[java-idp-plugin-oidc-rp] branch main updated: Add authenticatable abstract context to back-channel token endpoints
Phil Smart
philip.smart at jisc.ac.uk
Tue Nov 29 15:42:13 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=5399d7f469116aaac5c49129af07e283165da99c
The following commit(s) were added to refs/heads/main by this push:
new 5399d7f Add authenticatable abstract context to back-channel token endpoints
5399d7f is described below
commit 5399d7f469116aaac5c49129af07e283165da99c
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Nov 29 15:42:07 2022 +0000
Add authenticatable abstract context to back-channel token endpoints
---
...ava => AbstractAuthenticatableOIDCContext.java} | 36 ++++++++++------------
.../rp/context/AccessTokenResponseContext.java | 4 +--
.../oidc/rp/context/UserInfoResponseContext.java | 4 +--
.../logic/UserInfoPlainResponseTypeCondition.java | 2 +-
.../impl/AbstractHttpOIDCAuthenticationAction.java | 18 ++++++++---
.../oidc/rp/impl/ExchangeCodeForAccessToken.java | 2 +-
.../authn/oidc/rp/impl/UserInfoEndpointLookup.java | 2 +-
7 files changed, 36 insertions(+), 32 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/UserInfoResponseContext.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AbstractAuthenticatableOIDCContext.java
similarity index 54%
copy from idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/UserInfoResponseContext.java
copy to idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AbstractAuthenticatableOIDCContext.java
index 8d4fa34..4e95c02 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/UserInfoResponseContext.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AbstractAuthenticatableOIDCContext.java
@@ -17,35 +17,33 @@
package net.shibboleth.idp.plugin.authn.oidc.rp.context;
-import javax.annotation.Nullable;
-
import org.opensaml.messaging.context.BaseContext;
-import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.UserInfoResponse;
-
-
-/** A context to hold the response from the UserInfo endpoint.*/
-public class UserInfoResponseContext extends BaseContext {
-
- /** The UserInfo response.*/
- @Nullable private UserInfoResponse userInfo;
+/**
+ * An abstract base class for subcontexts that carry information which may be authenticated. For example,
+ * tokens received over TLS where server TLS credential validation was performed and successful.
+ */
+public class AbstractAuthenticatableOIDCContext extends BaseContext {
+ /** Flag indicating whether the information contained in this context has been authenticated. */
+ private boolean authenticated;
+
/**
- * Get the user info response.
+ * Gets the flag indicating whether the information contained in this context has been authenticated.
*
- * @return the user info.
+ * @return Returns the authenticated flag.
*/
- @Nullable public UserInfoResponse getUserInfo() {
- return userInfo;
+ public boolean isAuthenticated() {
+ return authenticated;
}
-
+
/**
- * Set the user info response.
+ * Sets the flag indicating whether the information contained in this context has been authenticated.
*
- * @param info the user info response.
+ * @param flag The flag to set.
*/
- public void setUserInfo(@Nullable final UserInfoResponse info) {
- userInfo = info;
+ public void setAuthenticated(final boolean flag) {
+ authenticated = flag;
}
}
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AccessTokenResponseContext.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AccessTokenResponseContext.java
index b8a16a9..4f7956a 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AccessTokenResponseContext.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/AccessTokenResponseContext.java
@@ -21,12 +21,10 @@ import java.util.Map;
import javax.annotation.Nullable;
-import org.opensaml.messaging.context.BaseContext;
-
import com.nimbusds.jwt.JWT;
/** A context to hold an OIDC token request response.*/
-public class AccessTokenResponseContext extends BaseContext {
+public class AccessTokenResponseContext extends AbstractAuthenticatableOIDCContext {
/** The raw token response as a map.*/
@Nullable private Map<String, Object> rawTokenResponse;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/UserInfoResponseContext.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/UserInfoResponseContext.java
index 8d4fa34..e218580 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/UserInfoResponseContext.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/UserInfoResponseContext.java
@@ -19,13 +19,11 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.context;
import javax.annotation.Nullable;
-import org.opensaml.messaging.context.BaseContext;
-
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.UserInfoResponse;
/** A context to hold the response from the UserInfo endpoint.*/
-public class UserInfoResponseContext extends BaseContext {
+public class UserInfoResponseContext extends AbstractAuthenticatableOIDCContext {
/** The UserInfo response.*/
@Nullable private UserInfoResponse userInfo;
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java
index fb3b7ea..1c41d3c 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/context/logic/UserInfoPlainResponseTypeCondition.java
@@ -25,7 +25,7 @@ import net.shibboleth.idp.plugin.authn.oidc.rp.context.UserInfoResponseContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.messaging.UserInfoResponse.UserInfoResponseType;
/**
- * Condition that returns true if the UserInfo response was an plain JWT type i.e. not signed and or encrypted.
+ * Condition that returns true if the UserInfo response was an plain JSON type i.e. not a signed and or encrypted JWT.
*/
public class UserInfoPlainResponseTypeCondition extends AbstractUserInfoResponseTypeCondition {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
index d08f6ee..65fd057 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
@@ -34,6 +34,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.authn.oidc.rp.OIDCRPException;
+import net.shibboleth.idp.plugin.authn.oidc.rp.context.AbstractAuthenticatableOIDCContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -151,19 +152,21 @@ public abstract class AbstractHttpOIDCAuthenticationAction<T> extends AbstractOI
* and decode the response using the supplied decoder strategy.
*
* @param profileRequestContext the context to pull information out of for encoding the request.
+ * @param authenticatableContext an authenticatable context to set the authenticated flag. Can be {@literal null} if
+ * no flag is supplied.
*
* @return the decoded response.
*
* @throws OIDCRPException on error making the request.
*/
- @Nonnull protected T handleRequest(
- @Nonnull final ProfileRequestContext profileRequestContext) throws OIDCRPException {
+ @Nonnull protected T handleRequest(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nullable final AbstractAuthenticatableOIDCContext authenticatableContext) throws OIDCRPException {
try {
final HttpUriRequest request = getHttpRequestEncoderStrategy().apply(profileRequestContext);
if (request == null) {
throw new OIDCRPException("Unable to encode HTTP request");
}
- final HttpResponse response = executeHttpRequest(request);
+ final HttpResponse response = executeHttpRequest(request, authenticatableContext);
final T responseObject = getHttpResponseDecoderStrategy().apply(response);
if (responseObject == null) {
throw new OIDCRPException(
@@ -181,12 +184,15 @@ public abstract class AbstractHttpOIDCAuthenticationAction<T> extends AbstractOI
* Performs a call to an HTTP endpoint using the configured HttpClient and security parameters.
*
* @param request the prepared HTTP request
+ * @param authenticatableContext an authenticatable context to set the authenticated flag. Can be {@literal null} if
+ * no flag is supplied.
*
* @return the HTTP response, never {@code null}.
*
* @throws IOException if there is an error producing a response
*/
- @Nonnull protected HttpResponse executeHttpRequest(@Nonnull final HttpUriRequest request) throws IOException {
+ @Nonnull protected HttpResponse executeHttpRequest(@Nonnull final HttpUriRequest request,
+ @Nullable final AbstractAuthenticatableOIDCContext authenticatableContext) throws IOException {
Constraint.isNotNull(request, "Request can not be null");
@@ -195,6 +201,10 @@ public abstract class AbstractHttpOIDCAuthenticationAction<T> extends AbstractOI
HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(clientContext, request);
final HttpResponse httpResponse = httpClient.execute(request, clientContext);
HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, request.getURI().getScheme());
+ // Will have thrown prior to this if TLS credential had not been evaluated.
+ if (authenticatableContext != null) {
+ authenticatableContext.setAuthenticated(true);
+ }
return httpResponse;
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessToken.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessToken.java
index 98c33ce..6859311 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessToken.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ExchangeCodeForAccessToken.java
@@ -96,7 +96,7 @@ public class ExchangeCodeForAccessToken extends AbstractHttpOIDCAuthenticationAc
}
try {
- final Map<String, Object> responseObject = handleRequest(profileRequestContext);
+ final Map<String, Object> responseObject = handleRequest(profileRequestContext, responseCtx);
responseCtx.setRawTokenResponse(responseObject);
log.trace("{}: Token request response '{}'",getLogPrefix(), responseObject);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java
index cd688a7..74a9cc4 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/UserInfoEndpointLookup.java
@@ -92,7 +92,7 @@ public class UserInfoEndpointLookup extends AbstractHttpOIDCAuthenticationAction
}
try {
- userInfoCtx.setUserInfo(handleRequest(profileRequestContext));
+ userInfoCtx.setUserInfo(handleRequest(profileRequestContext, userInfoCtx));
} catch (final OIDCRPException e) {
log.error("{} Unable to return claims from UserInfo endpoint",getLogPrefix(),e);
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list