[java-oidc-common] 11/28: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
Phil Smart
philip.smart at jisc.ac.uk
Wed Oct 5 10:34:42 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=9ad1c336ecab80c1673bc812e4cafa3f12f0f26b
commit 9ad1c336ecab80c1673bc812e4cafa3f12f0f26b
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Jul 14 11:11:39 2022 +0100
JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
- Change JWT credential resolvers to JOSEObjectCredentialResolver types
- Reposition credential resolvers under BasicJOSEObjectCredentialResolver
- Add additional key criteria to the criteria set for credential resolvers
- Added KeyAlgorithmCriterion, KeyLengthCriterion, JOSEObjectCriterion,
and EvaluableKeyIDCredentialCriterion to the resolver criteria set.
- Remove key usage check from criterion credential resolver
This is covered by the UsageCredentialCriterion passed into the
resolvers
https://shibboleth.atlassian.net/browse/JCOMOIDC-41
---
.../oidc/security/DecryptionConfiguration.java | 7 +-
.../oidc/security/JWTDecryptionParameters.java | 9 +-
.../context/JWTSecurityParametersContext.java | 39 +++++-
oidc-common-crypto-impl/pom.xml | 4 +-
.../impl/BasicJOSEObjectCredentialResolver.java | 20 ++-
.../impl/ChainingJOSEObjectCredentialResolver.java | 39 +++---
.../impl/CriterionCredentialResolver.java | 61 +++++++++
.../impl/ProviderMetadataCredentialResolver.java | 5 +-
.../impl/BasicJWTDecryptionConfiguration.java | 14 +-
.../security/impl/CriterionCredentialResolver.java | 107 ---------------
.../DefaultJWTDecryptionParametersResolver.java | 6 +-
.../oidc/security/impl/JWTDecrypter.java | 145 +++++++++++++++++++--
...pulateJWTSignatureSigningParametersHandler.java | 17 +++
.../PopulateJWTSignatureValidationParameters.java | 12 +-
...ateJWTSignatureValidationParametersHandler.java | 11 +-
.../oidc/security/impl/JWTDecrypterTest.java | 15 ++-
.../config/OIDCAuthorizationConfiguration.java | 52 +++++++-
17 files changed, 360 insertions(+), 203 deletions(-)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
index 0fbf4e7..eb4b62b 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
@@ -19,9 +19,10 @@ package net.shibboleth.oidc.security;
import javax.annotation.Nullable;
-import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
+
public interface DecryptionConfiguration extends AlgorithmPolicyConfiguration {
/**
@@ -29,7 +30,7 @@ public interface DecryptionConfiguration extends AlgorithmPolicyConfiguration {
*
* @return the KeyInfoCredentialResolver instance
*/
- @Nullable CredentialResolver getContentEncryptionKeyCredentialResolver();
+ @Nullable JOSEObjectCredentialResolver getContentEncryptionKeyCredentialResolver();
/**
* Get the CredentialResolver to use when processing the EncryptedKey (the
@@ -37,5 +38,5 @@ public interface DecryptionConfiguration extends AlgorithmPolicyConfiguration {
*
* @return the CredentialResolver instance
*/
- @Nullable CredentialResolver getKEKCredentialResolver();
+ @Nullable JOSEObjectCredentialResolver getKEKCredentialResolver();
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
index 53004be..6b8d2e6 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
@@ -23,6 +23,7 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.xmlsec.AlgorithmPolicyParameters;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
/**
@@ -31,10 +32,10 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
/** The encrypted content encrypted key's (CEK) credential resolver. */
- @Nullable private CredentialResolver kekKeyCredentialResolver;
+ @Nullable private JOSEObjectCredentialResolver kekKeyCredentialResolver;
/** The content encryption key (CEK) resolver.*/
- @Nullable private CredentialResolver contentEncryptionKeyCredentialResolver;
+ @Nullable private JOSEObjectCredentialResolver contentEncryptionKeyCredentialResolver;
/** Carries additional criterion made available to the resolvers at runtime.*/
@Nonnull final CriteriaSet additionalCriteria;
@@ -66,7 +67,7 @@ public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
*
* @param resolver the CredentialResolver instance
*/
- public void setContentEncryptionKeyCredentialResolver(@Nullable final CredentialResolver resolver) {
+ public void setContentEncryptionKeyCredentialResolver(@Nullable final JOSEObjectCredentialResolver resolver) {
contentEncryptionKeyCredentialResolver = resolver;
}
@@ -86,7 +87,7 @@ public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
*
* @param resolver the CredentialResolver instance
*/
- public void setKEKCredentialResolver(@Nullable final CredentialResolver resolver) {
+ public void setKEKCredentialResolver(@Nullable final JOSEObjectCredentialResolver resolver) {
kekKeyCredentialResolver = resolver;
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
index 08892ee..1dfa595 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
@@ -21,6 +21,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.xmlsec.EncryptionParameters;
import org.opensaml.xmlsec.SignatureSigningParameters;
import com.nimbusds.jwt.SignedJWT;
@@ -32,7 +33,7 @@ import net.shibboleth.oidc.security.SignatureValidationParameters;
* A context implementation for storing parameter instances for JWT signature signing and validation, and JWT
* encryption and decryption.
*/
-public class JWTSecurityParametersContext extends BaseContext {
+public final class JWTSecurityParametersContext extends BaseContext {
/** Signature validation parameters. */
@Nullable private SignatureValidationParameters<SignedJWT> signatureValidationParameters;
@@ -42,9 +43,12 @@ public class JWTSecurityParametersContext extends BaseContext {
/** Decryption parameters. */
@Nullable private JWTDecryptionParameters decryptionParameters;
+
+ /** Encryption parameters.*/
+ @Nullable private EncryptionParameters encryptionParameters;
/**
- * Get the parameters to use for XML signature validation operations.
+ * Get the parameters to use for signature validation operations.
*
* @return the parameters
*/
@@ -53,7 +57,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Set the parameters to use for XML signature validation operations.
+ * Set the parameters to use for signature validation operations.
*
* @param params The signatureValidationParameters to set
*
@@ -66,7 +70,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Get the parameters to use for XML signature signing operations.
+ * Get the parameters to use for signature signing operations.
*
* @return the parameters
*/
@@ -75,7 +79,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Set the parameters to use for XML signature signing operations.
+ * Set the parameters to use for signature signing operations.
*
* @param params the parameters
*
@@ -88,7 +92,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Get the parameters to use for XML decryption operations.
+ * Get the parameters to use for decryption operations.
*
* @return the parameters
*/
@@ -97,7 +101,7 @@ public class JWTSecurityParametersContext extends BaseContext {
}
/**
- * Set the parameters to use for XML decryption operations.
+ * Set the parameters to use for decryption operations.
*
* @param params the parameters
*
@@ -107,5 +111,26 @@ public class JWTSecurityParametersContext extends BaseContext {
decryptionParameters = params;
return this;
}
+
+ /**
+ * Set the parameters to use for encryption operations.
+ *
+ * @param params the parameters
+ *
+ * @return this context
+ */
+ public JWTSecurityParametersContext setEncryptionParameters(@Nullable final EncryptionParameters params) {
+ encryptionParameters = params;
+ return this;
+ }
+
+ /**
+ * Get the parameters to use for encryption operations.
+ *
+ * @return the parameters
+ */
+ @Nullable public EncryptionParameters getEncryptionParameters() {
+ return encryptionParameters;
+ }
}
diff --git a/oidc-common-crypto-impl/pom.xml b/oidc-common-crypto-impl/pom.xml
index f88d431..0c2ae52 100644
--- a/oidc-common-crypto-impl/pom.xml
+++ b/oidc-common-crypto-impl/pom.xml
@@ -20,11 +20,11 @@
<dependencies>
<!-- Do we need this? should not!! -->
- <dependency>
+ <!-- <dependency>
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-xmlsec-impl</artifactId>
<scope>provided</scope>
- </dependency>
+ </dependency> -->
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
index c3690c4..f9a13d9 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
@@ -7,6 +7,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -31,24 +32,18 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
* A basic implementation of {@link JOSEObjectCredentialResolver}.
*
*/
-public class BasicJOSEObjectCredentialResolver implements JOSEObjectCredentialResolver {
- // TODO support auto-magical filtering ala OpenSAML AbstractCriteriaFilteringCredentialResolver?
- // It's impl, so would have to copy or refactor to common library or promote to API.
+public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
+ implements JOSEObjectCredentialResolver {
+ // TODO AbstractCriteriaFilteringCredentialResolver It's impl, so would have to copy or refactor to
+ // common library or promote to API.
/** Logger. */
private final Logger log = LoggerFactory.getLogger(BasicJOSEObjectCredentialResolver.class);
- /** {@inheritDoc} */
- @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
- final Iterable<Credential> creds = resolve(criteriaSet);
- if (creds.iterator().hasNext()) {
- return creds.iterator().next();
- }
- return null;
- }
@Override
- @Nonnull @NonnullElements public Iterable<Credential> resolve(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
+ @Nonnull @NonnullElements protected Iterable<Credential> resolveFromSource(
+ @Nullable final CriteriaSet criteriaSet) throws ResolverException {
JOSEObjectCriterion joseObjectCriteria = null;
if (criteriaSet != null) {
joseObjectCriteria = criteriaSet.get(JOSEObjectCriterion.class);
@@ -146,5 +141,6 @@ public class BasicJOSEObjectCredentialResolver implements JOSEObjectCredentialRe
}
return credential;
}
+
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ChainingJOSEObjectCredentialResolver.java
similarity index 50%
copy from oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
copy to oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ChainingJOSEObjectCredentialResolver.java
index 0fbf4e7..aabf703 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ChainingJOSEObjectCredentialResolver.java
@@ -15,27 +15,30 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.security;
+package net.shibboleth.oidc.security.credential.impl;
-import javax.annotation.Nullable;
+import java.util.List;
-import org.opensaml.security.credential.CredentialResolver;
-import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.credential.impl.AbstractChainingCredentialResolver;
+
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
+
+/**
+ * A concrete implementation of {@link AbstractChainingCredentialResolver} which is scoped to
+ * the simple {@link JOSEObjectCredentialResolver} type.
+ */
+public class ChainingJOSEObjectCredentialResolver extends AbstractChainingCredentialResolver<JOSEObjectCredentialResolver>
+ implements JOSEObjectCredentialResolver {
-public interface DecryptionConfiguration extends AlgorithmPolicyConfiguration {
-
- /**
- * Get the CredentialResolver to use when processing the encrypted content.
- *
- * @return the KeyInfoCredentialResolver instance
- */
- @Nullable CredentialResolver getContentEncryptionKeyCredentialResolver();
-
/**
- * Get the CredentialResolver to use when processing the EncryptedKey (the
- * Key Encryption Key or KEK).
- *
- * @return the CredentialResolver instance
+ * Constructor.
+ *
+ * @param resolverChain the credential resolver chain
*/
- @Nullable CredentialResolver getKEKCredentialResolver();
+ public ChainingJOSEObjectCredentialResolver(@Nonnull final List<JOSEObjectCredentialResolver> resolverChain) {
+ super(resolverChain);
+ }
+
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
new file mode 100644
index 0000000..35229ce
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential.impl;
+
+import java.util.Collections;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.credential.Credential;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * Extracts the credential from the {@link StaticCredentialCriterion} inside the given criteria set,
+ * inspects its suitability and passes it back.
+ */
+//TODO Docs
+//TODO Algorithm filters?
+public class CriterionCredentialResolver extends BasicJOSEObjectCredentialResolver {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(CriterionCredentialResolver.class);
+
+ @Override
+ protected Iterable<Credential> resolveFromSource(@Nonnull final CriteriaSet criteriaSet) throws ResolverException {
+ Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
+
+ if (criteriaSet.contains(StaticCredentialCriterion.class)) {
+ final StaticCredentialCriterion credentialCriterion = criteriaSet.get(StaticCredentialCriterion.class);
+ final Credential credential = credentialCriterion.getCredential();
+ log.debug("Extracted key '{}', from criterion", credential.getKeyNames());
+ return List.of(credential);
+
+ } else {
+ log.trace("Criteria did not contain a StaticCredentialCriterion");
+ return Collections.emptyList();
+ }
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
similarity index 97%
rename from oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java
rename to oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
index 9da94c1..ec50a34 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.security.impl;
+package net.shibboleth.oidc.security.credential.impl;
import java.time.Duration;
import java.time.Instant;
@@ -43,6 +43,7 @@ import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
@@ -56,7 +57,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
//TODO Docs
//TODO Algorithm filters?
-public class ProviderMetadataCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
+public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentialResolver
implements InitializableComponent {
/** Class logger. */
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java
index 7d414fc..7fce719 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java
@@ -19,10 +19,10 @@ package net.shibboleth.oidc.security.impl;
import javax.annotation.Nullable;
-import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.xmlsec.impl.BasicAlgorithmPolicyConfiguration;
import net.shibboleth.oidc.security.DecryptionConfiguration;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
/**
* Basic implementation of {@link DecryptionConfiguration} for handling JWEs.
@@ -31,13 +31,13 @@ public class BasicJWTDecryptionConfiguration
extends BasicAlgorithmPolicyConfiguration implements DecryptionConfiguration {
/** The EncryptedKey's credential resolver. */
- @Nullable private CredentialResolver kekKeyCredentialResolver;
+ @Nullable private JOSEObjectCredentialResolver kekKeyCredentialResolver;
/** The content encryption key (CEK) resolver.*/
- @Nullable private CredentialResolver contentEncryptionKeyCredentialResolver;
+ @Nullable private JOSEObjectCredentialResolver contentEncryptionKeyCredentialResolver;
@Override
- @Nullable public CredentialResolver getContentEncryptionKeyCredentialResolver() {
+ @Nullable public JOSEObjectCredentialResolver getContentEncryptionKeyCredentialResolver() {
return contentEncryptionKeyCredentialResolver;
}
@@ -46,12 +46,12 @@ public class BasicJWTDecryptionConfiguration
*
* @param resolver the CredentialResolver instance
*/
- public void setContentEncryptionKeyCredentialResolver(@Nullable final CredentialResolver resolver) {
+ public void setContentEncryptionKeyCredentialResolver(@Nullable final JOSEObjectCredentialResolver resolver) {
contentEncryptionKeyCredentialResolver = resolver;
}
@Override
- @Nullable public CredentialResolver getKEKCredentialResolver() {
+ @Nullable public JOSEObjectCredentialResolver getKEKCredentialResolver() {
return kekKeyCredentialResolver;
}
@@ -61,7 +61,7 @@ public class BasicJWTDecryptionConfiguration
*
* @param resolver the CredentialResolver instance
*/
- public void setKEKCredentialResolver(@Nullable final CredentialResolver resolver) {
+ public void setKEKCredentialResolver(@Nullable final JOSEObjectCredentialResolver resolver) {
kekKeyCredentialResolver = resolver;
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CriterionCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CriterionCredentialResolver.java
deleted file mode 100644
index 4d93160..0000000
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CriterionCredentialResolver.java
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.oidc.security.impl;
-
-import java.util.Collections;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
-import org.opensaml.security.criteria.KeyAlgorithmCriterion;
-import org.opensaml.security.criteria.UsageCriterion;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-/**
- * Extracts the credential from the {@link StaticCredentialCriterion} inside the given criteria set,
- * inspects its suitability and passes it back.
- */
-//TODO Docs
-//TODO Algorithm filters?
-public class CriterionCredentialResolver extends AbstractCriteriaFilteringCredentialResolver {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(CriterionCredentialResolver.class);
-
- @Override
- protected Iterable<Credential> resolveFromSource(@Nonnull final CriteriaSet criteriaSet) throws ResolverException {
- Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
-
- final UsageType usage = getEffectiveUsageInput(criteriaSet);
-
- if (criteriaSet.contains(StaticCredentialCriterion.class)) {
- final StaticCredentialCriterion credentialCriterion = criteriaSet.get(StaticCredentialCriterion.class);
- final Credential credential = credentialCriterion.getCredential();
- if (matchUsage(credential.getUsageType(), usage)) {
-
- final KeyAlgorithmCriterion keyAlg = criteriaSet.get(KeyAlgorithmCriterion.class);
-
- log.debug("Selected key '{}', for usage '{}', matched to alg '{}'",
- credential.getKeyNames(),usage, keyAlg);
- return List.of(credential);
- } else {
- log.warn("Usage type of credential from criteria did not match the effective usage input");
- return Collections.emptyList();
- }
- } else {
- log.warn("Criteria did not contain a StaticCredentialCriterion "
- + "could not perform resolution");
- return Collections.emptyList();
- }
- }
-
-
- /**
- * Match usage enum type values from credential in the criteria set to the usage in the criteria.
- *
- * @param credentialUsage the value from the credential in the criteria set
- * @param criteriaUsage the value from credential criteria
- * @return true if the two usage specifiers match for purposes of resolving credentials, false otherwise
- */
- protected boolean matchUsage(@Nonnull final UsageType credentialUsage, @Nonnull final UsageType criteriaUsage) {
- if (credentialUsage == UsageType.UNSPECIFIED || criteriaUsage == UsageType.UNSPECIFIED) {
- return true;
- }
- return credentialUsage == criteriaUsage;
- }
-
- /**
- * Get the effective {@link UsageType} input to use.
- *
- * @param criteriaSet the criteria set being processed
- * @return the effective usage value
- */
- @Nonnull protected UsageType getEffectiveUsageInput(@Nonnull final CriteriaSet criteriaSet) {
- final UsageCriterion usageCriteria = criteriaSet.get(UsageCriterion.class);
- if (usageCriteria != null) {
- return usageCriteria.getUsage();
- }
- return UsageType.UNSPECIFIED;
- }
-
-
-
-}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
index 5022b9d..6217bd0 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
@@ -13,6 +13,7 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.security.DecryptionConfiguration;
import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.JWTDecryptionParametersResolver;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.criterion.DecryptionConfigurationCriterion;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -46,6 +47,7 @@ public class DefaultJWTDecryptionParametersResolver extends AbstractSecurityPara
params.setContentEncryptionKeyCredentialResolver(resolveContentEncryptionKeyCredentialResolver(criteria));
params.setKEKCredentialResolver(resolveKEKCredentialResolver(criteria));
+ //TODO why not this?
//params.setEncryptedKeyResolver(resolveEncryptedKeyResolver(criteria));
// Add all the runtime criteria into the parameters for later use by the resolvers.
@@ -63,7 +65,7 @@ public class DefaultJWTDecryptionParametersResolver extends AbstractSecurityPara
* @param criteria the input criteria being evaluated
* @return the effective resolver, or null
*/
- @Nullable protected CredentialResolver resolveKEKCredentialResolver(
+ @Nullable protected JOSEObjectCredentialResolver resolveKEKCredentialResolver(
@Nonnull final CriteriaSet criteria) {
for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
@@ -82,7 +84,7 @@ public class DefaultJWTDecryptionParametersResolver extends AbstractSecurityPara
* @param criteria the input criteria being evaluated
* @return the effective resolver, or null
*/
- @Nullable protected CredentialResolver resolveContentEncryptionKeyCredentialResolver(
+ @Nullable protected JOSEObjectCredentialResolver resolveContentEncryptionKeyCredentialResolver(
@Nonnull final CriteriaSet criteria) {
for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
index 853a016..ddee296 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
@@ -19,15 +19,20 @@ package net.shibboleth.oidc.security.impl;
import java.security.interfaces.ECPrivateKey;
import java.text.ParseException;
+import java.util.HashSet;
import java.util.List;
+import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.KeyAlgorithmCriterion;
+import org.opensaml.security.criteria.KeyLengthCriterion;
import org.opensaml.security.criteria.UsageCriterion;
import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
+import org.opensaml.xmlsec.encryption.EncryptedType;
import org.opensaml.xmlsec.encryption.support.DecryptionException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -48,8 +53,10 @@ import org.slf4j.LoggerFactory;
* limitations under the License.
*/
+import com.google.common.base.Strings;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JOSEException;
+import com.nimbusds.jose.JOSEObject;
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWEDecrypter;
import com.nimbusds.jose.JWEObject.State;
@@ -63,8 +70,11 @@ import com.nimbusds.jwt.JWTParser;
import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.credential.JWKCredential;
+import net.shibboleth.oidc.security.credential.impl.EvaluableKeyIDCredentialCriterion;
import net.shibboleth.oidc.security.credential.impl.JWKEncryptionCredentialContext;
+import net.shibboleth.oidc.security.criterion.JOSEObjectCriterion;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.Criterion;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -72,7 +82,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
* Supports decryption of encrypted JSON Web Tokens using the JSON Web Encryption standard.
* The {@link EncryptedJWT} will be decrypted in-place, with its {@link State} changing to {@link State#DECRYPTED}
- * on successful decryption. Any error will throw a {@link DecryptionException}.
+ * on successful decryption. Any error that occurs decrypting the JWT will throw an {@link DecryptionException}.
*
* <p>A decrypter should be created for each new decryption operation.</p>
*/
@@ -106,6 +116,11 @@ public class JWTDecrypter {
*/
@Nonnull public JWT decrypt(@Nonnull final EncryptedJWT encryptedObject) throws DecryptionException {
+ if (encryptedObject.getHeader() == null) {
+ // Not sure it should ever get here, but just in-case
+ throw new DecryptionException("JWT headers are not available, decryption failed");
+ }
+
final JWEAlgorithm jwtAlg = encryptedObject.getHeader().getAlgorithm();
// Direct Encryption
@@ -143,21 +158,123 @@ public class JWTDecrypter {
}
/**
- * Build a criteria set using the additional criteria in the params and those supplied.
+ * Build a criteria set using the additional criteria in the params, those supplied, and those
+ * that can be extracted from the encrypted JWT headers.
*
+ * @param encryptedObject the encrypted JWT to build criterion from
* @param criteria criteria supplied, can be {@literal null}.
*
* @return the build criteria set.
*/
- private CriteriaSet buildCriteria(@Nullable final List<Criterion> criteria) {
- final CriteriaSet crit = new CriteriaSet();
+ private CriteriaSet buildCriteria(@Nonnull final EncryptedJWT encryptedObject,
+ @Nullable final List<Criterion> criteria) {
+ final CriteriaSet newCriteriaSet = new CriteriaSet();
+
+ // Add any additional criteria that have been passed through from the params.
if (params.getAdditionalCriteria() != null) {
- params.getAdditionalCriteria().forEach(c -> crit.add(c));
+ params.getAdditionalCriteria().forEach(newCriteriaSet::add);
}
if (criteria != null) {
- criteria.forEach(c -> crit.add(c));
+ criteria.forEach(newCriteriaSet::add);
+ }
+
+ // Add the entire object so the resolver can access it
+ newCriteriaSet.add(new JOSEObjectCriterion(encryptedObject));
+
+ final Set<Criterion> keyCriteria = buildKeyCriteria(encryptedObject);
+ if (keyCriteria != null && !keyCriteria.isEmpty()) {
+ newCriteriaSet.addAll(keyCriteria);
+ }
+
+ return newCriteriaSet;
+ }
+
+ /**
+ * Build decryption key credential criteria according to information in the encrypted object.
+ *
+ * @param encryptedObject the encrypted JWT from which to deduce decryption key criteria
+ * @return a set of credential criteria pertaining to the decryption key
+ */
+ @Nullable private Set<Criterion> buildKeyCriteria(@Nonnull final EncryptedJWT encryptedObject) {
+ final EncryptionMethod encMethod = encryptedObject.getHeader().getEncryptionMethod();
+ if (encMethod == null) {
+ // This element is optional
+ return null;
+ }
+ final String encAlgorithmURI = StringSupport.trimOrNull(encMethod.getName());
+ if (encAlgorithmURI == null) {
+ return null;
+ }
+
+ final Set<Criterion> critSet = new HashSet<>(2);
+
+ final KeyAlgorithmCriterion algoCrit = buildKeyAlgorithmCriteria(encAlgorithmURI);
+ if (algoCrit != null) {
+ critSet.add(algoCrit);
+ log.debug("Added decryption key algorithm criteria: {}", algoCrit.getKeyAlgorithm());
+ }
+
+ KeyLengthCriterion lengthCrit = buildKeyLengthCriteria(encAlgorithmURI);
+ if (lengthCrit != null) {
+ critSet.add(lengthCrit);
+ log.debug("Added decryption key length criteria from EncryptionMethod algorithm URI: {}", lengthCrit
+ .getKeyLength());
+ } else {
+ if (encMethod.cekBitLength() != 0) {
+ lengthCrit = new KeyLengthCriterion(encMethod.cekBitLength());
+ critSet.add(lengthCrit);
+ log.debug("Added decryption key length criteria from EncryptionMethod/KeySize: {}", lengthCrit
+ .getKeyLength());
+ }
}
- return crit;
+
+ // If 'kid' exists in the header, create an EvaluableKeyID criterion
+ if (encryptedObject.getHeader().getKeyID() != null) {
+ // FIXME: This is created directly as an EvaluableCriterion as I can not see a way to
+ // add to the default mappings in EvaluableCredentialCriteriaRegistry without overriding the opensaml
+ // version
+ critSet.add(new EvaluableKeyIDCredentialCriterion(encryptedObject.getHeader().getKeyID()));
+ }
+
+ return critSet;
+ }
+
+ /**
+ * Dynamically construct key algorithm credential criteria based on the specified algorithm URI.
+ *
+ * @param encAlgorithmURI the algorithm URI
+ * @return a new key algorithm credential criteria instance, or null if criteria could not be determined
+ */
+ @Nullable private KeyAlgorithmCriterion buildKeyAlgorithmCriteria(@Nullable final String encAlgorithmURI) {
+ if (Strings.isNullOrEmpty(encAlgorithmURI)) {
+ return null;
+ }
+
+ final String jcaKeyAlgorithm = AlgorithmSupport.getKeyAlgorithm(encAlgorithmURI);
+ if (!Strings.isNullOrEmpty(jcaKeyAlgorithm)) {
+ return new KeyAlgorithmCriterion(jcaKeyAlgorithm);
+ }
+
+ return null;
+ }
+
+ /**
+ * Dynamically construct key length credential criteria based on the specified algorithm URI.
+ *
+ * @param encAlgorithmURI the algorithm URI
+ * @return a new key length credential criteria instance, or null if the value could not be determined
+ */
+ @Nullable private KeyLengthCriterion buildKeyLengthCriteria(@Nullable final String encAlgorithmURI) {
+ if (Strings.isNullOrEmpty(encAlgorithmURI)) {
+ return null;
+ }
+
+ final Integer keyLength = AlgorithmSupport.getKeyLength(encAlgorithmURI);
+ if (keyLength != null) {
+ return new KeyLengthCriterion(keyLength);
+ }
+
+ return null;
}
/**
@@ -180,7 +297,8 @@ public class JWTDecrypter {
throw new DecryptionException("Decryption can not be attempted, KEK resolver is not available");
}
- final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ final CriteriaSet criteria =
+ buildCriteria(encryptedObject, List.of(new UsageCriterion(UsageType.ENCRYPTION)));
try {
for (final Credential cred : params.getKEKCredentialResolver().resolve(criteria)) {
@@ -225,7 +343,8 @@ public class JWTDecrypter {
throw new DecryptionException("Decryption can not be attempted, KEK resolver is not available");
}
- final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ final CriteriaSet criteria =
+ buildCriteria(encryptedObject, List.of(new UsageCriterion(UsageType.ENCRYPTION)));
try {
for (final Credential cred : params.getKEKCredentialResolver().resolve(criteria)) {
@@ -270,7 +389,8 @@ public class JWTDecrypter {
throw new DecryptionException("Decryption can not be attempted, KEK resolver is not available");
}
- final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ final CriteriaSet criteria =
+ buildCriteria(encryptedObject, List.of(new UsageCriterion(UsageType.ENCRYPTION)));
try {
for (final Credential cred : params.getKEKCredentialResolver().resolve(criteria)) {
@@ -316,7 +436,8 @@ public class JWTDecrypter {
throw new DecryptionException("Decryption can not be attempted, CEK resolver is not available");
}
- final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ final CriteriaSet criteria =
+ buildCriteria(encryptedObject, List.of(new UsageCriterion(UsageType.ENCRYPTION)));
try {
for (final Credential cred : params.getContentEncryptionKeyCredentialResolver().resolve(criteria)) {
@@ -338,7 +459,7 @@ public class JWTDecrypter {
} catch (final ResolverException e) {
log.warn("Unable to decrypt JWE using Direct Encryption", e);
}
- throw new DecryptionException("All attempts to decrypt the JWE using Direct Encryption have failed");
+ throw new DecryptionException("Failed to decrypt JWE, no suitable credential found");
}
/**
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java
index e3df9da..d09da47 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.impl;
import java.util.Collections;
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java
index dd4fa77..76266c6 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java
@@ -129,14 +129,10 @@ public class PopulateJWTSignatureValidationParameters
if (resolver == null) {
throw new ComponentInitializationException("SignatureValidationParametersResolver cannot be null");
}
-// else if (configurationLookupStrategy == null) {
-// configurationLookupStrategy = new Function<>() {
-// public List<SignatureValidationConfiguration<?>> apply(final ProfileRequestContext input) {
-// return Collections.singletonList(
-// SecurityConfigurationSupport.getGlobalSignatureValidationConfiguration());
-// }
-// };
-// }
+ if (configurationLookupStrategy == null) {
+ // Does not support a default config lookup like the SAML case
+ throw new ComponentInitializationException("ConfigurationLookupStrategy cannot be null");
+ }
final PopulateJWTSignatureValidationParametersHandler delegate = getDelegate();
delegate.setSignatureValidationParametersResolver(resolver);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java
index 7384ac9..17f6eee 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java
@@ -118,14 +118,9 @@ public class PopulateJWTSignatureValidationParametersHandler extends AbstractMes
if (resolver == null) {
throw new ComponentInitializationException("SignatureValidationParametersResolver cannot be null");
}
-// else if (configurationLookupStrategy == null) {
-// configurationLookupStrategy = new Function<>() {
-// public List<SignatureValidationConfiguration> apply(final MessageContext input) {
-// return Collections.singletonList(
-// SecurityConfigurationSupport.getGlobalSignatureValidationConfiguration());
-// }
-// };
-// }
+ if (configurationLookupStrategy == null) {
+ throw new ComponentInitializationException("ConfigurationLookupStrategy cannot be null");
+ }
}
/** {@inheritDoc} */
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
index 5c2159e..9a0240b 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTDecrypterTest.java
@@ -47,6 +47,7 @@ import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.impl.JWKEncryptionCredentialContext;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -107,7 +108,7 @@ public class JWTDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setKEKCredentialResolver(new CredentialResolver() {
+ params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -143,7 +144,7 @@ public class JWTDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setContentEncryptionKeyCredentialResolver(new CredentialResolver() {
+ params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -181,7 +182,7 @@ public class JWTDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setContentEncryptionKeyCredentialResolver(new CredentialResolver() {
+ params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -225,7 +226,7 @@ public class JWTDecrypterTest {
final var params = new JWTDecryptionParameters();
// Wrong credential type used here
- params.setContentEncryptionKeyCredentialResolver(new CredentialResolver() {
+ params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -263,7 +264,7 @@ public class JWTDecrypterTest {
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setKEKCredentialResolver(new CredentialResolver() {
+ params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -305,7 +306,7 @@ public class JWTDecrypterTest {
jweObject.encrypt(new RSAEncrypter((RSAPublicKey) key.toPublicKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setKEKCredentialResolver(new CredentialResolver() {
+ params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
@@ -350,7 +351,7 @@ public class JWTDecrypterTest {
jweObject.encrypt(new ECDHEncrypter(key.toECPublicKey()));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
final var params = new JWTDecryptionParameters();
- params.setKEKCredentialResolver(new CredentialResolver() {
+ params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
@Override
public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 4d5fdd7..e72eb31 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -74,6 +74,9 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
/** Predicate used to determine if the generated request object should be signed. Default returns true. */
@Nonnull private Predicate<ProfileRequestContext> signRequestObjectPredicate;
+ /** Predicate used to determine if the generated request object should be encrypted. Default returns false. */
+ @Nonnull private Predicate<ProfileRequestContext> encryptRequestObjectPredicate;
+
/** Lookup function to supply attribute IDs to omit from UserInfo token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
@@ -156,6 +159,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
encodeConsentInTokensPredicate = Predicates.alwaysFalse();
useRequestObjectPredicate = Predicates.alwaysFalse();
signRequestObjectPredicate = Predicates.alwaysTrue();
+ encryptRequestObjectPredicate = Predicates.alwaysFalse();
retrieveUserInfoEndpointClaims = Predicates.alwaysTrue();
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
@@ -195,6 +199,43 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
signRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
+ /**
+ * Set the predicate to determine if the RequestObject should be signed.
+ *
+ * @param condition the condition
+ */
+ public void setSignRequestObjectPredicate(final Predicate<ProfileRequestContext> condition) {
+ signRequestObjectPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Should the RequestObject (if configured) be encrypted?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return true iff the RequestObject should be encrypted, false otherwise.
+ */
+ public boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptRequestObjectPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether the RequestObject should be encrypted.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptRequestObject(final boolean flag) {
+ encryptRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set the predicate to determine if the RequestObject should be encrypted.
+ *
+ * @param condition the condition
+ */
+ public void setEncryptRequestObjectPredicate(final Predicate<ProfileRequestContext> condition) {
+ encryptRequestObjectPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
/**
* Set the strategy to locate a client_id.
@@ -319,7 +360,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
}
/**
- * Set the redirect_uri lookup strategy to use to locate an override redirect_rui.
+ * Set the redirect_uri lookup strategy used to locate an overridden redirect.
*
* @param strategy the strategy to use.
*/
@@ -333,9 +374,12 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @param uri the redirect_uri
*/
- public void setRedirectUriOverride(@Nonnull @NotEmpty final String uri) {
- redirectUriOverrideLookupStrategy = FunctionSupport.constant(
- Constraint.isNotNull(uri, "Redirect_uri can not be null or empty"));
+ public void setRedirectUriOverride(@Nullable final String uri) {
+ if (uri != null) {
+ redirectUriOverrideLookupStrategy = FunctionSupport.constant(uri);
+ } else {
+ redirectUriOverrideLookupStrategy= FunctionSupport.constant(null);
+ }
}
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list