[java-oidc-common] branch main updated: JOIDC-99 - Support OAuth 2.0 Authorization Server Issuer Identification as per RFC9207

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=d0db53c4660b37473d19ab8bddb2661957799e50

The following commit(s) were added to refs/heads/main by this push:
     new d0db53c  JOIDC-99 - Support OAuth 2.0 Authorization Server Issuer Identification as per RFC9207
d0db53c is described below

commit d0db53c4660b37473d19ab8bddb2661957799e50
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 20 15:15:19 2022 +0300

    JOIDC-99 - Support OAuth 2.0 Authorization Server Issuer Identification as per RFC9207
    
    https://shibboleth.atlassian.net/browse/JOIDC-99
    
    Added a profile configuration predicate to OIDCAuthorizationConfiguration.
---
 .../config/OIDCAuthorizationConfiguration.java     | 40 ++++++++++++++++++
 ...udeIssuerInAuthenticationResponsePredicate.java | 49 ++++++++++++++++++++++
 2 files changed, 89 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index dd79df8..ca95143 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -71,6 +71,9 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
     /** Lookup function to supply attribute IDs to omit from UserInfo token. */
     @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
     
+    /** Whether to include iss parameter in the authentication response. */
+    @Nonnull private Predicate<ProfileRequestContext> includeIssuerInResponsePredicate;
+
     /** Enumeration of the HTTP methods used in OIDC authentication requests.*/
     public enum OIDCHttpRequestMethod {    
         /**
@@ -113,6 +116,8 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
         encodedAttributesLookupStrategy = FunctionSupport.constant(null);
         deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
         httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
+
+        includeIssuerInResponsePredicate = Predicates.alwaysFalse();
     }
 
     /**
@@ -376,4 +381,39 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
         deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
     }
 
+    /**
+     * Get whether to include iss parameter in the authentication response.
+     * 
+     * @param profileRequestContext profile request context
+     * 
+     * @return whether to include iss parameter in the authentication response
+     * 
+     * @since 2.1.0
+     */
+    public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext) {
+        return includeIssuerInResponsePredicate.test(profileRequestContext);
+    }
+
+    /**
+     * Set whether to include iss parameter in the authentication response.
+     * 
+     * @param flag flag to set
+     * 
+     * @since 2.1.0
+     */
+    public void setIncludeIssuerInResponse(final boolean flag) {
+        includeIssuerInResponsePredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+    }
+
+    /**
+     * Set condition for whether to include iss parameter in the authentication response.
+     * 
+     * @param condition condition to set
+     * 
+     * @since 2.1.0
+     */
+    public void setIncludeIssuerInResponsePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        includeIssuerInResponsePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+    }
+
 }
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IncludeIssuerInAuthenticationResponsePredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IncludeIssuerInAuthenticationResponsePredicate.java
new file mode 100644
index 0000000..50b6a63
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IncludeIssuerInAuthenticationResponsePredicate.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OIDCAuthorizationConfiguration#isIncludeIssuerInResponse(ProfileRequestContext)}.
+ * 
+ * @since 2.1.0
+ */
+public class IncludeIssuerInAuthenticationResponsePredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc instanceof OIDCAuthorizationConfiguration) {
+                return ((OIDCAuthorizationConfiguration) pc).isIncludeIssuerInResponse(input);
+            }
+        }
+        return false;
+    }
+
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.