[java-oidc-common] branch main updated: JOIDC-111 - Support manipulating claims encoded inside authz code and tokens
Henri Mikkonen
henri.mikkonen at iki.fi
Fri May 27 11:21:37 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=9ccad0414efb4295ab384329be74e2e0b8f26c26
The following commit(s) were added to refs/heads/main by this push:
new 9ccad04 JOIDC-111 - Support manipulating claims encoded inside authz code and tokens
9ccad04 is described below
commit 9ccad0414efb4295ab384329be74e2e0b8f26c26
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 27 14:19:37 2022 +0300
JOIDC-111 - Support manipulating claims encoded inside authz code and tokens
https://shibboleth.atlassian.net/browse/JOIDC-111
Added profile configuration parameters for wiring manipulation function for
authorization code claims (authorize -endpoint), access token claims (authorize
and token -endpoints) and refresh token claims (token -endpoint).
---
.../config/AbstractOIDCSSOConfiguration.java | 51 ++++++++++++++++++-
.../config/OIDCAuthorizationConfiguration.java | 51 +++++++++++++++++++
...laimsSetManipulationStrategyLookupFunction.java | 59 ++++++++++++++++++++++
...laimsSetManipulationStrategyLookupFunction.java | 59 ++++++++++++++++++++++
...laimsSetManipulationStrategyLookupFunction.java | 59 ++++++++++++++++++++++
.../oauth2/config/OAuth2TokenConfiguration.java | 59 +++++++++++++++++++++-
6 files changed, 336 insertions(+), 2 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index 7c6216e..c38c42f 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -93,6 +93,11 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
idTokenManipulationStrategyLookupStrategy;
+ /** Lookup function to supply strategy bi-function for manipulating access token claims set. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ accessTokenClaimsSetManipulationStrategyLookupStrategy;
+
/**
* Creates a new configuration instance.
*
@@ -116,7 +121,8 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
alwaysIncludedAttributesLookupStrategy = FunctionSupport.constant(null);
idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
-}
+ accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
+ }
/** {@inheritDoc} */
@Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -542,4 +548,47 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
strategy) {
idTokenManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
+ /**
+ * Get the bi-function for manipulating access token claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating access token claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return accessTokenClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-function for manipulating access token claims set.
+ *
+ * @param strategy bi-function for manipulating access token claims set
+ *
+ * @since 2.1.0
+ */
+ public void setAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
+ accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-function for manipulating access token claims set.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 2.1.0
+ */
+ public void setAccessTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ strategy) {
+ accessTokenClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index ca95143..e6d5aaa 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -20,7 +20,9 @@ package net.shibboleth.oidc.profile.config;
import java.time.Duration;
import java.util.Collection;
import java.util.Collections;
+import java.util.Map;
import java.util.Set;
+import java.util.function.BiFunction;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -92,6 +94,11 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*/
@Nonnull private Function<ProfileRequestContext,OIDCHttpRequestMethod> httpRequestMethodLookupStrategy;
+ /** Lookup function to supply strategy bi-function for manipulating authorization code claims set. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy;
+
/**
* Constructor.
*/
@@ -118,6 +125,8 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
includeIssuerInResponsePredicate = Predicates.alwaysFalse();
+
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
}
/**
@@ -416,4 +425,46 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
includeIssuerInResponsePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /**
+ * Get the bi-function for manipulating authorization code claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return authorizationCodeClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-function for manipulating authorization code claims set.
+ *
+ * @param strategy bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ public void setAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-function for manipulating authorization code claims set.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 2.1.0
+ */
+ public void setAuthorizationCodeClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ strategy) {
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenClaimsSetManipulationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenClaimsSetManipulationStrategyLookupFunction.java
new file mode 100644
index 0000000..a95a743
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenClaimsSetManipulationStrategyLookupFunction.java
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.Map;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+
+/**
+ * A function that returns
+ * {@link AbstractOIDCSSOConfiguration#getAccessTokenClaimsSetManipulationStrategy(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 2.1.0
+ */
+public class AccessTokenClaimsSetManipulationStrategyLookupFunction extends
+ AbstractRelyingPartyLookupFunction<BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> {
+
+ /** {@inheritDoc} */
+ @Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> apply(
+ @Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof AbstractOIDCSSOConfiguration) {
+ return ((AbstractOIDCSSOConfiguration) pc).getAccessTokenClaimsSetManipulationStrategy(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthorizationCodeClaimsSetManipulationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthorizationCodeClaimsSetManipulationStrategyLookupFunction.java
new file mode 100644
index 0000000..3f7272e
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthorizationCodeClaimsSetManipulationStrategyLookupFunction.java
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.Map;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+
+/**
+ * A function that returns
+ * {@link OIDCAuthorizationConfiguration#getAuthorizationCodeClaimsSetManipulationStrategy(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 2.1.0
+ */
+public class AuthorizationCodeClaimsSetManipulationStrategyLookupFunction extends
+ AbstractRelyingPartyLookupFunction<BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> {
+
+ /** {@inheritDoc} */
+ @Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> apply(
+ @Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OIDCAuthorizationConfiguration) {
+ return ((OIDCAuthorizationConfiguration) pc).getAuthorizationCodeClaimsSetManipulationStrategy(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenClaimsSetManipulationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenClaimsSetManipulationStrategyLookupFunction.java
new file mode 100644
index 0000000..1bdf1f6
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenClaimsSetManipulationStrategyLookupFunction.java
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.Map;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration;
+
+/**
+ * A function that returns
+ * {@link OAuth2TokenConfiguration#getRefreshTokenClaimsSetManipulationStrategy(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 2.1.0
+ */
+public class RefreshTokenClaimsSetManipulationStrategyLookupFunction extends
+ AbstractRelyingPartyLookupFunction<BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> {
+
+ /** {@inheritDoc} */
+ @Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> apply(
+ @Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OAuth2TokenConfiguration) {
+ return ((OAuth2TokenConfiguration) pc).getRefreshTokenClaimsSetManipulationStrategy(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
index b013b9d..ee7bab8 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
@@ -19,14 +19,18 @@ package net.shibboleth.oidc.profile.oauth2.config;
import java.util.Collection;
import java.util.Collections;
+import java.util.Map;
import java.util.Set;
+import java.util.function.BiFunction;
import java.util.function.Function;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.google.common.base.Predicates;
import com.nimbusds.oauth2.sdk.GrantType;
import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
@@ -49,6 +53,14 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
/** Enabled grant types. */
@Nonnull private Function<ProfileRequestContext,Set<String>> grantTypesLookupStrategy;
+ /** Whether always include c_hash into the id_token. */
+ @Nonnull private Predicate<ProfileRequestContext> alwaysIncludeCodeHashToIDTokenPredicate;
+
+ /** Lookup function to supply strategy bi-function for manipulating refresh token claims set. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ refreshTokenClaimsSetManipulationStrategyLookupStrategy;
+
/**
* Constructor.
*/
@@ -57,6 +69,9 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
grantTypesLookupStrategy = FunctionSupport.constant(
Set.of(GrantType.AUTHORIZATION_CODE.toString(), GrantType.REFRESH_TOKEN.toString()));
+ alwaysIncludeCodeHashToIDTokenPredicate = Predicates.alwaysFalse();
+
+ refreshTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
}
/**
@@ -110,5 +125,47 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
@Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
grantTypesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
-
+
+ /**
+ * Get the bi-function for manipulating refresh token claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating refresh token claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getRefreshTokenClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return refreshTokenClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-function for manipulating refresh token claims set.
+ *
+ * @param strategy bi-function for manipulating refresh token claims set
+ *
+ * @since 2.1.0
+ */
+ public void setRefreshTokenClaimsSetManipulationStrategy(
+ @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
+ refreshTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-function for manipulating refresh token claims set.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 2.1.0
+ */
+ public void setRefreshTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ strategy) {
+ refreshTokenClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list