotNull(strategy, "ResponseType lookup strategy can not be null");
+ }
+
+ /**
+ * Set the response_type to use for authentication requests.
+ *
+ * @param responseType the response_type to use
+ */
+ public void setResponseType(@Nullable final String responseType) {
+ responseTypeLookupStrategy = FunctionSupport.constant(responseType);
+ }
+
+ /**
+ * Get the response_type to use for authentication requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_type
+ */
+ public String getResponseType(@Nullable final ProfileRequestContext profileRequestContext) {
+ return responseTypeLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the lookup strategy to determine the scopes to use for authentication requests.
+ *
+ * @param strategy the strategy to use
+ */
+ public void setScopesLookupStrategy(@Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
+ scopesLookupStrategy = Constraint.isNotNull(strategy, "Scopes lookup strategy can not be null");
+ }
+
+ /**
+ * Set the scopes to use for authentication requests
+ *
+ * @param scopes the scopes
+ */
+ public void setScopes(@Nullable @NonnullElements final Set<String> scopes) {
+ if (scopes == null || scopes.isEmpty()) {
+ scopesLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ scopesLookupStrategy = FunctionSupport.constant(
+ Set.copyOf(StringSupport.normalizeStringCollection(scopes)));
+ }
+ }
+
+ /**
+ * Get the scopes to use in authentication requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the scopes
+ */
+ @Nullable public Set<String> getScopes(@Nullable final ProfileRequestContext profileRequestContext) {
+ return scopesLookupStrategy.apply(profileRequestContext);
+ }
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java
index 0a6e650..814eadc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java
@@ -49,14 +49,22 @@ public class OIDCSecurityConfiguration extends SecurityConfiguration {
@Nullable
private net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> idTokenJwtSignatureValidationConfig;
- /** Configuration used when decrypting JWTs. */
+ /** Configuration used when decrypting id_tokens. */
@Nullable
private net.shibboleth.oidc.security.DecryptionConfiguration idTokenJwtDecryptConfig;
+ /** Configuration used when decrypting UserInfo tokens. */
+ @Nullable
+ private net.shibboleth.oidc.security.DecryptionConfiguration userInfoJwtDecryptConfig;
+
+ /** Configuration used when validating UserInfo JWT signatures. */
+ @Nullable
+ private net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> userInfoTokenJwtSignatureValidationConfig;
+
/**
- * Set the configuration used to decrypt JWTs.
+ * Set the configuration used to decrypt id_tokens.
*
- * @param config configuration used when decrypting JWTs, or null
+ * @param config configuration used when decrypting id_tokens, or null
*/
public void setIdTokenJwtDecryptionConfig(@Nullable final
net.shibboleth.oidc.security.DecryptionConfiguration config) {
@@ -64,13 +72,32 @@ public class OIDCSecurityConfiguration extends SecurityConfiguration {
}
/**
- * Get the configuration used when decrypting JWTs.
+ * Get the configuration used when decrypting id_tokens.
*
- * @return configuration used when decrypting JWTs, or null
+ * @return configuration used when decrypting id_tokens, or null
*/
@Nullable public net.shibboleth.oidc.security.DecryptionConfiguration getIdtokenJwtDecryptionConfig() {
return idTokenJwtDecryptConfig;
}
+
+ /**
+ * Set the configuration used to decrypt UserInfo JWTs.
+ *
+ * @param config configuration used when decrypting UserInfo JWTs, or null
+ */
+ public void setUserInfoJwtDecryptionConfig(@Nullable final
+ net.shibboleth.oidc.security.DecryptionConfiguration config) {
+ userInfoJwtDecryptConfig = config;
+ }
+
+ /**
+ * Get the configuration used when decrypting UserInfo JWTs.
+ *
+ * @return configuration used when decrypting UserInfo JWTs, or null
+ */
+ @Nullable public net.shibboleth.oidc.security.DecryptionConfiguration getUserInfoJwtDecryptionConfig() {
+ return userInfoJwtDecryptConfig;
+ }
/**
* Get the configuration used when decrypting request object information.
@@ -149,5 +176,25 @@ public class OIDCSecurityConfiguration extends SecurityConfiguration {
@Nullable final net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> config) {
idTokenJwtSignatureValidationConfig = config;
}
+
+ /**
+ * Get the configuration used when validating id_token JWT signatures.
+ *
+ * @return configuration used when validating id_token JWT signatures, or null
+ */
+ @Nullable
+ public net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> getUserInfoTokenJwtSignatureValidationConfig() {
+ return userInfoTokenJwtSignatureValidationConfig;
+ }
+
+ /**
+ * Set the configuration used when validating id_token JWT signatures.
+ *
+ * @param config configuration used when validating id_token JWT signatures, or null
+ */
+ public void setUserInfoTokenJwtSignatureValidationConfig(
+ @Nullable final net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> config) {
+ userInfoTokenJwtSignatureValidationConfig = config;
+ }
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list