[java-oidc-common] branch main updated: JOIDC-90 - Revocation of individual tokens
Henri Mikkonen
henri.mikkonen at iki.fi
Tue May 31 11:27:13 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=dbb3a59c553c968981003a5d33e98834670e4fec
The following commit(s) were added to refs/heads/main by this push:
new dbb3a59 JOIDC-90 - Revocation of individual tokens
dbb3a59 is described below
commit dbb3a59c553c968981003a5d33e98834670e4fec
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue May 31 14:25:58 2022 +0300
JOIDC-90 - Revocation of individual tokens
https://shibboleth.atlassian.net/browse/JOIDC-90
Added profile configuration parameters for revocation method and
lifetime + functions to fetch their values.
---
.../navigate/RevocationLifetimeLookupFunction.java | 52 ++++++++++
.../navigate/RevocationMethodLookupFunction.java | 51 ++++++++++
.../config/OAuth2TokenRevocationConfiguration.java | 111 +++++++++++++++++++++
3 files changed, 214 insertions(+)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationLifetimeLookupFunction.java
new file mode 100644
index 0000000..800a9ea
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationLifetimeLookupFunction.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.time.Duration;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration;
+
+/**
+ * A function that returns
+ * {@link OAuth2TokenRevocationConfiguration#getRevocationLifetime(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class RevocationLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
+
+ /** {@inheritDoc} */
+ @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OAuth2TokenRevocationConfiguration) {
+ return ((OAuth2TokenRevocationConfiguration) pc).getRevocationLifetime(input);
+ }
+ }
+ return null;
+ }
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationMethodLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationMethodLookupFunction.java
new file mode 100644
index 0000000..5f0c78f
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationMethodLookupFunction.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration.OAuth2TokenRevocationMethod;
+
+/**
+ * A function that returns
+ * {@link OAuth2TokenRevocationConfiguration#getRevocationMethod(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class RevocationMethodLookupFunction extends AbstractRelyingPartyLookupFunction<OAuth2TokenRevocationMethod> {
+
+ /** {@inheritDoc} */
+ @Nullable public OAuth2TokenRevocationMethod apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OAuth2TokenRevocationConfiguration) {
+ return ((OAuth2TokenRevocationConfiguration) pc).getRevocationMethod(input);
+ }
+ }
+ return null;
+ }
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
index 507e054..be83bb5 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
@@ -17,9 +17,19 @@
package net.shibboleth.oidc.profile.oauth2.config;
+import java.time.Duration;
+import java.util.function.Function;
+
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
* Profile configuration for the OAuth2 Token Revocation.
@@ -32,11 +42,34 @@ public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValid
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/revocation";
+ /** Enumeration of the HTTP methods used in OIDC authentication requests.*/
+ public enum OAuth2TokenRevocationMethod {
+ /**
+ * Revoke full chain of tokens (from authorization code (or initial access token) onwards).
+ */
+ CHAIN,
+ /**
+ * Revoke single access or refresh token.
+ */
+ TOKEN
+ }
+
+ /**
+ * Which revocation method should be used when revoking a token.
+ * Supported values are CHAIN and TOKEN. The default is CHAIN.
+ */
+ @Nonnull private Function<ProfileRequestContext,OAuth2TokenRevocationMethod> revocationMethodLookupStrategy;
+
+ /** Lookup function to supply revocation lifetime. */
+ @Nonnull private Function<ProfileRequestContext,Duration> revocationLifetimeLookupStrategy;
+
/**
* Constructor.
*/
public OAuth2TokenRevocationConfiguration() {
this(PROFILE_ID);
+ revocationMethodLookupStrategy = FunctionSupport.constant(OAuth2TokenRevocationMethod.CHAIN);
+ revocationLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(6));
}
/**
@@ -48,4 +81,82 @@ public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValid
super(profileId);
}
+ /**
+ * Set strategy for looking up which revocation method should be used when revoking a token.
+ *
+ * @param strategy What to set.
+ */
+ public void setRevocationMethodLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,OAuth2TokenRevocationMethod> strategy) {
+ revocationMethodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Set which revocation method should be used when revoking a token.
+ *
+ * @param method What to set.
+ */
+ public void setRevocationMethod(@Nonnull @NotEmpty final String method) {
+ Constraint.isNotEmpty(method, "OAuth2 token revocation method strategy can not be null or empty");
+ if ("CHAIN".equals(method)) {
+ revocationMethodLookupStrategy = FunctionSupport.constant(OAuth2TokenRevocationMethod.CHAIN);
+ } else if ("TOKEN".equals(method)) {
+ revocationMethodLookupStrategy = FunctionSupport.constant(OAuth2TokenRevocationMethod.TOKEN);
+ } else {
+ throw new ConstraintViolationException("OAuth2 token revocation method '"
+ + "' not recognized, must be one of CHAIN or TOKEN");
+ }
+ }
+
+ /**
+ * Get the revocation method used when revoking a token.
+ *
+ * @param profileRequestContext profile request context.
+ * @return The revocation method used when revoking a token.
+ */
+ public OAuth2TokenRevocationMethod getRevocationMethod(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return revocationMethodLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set a lookup strategy for the revocation lifetime.
+ *
+ * @param strategy What to set.
+ */
+ public void setRevocationLifetimeLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,Duration> strategy) {
+ revocationLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Get revocation lifetime.
+ *
+ * <p>Defaults to 6 hours.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return revocation lifetime
+ */
+ @Positive @Nonnull
+ public Duration getRevocationLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Duration lifetime = revocationLifetimeLookupStrategy.apply(profileRequestContext);
+
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Revocation lifetime must be greater than 0");
+ return lifetime;
+ }
+
+ /**
+ * Set the lifetime of revocation.
+ *
+ * @param lifetime What to set.
+ */
+ public void setRevocationLifetime(@Positive @Nonnull final Duration lifetime) {
+ Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
+ "Revocation lifetime must be greater than 0");
+
+ revocationLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
+ }
+
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list