[java-oidc-common] branch main updated: JCOMOIDC-38 - Move various support classes from the OP plugin
Phil Smart
philip.smart at jisc.ac.uk
Thu Nov 24 15:57:37 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=164528c52301533d96c11ba66fb685d1c9b8240e
The following commit(s) were added to refs/heads/main by this push:
new 164528c JCOMOIDC-38 - Move various support classes from the OP plugin
164528c is described below
commit 164528c52301533d96c11ba66fb685d1c9b8240e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Nov 24 15:57:34 2022 +0000
JCOMOIDC-38 - Move various support classes from the OP plugin
- Move in a modified version of the build keyset response action.
https://shibboleth.atlassian.net/browse/JCOMOIDC-38
---
oidc-common-profile-impl/pom.xml | 9 ++
.../impl/FormOutboundKeySetResponseMessage.java | 171 +++++++++++++++++++++
2 files changed, 180 insertions(+)
diff --git a/oidc-common-profile-impl/pom.xml b/oidc-common-profile-impl/pom.xml
index 670a1e5..1e85540 100644
--- a/oidc-common-profile-impl/pom.xml
+++ b/oidc-common-profile-impl/pom.xml
@@ -22,6 +22,15 @@
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-profile-api</artifactId>
</dependency>
+ <!-- TODO remove impl module. Needed for the CredentialConversionUtil class - maybe move that to API?-->
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-crypto-impl</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-crypto-api</artifactId>
+ </dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-metadata-api</artifactId>
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessage.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessage.java
new file mode 100644
index 0000000..ceefb45
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessage.java
@@ -0,0 +1,171 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.impl;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.credential.Credential;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jose.jwk.JWK;
+import com.nimbusds.jose.jwk.JWKSet;
+
+import net.minidev.json.JSONObject;
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.idp.profile.IdPEventIds;
+import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
+import net.shibboleth.oidc.profile.messaging.JSONSuccessResponse;
+import net.shibboleth.oidc.security.impl.CredentialConversionUtil;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Action that forms outbound message containing keyset. Keys of the keyset are located from security configuration
+ * via a lookup strategy. The built response is set on to the {@link ProfileRequestContext#getOutboundMessageContext()}.
+ */
+public class FormOutboundKeySetResponseMessage extends AbstractProfileAction {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(FormOutboundKeySetResponseMessage.class);
+
+ /**
+ * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
+ */
+ @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
+
+ /**
+ * Strategy used to locate the list of credentials to publish.
+ */
+ @Nonnull private Function<OIDCSecurityConfiguration, List<Credential>> credentialsToPublishLookupStrategy;
+
+ /** Security configuration we look for keys to publish. */
+ @Nullable private OIDCSecurityConfiguration secConfiguration;
+
+ /** Constructor. */
+ public FormOutboundKeySetResponseMessage() {
+ relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ credentialsToPublishLookupStrategy = secConfig -> Collections.emptyList();
+ }
+
+ /**
+ * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link ProfileRequestContext}.
+ *
+ * @param strategy strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link ProfileRequestContext}
+ */
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ relyingPartyContextLookupStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the strategy used to locate the credentials to publish at the KeySet endpoint.
+ *
+ * @param strategy the strategy.
+ */
+ public void setCredentialsToPublishLookupStrategy(
+ @Nonnull final Function<OIDCSecurityConfiguration, List<Credential>> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ credentialsToPublishLookupStrategy = Constraint.isNotNull(strategy,
+ "credentialsToPublishLookupStrategy can not be null");
+ }
+
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ if (!super.doPreExecute(profileRequestContext)) {
+ return false;
+ }
+
+ final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
+ if (rpCtx == null) {
+ log.debug("{} No relying party context associated with this profile request", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ return false;
+ }
+
+ if (rpCtx.getProfileConfig() == null) {
+ log.debug("{} No profile configuration associated with this profile request", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ return false;
+ }
+
+ final SecurityConfiguration securityConfig =
+ rpCtx.getProfileConfig().getSecurityConfiguration(profileRequestContext);
+
+ if (!(securityConfig instanceof OIDCSecurityConfiguration)) {
+ log.debug("{} No security configuration associated with the profile configuration of the profile request",
+ getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
+ return false;
+ }
+
+ secConfiguration = (OIDCSecurityConfiguration) securityConfig;
+ return true;
+ }
+
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ final List<JWK> publishList = new ArrayList<>();
+
+ final List<Credential> credentialsToPublish = credentialsToPublishLookupStrategy.apply(secConfiguration);
+ convertAndPublishToList(credentialsToPublish, publishList);
+
+ final JWKSet keySet = new JWKSet(publishList);
+ final JSONObject keySetJson = new JSONObject(keySet.toJSONObject());
+ profileRequestContext.getOutboundMessageContext().setMessage(new JSONSuccessResponse(keySetJson));
+ }
+
+ /**
+ * Converts the given credentials into JWK and adds all the successfully converted JWKs to the given list.
+ *
+ * @param credentials The list of credentials to be converted to JWKs.
+ * @param publishList The list where the successfully converted JWKs are put.
+ */
+ protected void convertAndPublishToList(final List<Credential> credentials, final List<JWK> publishList) {
+ if (credentials != null) {
+ for (final Credential credential : credentials) {
+ final JWK jwk = CredentialConversionUtil.credentialToKey(credential);
+ if (jwk != null) {
+ publishList.add(jwk);
+ }
+ }
+ }
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list