[java-idp-oidc] branch main updated: Removed an unused class.
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Mar 25 13:02:37 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e513476cadc5a8f8685c826784fb2a9c85b32689
The following commit(s) were added to refs/heads/main by this push:
new e513476c Removed an unused class.
e513476c is described below
commit e513476cadc5a8f8685c826784fb2a9c85b32689
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 25 15:01:33 2022 +0200
Removed an unused class.
This is related to some old PoC'ing and has accidentally come as a part of
this tree.
---
.../op/profile/impl/SignRegistrationResponse.java | 258 ---------------------
1 file changed, 258 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SignRegistrationResponse.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SignRegistrationResponse.java
deleted file mode 100644
index ccc1d17c..00000000
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SignRegistrationResponse.java
+++ /dev/null
@@ -1,258 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-
-import java.security.interfaces.ECPrivateKey;
-import java.text.ParseException;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.xmlsec.SignatureSigningParameters;
-import org.opensaml.xmlsec.context.SecurityParametersContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.nimbusds.jose.Algorithm;
-import com.nimbusds.jose.JOSEException;
-import com.nimbusds.jose.JWSAlgorithm;
-import com.nimbusds.jose.JWSHeader;
-import com.nimbusds.jose.JWSSigner;
-import com.nimbusds.jose.crypto.ECDSASigner;
-import com.nimbusds.jose.crypto.MACSigner;
-import com.nimbusds.jose.crypto.RSASSASigner;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformationResponse;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-
-import net.minidev.json.JSONObject;
-import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.OIDCClientRegistrationResponseMetadataLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.MetadataStatementsLookupFunction;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.oidc.security.credential.JWKCredential;
-import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/**
- * If metadata_statements already exists in the response metadata, the response is signed according to the OIDCfed
- * specification.
- *
- * TODO: remove duplicates with other signing actions (id_token issuer).
- * TODO: revisit
- */
-public class SignRegistrationResponse extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(SignRegistrationResponse.class);
-
- /** The resolved credential. */
- private Credential credential;
-
- /** The response to add the signature on. */
- private OIDCClientInformationResponse response;
-
- /** The value to be used in the 'iss' claim. */
- private String issuer;
-
- /** Strategy used to locate the existing metadata_statements map from the registration response. */
- @Nonnull private Function<ProfileRequestContext, Map<String, String>> metadataStatementsLookupStrategy;
-
- /** Strategy used to locate the {@link SecurityParametersContext} to use for signing. */
- @Nonnull private Function<ProfileRequestContext, SecurityParametersContext> securityParametersLookupStrategy;
-
- /** The signature signing parameters. */
- @Nullable private SignatureSigningParameters signatureSigningParameters;
-
- /** Constructor. */
- public SignRegistrationResponse() {
- securityParametersLookupStrategy = new ChildContextLookup<>(SecurityParametersContext.class);
- metadataStatementsLookupStrategy = new MetadataStatementsLookupFunction();
- ((MetadataStatementsLookupFunction)metadataStatementsLookupStrategy).setMetadataLookupStrategy(
- new OIDCClientRegistrationResponseMetadataLookupFunction());
- }
-
- /**
- * Set the value to be used in the 'iss' claim.
- * @param iss The value to be used in the 'iss' claim.
- */
- public void setIssuer(final String iss) {
- issuer = Constraint.isNotEmpty(iss, "The issuer cannot be empty!");
- }
-
- /**
- * Set the strategy used to locate the {@link SecurityParametersContext} to
- * use.
- *
- * @param strategy
- * lookup strategy
- */
- public void setSecurityParametersLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, SecurityParametersContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- securityParametersLookupStrategy = Constraint.isNotNull(strategy,
- "SecurityParameterContext lookup strategy cannot be null");
- }
-
- /**
- * Set the stategy used to locate the existing metadata_statements map from the registration response.
- * @param strategy The stategy used to locate the existing metadata_statements map from the registration response.
- */
- public void setMetadataStatementsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Map<String, String>> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- metadataStatementsLookupStrategy = Constraint.isNotNull(strategy,
- "Metadata statements lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- final SecurityParametersContext secParamCtx = securityParametersLookupStrategy.apply(profileRequestContext);
- if (secParamCtx == null) {
- log.debug("{} Will not sign id token because no security parameters context is available", getLogPrefix());
- return false;
- }
-
- signatureSigningParameters = secParamCtx.getSignatureSigningParameters();
- if (signatureSigningParameters == null || signatureSigningParameters.getSigningCredential() == null) {
- log.debug("{} Will not sign id token because no signature signing credentials available", getLogPrefix());
- return false;
- }
- credential = signatureSigningParameters.getSigningCredential();
-
- if (profileRequestContext.getOutboundMessageContext() == null) {
- log.error("{} Unable to locate outbound message context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- final Object message = profileRequestContext.getOutboundMessageContext().getMessage();
-
- if (message == null || !(message instanceof OIDCClientInformationResponse)) {
- log.error("{} Unable to locate outbound message", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- response = (OIDCClientInformationResponse) message;
- return true;
- }
-
- /**
- * Returns correct implementation of signer based on algorithm type.
- *
- * @param jwsAlgorithm
- * JWS algorithm
- * @return signer for algorithm and private key
- * @throws JOSEException
- * if algorithm cannot be supported
- */
- private JWSSigner getSigner(final Algorithm jwsAlgorithm) throws JOSEException {
- if (JWSAlgorithm.Family.EC.contains(jwsAlgorithm)) {
- return new ECDSASigner((ECPrivateKey) credential.getPrivateKey());
- }
- if (JWSAlgorithm.Family.RSA.contains(jwsAlgorithm)) {
- return new RSASSASigner(credential.getPrivateKey());
- }
- if (JWSAlgorithm.Family.HMAC_SHA.contains(jwsAlgorithm)) {
- return new MACSigner(credential.getSecretKey());
- }
- throw new JOSEException("Unsupported algorithm " + jwsAlgorithm.getName());
- }
-
- /**
- * Resolves JWS algorithm from signature signing parameters.
- *
- * @return JWS algorithm
- */
- private JWSAlgorithm resolveAlgorithm() {
-
- final JWSAlgorithm algorithm = new JWSAlgorithm(signatureSigningParameters.getSignatureAlgorithm());
- if (credential instanceof JWKCredential) {
- if (!algorithm.equals(((JWKCredential) credential).getAlgorithm())) {
- log.warn("{} Signature signing algorithm {} differs from JWK algorithm {}", getLogPrefix(),
- algorithm.getName(), ((JWKCredential) credential).getAlgorithm());
- }
- }
- log.debug("{} Algorithm resolved {}", getLogPrefix(), algorithm.getName());
- return algorithm;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final OIDCClientMetadata responseMetadata = response.getOIDCClientInformation().getOIDCMetadata();
-
- final Map<String, String> statements = metadataStatementsLookupStrategy.apply(profileRequestContext);
- if (statements == null || statements.isEmpty()) {
- log.debug("{} No existing metadata_statements, nothing to be done", getLogPrefix());
- return;
- }
-
- final String federationId = statements.keySet().iterator().next();
-
- SignedJWT jwt = null;
- final Algorithm jwsAlgorithm = resolveAlgorithm();
- final String kid = CredentialConversionUtil.resolveKid(credential);
-
- try {
- final JWSSigner signer = getSigner(jwsAlgorithm);
-
- responseMetadata.setCustomField("kid", kid);
- responseMetadata.setCustomField("iss", issuer);
- responseMetadata.setCustomField("exp",
- Long.valueOf(Instant.now().plus(Duration.ofHours(1)).getEpochSecond()));
- //TODO: currently hardcoded to one hour, must be configured
-
- jwt = new SignedJWT(new JWSHeader.Builder(new JWSAlgorithm(jwsAlgorithm.getName())).keyID(kid).build(),
- JWTClaimsSet.parse(response.getOIDCClientInformation().toJSONObject()));
- jwt.sign(signer);
-
- final JSONObject newStatements = new JSONObject();
- newStatements.put(federationId, jwt.serialize());
-
- responseMetadata.setCustomField("metadata_statements", newStatements);
- } catch (final ParseException e) {
- log.error("{} Error parsing claimset: {}", getLogPrefix(), e.getMessage());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return;
- } catch (final JOSEException e) {
- log.error("{} Error signing id token: {}", getLogPrefix(), e.getMessage());
- ActionSupport.buildEvent(profileRequestContext, EventIds.UNABLE_TO_SIGN);
- return;
- }
- log.debug("{} signed id token stored to context", getLogPrefix());
- }
-}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list