[java-oidc-common] branch main updated: JOIDC-104 - Support to manipulate claims within the ID_Token
Henri Mikkonen
henri.mikkonen at iki.fi
Fri May 20 07:44:57 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=837ad3786f9e04251e2a1a86a07cecab53192bcf
The following commit(s) were added to refs/heads/main by this push:
new 837ad37 JOIDC-104 - Support to manipulate claims within the ID_Token
837ad37 is described below
commit 837ad3786f9e04251e2a1a86a07cecab53192bcf
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 20 10:42:55 2022 +0300
JOIDC-104 - Support to manipulate claims within the ID_Token
https://shibboleth.atlassian.net/browse/JOIDC-104
Added a profile configuration hook to AbstractOIDCSSOConfiguration,
affecting OIDC.SSO and OAUTH2.Token.
---
.../config/AbstractOIDCSSOConfiguration.java | 44 ++++++++++++++++-
.../IDTokenManipulationStrategyLookupFunction.java | 57 ++++++++++++++++++++++
2 files changed, 100 insertions(+), 1 deletion(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index 95b3c7f..182ad00 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -20,7 +20,9 @@ package net.shibboleth.oidc.profile.config;
import java.time.Duration;
import java.util.Collection;
import java.util.Collections;
+import java.util.Map;
import java.util.Set;
+import java.util.function.BiFunction;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -86,6 +88,11 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** Lookup function to supply attribute IDs to include in ID token regardless of response_type. */
@Nonnull private Function<ProfileRequestContext,Set<String>> alwaysIncludedAttributesLookupStrategy;
+ /** Lookup function to supply strategy bi-function for manipulating id_token claims. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ idTokenManipulationStrategyLookupStrategy;
+
/**
* Creates a new configuration instance.
*
@@ -107,7 +114,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
- }
+
+ idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
+}
/** {@inheritDoc} */
@Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -494,4 +503,37 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
alwaysIncludedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /**
+ * Get the bi-function for manipulating id_token claims.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating id_token claims
+ */
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return idTokenManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-function for manipulating id_token claims.
+ *
+ * @param strategy bi-function for manipulating id_token claims
+ */
+ public void setIDTokenManipulationStrategy(
+ @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
+ idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-function for manipulating id_token claims.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIDTokenManipulationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ strategy) {
+ idTokenManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenManipulationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenManipulationStrategyLookupFunction.java
new file mode 100644
index 0000000..d79b54c
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenManipulationStrategyLookupFunction.java
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.Map;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+
+/**
+ * A function that returns
+ * {@link AbstractOIDCSSOConfiguration#getIDTokenManipulationStrategy(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class IDTokenManipulationStrategyLookupFunction extends
+ AbstractRelyingPartyLookupFunction<BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> {
+
+ /** {@inheritDoc} */
+ @Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> apply(
+ @Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof AbstractOIDCSSOConfiguration) {
+ return ((AbstractOIDCSSOConfiguration) pc).getIDTokenManipulationStrategy(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list