[java-oidc-common] 10/28: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=2caf5a3bf810c5155c289e29c9e87fb78f54e48c

commit 2caf5a3bf810c5155c289e29c9e87fb78f54e48c
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jul 6 10:52:00 2022 +0100

    JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
    
     - Improve RequestObject signing config
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-41
---
 .../config/OIDCAuthorizationConfiguration.java     | 25 ++++++++++++++++++
 .../profile/core/OIDCAuthenticationRequest.java    | 30 ++++++++++++++++++++++
 .../encoder/impl/HTTPPostAuthnRequestEncoder.java  |  5 +++-
 3 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 615e3a0..4d5fdd7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -71,6 +71,9 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
     /** Whether to encode authentication request parameters inside a JWT request object .*/
     @Nonnull private Predicate<ProfileRequestContext> useRequestObjectPredicate;
 
+    /** Predicate used to determine if the generated request object should be signed. Default returns true. */
+    @Nonnull private Predicate<ProfileRequestContext> signRequestObjectPredicate;
+
     /** Lookup function to supply attribute IDs to omit from UserInfo token. */
     @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
 
@@ -152,6 +155,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
         acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
         encodeConsentInTokensPredicate = Predicates.alwaysFalse();
         useRequestObjectPredicate = Predicates.alwaysFalse();
+        signRequestObjectPredicate = Predicates.alwaysTrue();
         retrieveUserInfoEndpointClaims = Predicates.alwaysTrue();
 
         authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
@@ -171,6 +175,27 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
         authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
     }
 
+    /**
+     * Should the RequestObject (if configured) be signed?
+     *
+     * @param profileRequestContext the profile request context
+     *
+     * @return true iff the RequestObject should be signed, false otherwise.
+     */
+    public boolean isSignRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
+        return signRequestObjectPredicate.test(profileRequestContext);
+    }
+
+    /**
+     * Set whether the RequestObject should be signed.
+     *
+     * @param flag flag to set
+     */
+    public void setSignRequestObject(final boolean flag) {
+        signRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+    }
+
+
     /**
      * Set the strategy to locate a client_id.
      *
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
index 816c008..21e7f59 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
 
 import com.nimbusds.jwt.JWT;
 import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
 
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 
@@ -39,6 +40,12 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
     /** The request object. Optional. */
     @Nullable private JWT requestObject;
     
+    /** 
+     * The claims used to build a request object JWT. Is temporary in nature, once the requestObject is
+     * built these should be blanked or not used.
+     */
+    @Nullable private ClaimsSet requestObjectClaimsSet;
+    
     /** The request URI. Optional. */
     @Nullable private URI requestURI;
     
@@ -53,6 +60,29 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
         // Must contain the openid scope. 
         getScope().add(DEFAULT_OPENID_SCOPE);
     }
+    
+    /**
+     * Set the request object claims set.
+     * 
+     * @param claims the claims
+     */
+    public void setRequestObjectClaimsSet(@Nullable final ClaimsSet claims) {
+        requestObjectClaimsSet = claims;
+    }
+    
+    /**
+     * Get the request object claims set. If the requestObject JWT has already
+     * been built, {@literal null} is returned to indicate these claims are 
+     * no longer 'live' and will not be reused. 
+     * 
+     * @return the request object claims
+     */
+    @Nullable public ClaimsSet getRequestObjectClaimsSet() {
+        if (requestObject == null) {
+            return requestObjectClaimsSet;
+        }
+        return null;
+    }
 
 
     /**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java
index 409d53f..e639e05 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoder/impl/HTTPPostAuthnRequestEncoder.java
@@ -99,8 +99,11 @@ public class HTTPPostAuthnRequestEncoder extends AbstractOIDCMessageEncoder {
      * 
      * @param request the authentication request.
      * @return response message as velocity context.
+     * 
+     * @throws MessageEncodingException on error building the parameters
      */
-    private VelocityContext doPostEncode(@Nonnull final OIDCAuthenticationRequest request) {
+    private VelocityContext doPostEncode(@Nonnull final OIDCAuthenticationRequest request) 
+                                                                throws MessageEncodingException {
         final VelocityContext context = new VelocityContext();
         final List<Pair<String, String>> params = createParametersFromRequest(request);
         params.forEach(param -> context.put(param.getFirst(), param.getSecond()));

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.