[java-oidc-common] 20/28: JOIDCRP-19 - Add audit context actions and audit extractors where necessary
Phil Smart
philip.smart at jisc.ac.uk
Wed Oct 5 10:34:51 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=c6eacbb7ecabb0660f3e9bcbc6adb8a0628e7913
commit c6eacbb7ecabb0660f3e9bcbc6adb8a0628e7913
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Aug 30 15:34:58 2022 +0100
JOIDCRP-19 - Add audit context actions and audit extractors where necessary
- Add audit extractors for various requests/responses
https://shibboleth.atlassian.net/browse/JOIDCRP-19
---
oidc-common-profile-api/pom.xml | 5 +
.../shibboleth/oidc/profile/audit/AuditFields.java | 110 ++++++++++++++++
.../profile/core/OIDCAuthenticationRequest.java | 2 +-
...bstractAuthenticationRequestAuditExtractor.java | 42 ++++++
...stractAuthenticationResponseAuditExtractor.java | 61 +++++++++
.../impl/AbstractClaimsSetAuditExtractor.java | 143 +++++++++++++++++++++
...cationContextClassReferencesAuditExtractor.java | 60 +++++++++
...AuthenticationResponseStatusAuditExtractor.java | 61 +++++++++
.../impl/AuthorizationEndpointAuditExtractor.java | 54 ++++++++
.../audit/impl/ClaimSetFromJWTLookupStrategy.java | 74 +++++++++++
.../impl/DateBasedJWTClaimAuditExtractor.java | 74 +++++++++++
.../audit/impl/ForceAuthnAuditExtractor.java | 57 ++++++++
.../impl/InboundMessageClassLookupFunction.java | 48 +++++++
.../profile/audit/impl/NonceAuditExtractor.java | 53 ++++++++
.../audit/impl/RedirectURIAuditExtractor.java | 53 ++++++++
.../audit/impl/ResponseModeAuditExtractor.java | 54 ++++++++
.../audit/impl/ResponseTypeAuditExtractor.java | 54 ++++++++
.../profile/audit/impl/ScopeAuditExtractor.java | 53 ++++++++
.../impl/StringBasedJWTClaimAuditExtractor.java | 31 +++++
.../StringListBasedJWTClaimAuditExtractor.java | 32 +++++
20 files changed, 1120 insertions(+), 1 deletion(-)
diff --git a/oidc-common-profile-api/pom.xml b/oidc-common-profile-api/pom.xml
index 096b10b..faf2de1 100644
--- a/oidc-common-profile-api/pom.xml
+++ b/oidc-common-profile-api/pom.xml
@@ -33,6 +33,11 @@
<artifactId>idp-profile-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp</groupId>
+ <artifactId>idp-saml-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>net.shibboleth.idp</groupId>
<artifactId>idp-authn-api</artifactId>
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/audit/AuditFields.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/audit/AuditFields.java
new file mode 100644
index 0000000..909b476
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/audit/AuditFields.java
@@ -0,0 +1,110 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.idp.profile.IdPAuditFields;
+import net.shibboleth.idp.profile.context.AuditContext;
+import net.shibboleth.idp.saml.profile.SAMLAuditFields;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/** Constants to use for audit logging fields stored in an {@link AuditContext}. */
+public final class AuditFields {
+
+ /** OIDC client ID. */
+ @Nonnull @NotEmpty public static final String CLIENT_ID = SAMLAuditFields.SERVICE_PROVIDER;
+
+ /** OIDC proxy client ID. Which is the IdP itself.*/
+ @Nonnull @NotEmpty public static final String PROXY_CLIENT_ID = SAMLAuditFields.IDENTITY_PROVIDER;
+
+ /** OIDC issuer. */
+ @Nonnull @NotEmpty public static final String ISSUER = SAMLAuditFields.IDENTITY_PROVIDER;
+
+ /** OIDC proxy issuer. The downstream identity provider. */
+ @Nonnull @NotEmpty public static final String PROXY_ISSUER = SAMLAuditFields.SERVICE_PROVIDER;
+
+ /** The inbound (Nimbus) message class. */
+ @Nonnull @NotEmpty public static final String INBOUND_MESSAGE_CLASS = SAMLAuditFields.REQUEST_BINDING;
+
+ /** The outbound (Nimbus) message class. */
+ @Nonnull @NotEmpty public static final String OUTBOUND_MESSAGE_CLASS = SAMLAuditFields.RESPONSE_BINDING;
+
+ /** The authentication context reference value. */
+ @Nonnull @NotEmpty public static final String ACR = SAMLAuditFields.AUTHN_CONTEXT;
+
+ /** The subject value. */
+ @Nonnull @NotEmpty public static final String SUB_VALUE = SAMLAuditFields.NAMEID;
+
+ /** The subject format (public/pairwise). */
+ @Nonnull @NotEmpty public static final String SUB_FORMAT = SAMLAuditFields.NAMEID_FORMAT;
+
+ /** Token scope. */
+ @Nonnull @NotEmpty public static final String SCOPE = "scope";
+
+ /** Token audience. */
+ @Nonnull @NotEmpty public static final String AUDIENCE = "aud";
+
+ /** The flag whether the id_token is encrypted. */
+ @Nonnull @NotEmpty public static final String ENCRYPTED_ID_TOKEN = SAMLAuditFields.ENCRYPTION;
+
+ /** prompt=none requested field. */
+ @Nonnull @NotEmpty public static final String IS_PASSIVE = SAMLAuditFields.IS_PASSIVE;
+
+ /** prompt=login requested field. */
+ @Nonnull @NotEmpty public static final String FORCE_AUTHN = SAMLAuditFields.FORCE_AUTHN;
+
+ /** auth_time value. */
+ @Nonnull @NotEmpty public static final String AUTHN_INSTANT = SAMLAuditFields.AUTHN_INSTANT;
+
+ /** id_token issue instant. */
+ @Nonnull @NotEmpty public static final String ID_TOKEN_ISSUE_INSTANT = SAMLAuditFields.ASSERTION_ISSUE_INSTANT;
+
+ /** id_token nonce. */
+ @Nonnull @NotEmpty public static final String NONCE = SAMLAuditFields.RELAY_STATE;
+
+ /** Revoked Token. */
+ @Nonnull @NotEmpty public static final String REVOKED_TOKEN = "R";
+
+ /** The response_type of the authentication request.*/
+ @Nonnull @NotEmpty public static final String RESPONSE_TYPE = "RESPT";
+
+ /** The response_type of the authentication request.*/
+ @Nonnull @NotEmpty public static final String RESPONSE_MODE = "RESPM";
+
+ /** The authorization endpoint for the authentication request. Useful in the proxy case.*/
+ @Nonnull @NotEmpty public static final String AUTHORIZATION_ENDPOINT = IdPAuditFields.DESTINATION_URL;
+
+ /** The authorization endpoint for the authentication request. Useful in the proxy case.*/
+ @Nonnull @NotEmpty public static final String REDIRECT_URI = "RDURI";
+
+ /** The authentication context class references for the authentication request. Useful in the proxy case.*/
+ @Nonnull @NotEmpty public static final String ACRS = "ACRS";
+
+ /** The authentication response result, including any error code if there are any. Useful in the proxy case.*/
+ @Nonnull @NotEmpty public static final String AUTHENTICATION_RESULT = "AUTHZR";
+
+
+ /**
+ * Constructor.
+ */
+ private AuditFields() {
+ // no op
+ }
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
index 4287306..613e3bd 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -31,7 +31,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
* OpenID Connect Authentication Request. Extends the OAuth 2.0 authorization request.
- * <p> This class is mutable and not thread-safe.</p>
+ * <p> This class is mutable (unlike the Nimbus variant) and not thread-safe.</p>
*/
public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationRequestAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationRequestAuditExtractor.java
new file mode 100644
index 0000000..595797c
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationRequestAuditExtractor.java
@@ -0,0 +1,42 @@
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * A base class for audit extractors that lookup the {@link OIDCAuthenticationRequest}.
+ *
+ * @param <T> the extracted type
+ */
+public abstract class AbstractAuthenticationRequestAuditExtractor<T> implements Function<ProfileRequestContext, T>{
+
+ /** Lookup strategy to locate the authentication request. */
+ @Nonnull
+ private final Function<ProfileRequestContext, OIDCAuthenticationRequest> requestLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for locating the authentication request
+ */
+ protected AbstractAuthenticationRequestAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ requestLookupStrategy = Constraint.isNotNull(strategy, "AuthenticationRequest lookup strategy cannot be null");
+ }
+
+ /**
+ * Get the request lookup strategy.
+ *
+ * @return the request lookup strategy
+ */
+ protected Function<ProfileRequestContext, OIDCAuthenticationRequest> getRequestLookupStrategy() {
+ return requestLookupStrategy;
+ }
+
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationResponseAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationResponseAuditExtractor.java
new file mode 100644
index 0000000..a7cd4f1
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationResponseAuditExtractor.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.nimbusds.openid.connect.sdk.AuthenticationResponse;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * A base class for audit extractors that lookup the {@link AuthenticationResponse}.
+ *
+ * @param <T> the extracted type
+ */
+public abstract class AbstractAuthenticationResponseAuditExtractor<T> implements Function<ProfileRequestContext, T>{
+
+ /** Lookup strategy to locate the authentication response. */
+ @Nonnull
+ private final Function<ProfileRequestContext, AuthenticationResponse> responseLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for locating the authentication response
+ */
+ protected AbstractAuthenticationResponseAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext, AuthenticationResponse> strategy) {
+ responseLookupStrategy = Constraint.isNotNull(strategy, "AuthenticationResponse lookup strategy cannot be null");
+ }
+
+
+ /**
+ * Get the response lookup strategy.
+ *
+ * @return the request lookup strategy
+ */
+ protected Function<ProfileRequestContext, AuthenticationResponse> getResponseLookupStrategy() {
+ return responseLookupStrategy;
+ }
+
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractClaimsSetAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractClaimsSetAuditExtractor.java
new file mode 100644
index 0000000..b39bc63
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractClaimsSetAuditExtractor.java
@@ -0,0 +1,143 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.text.ParseException;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import javax.annotation.concurrent.GuardedBy;
+import javax.annotation.concurrent.ThreadSafe;
+
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * An abstract audit extractor function to extract claims from the located claims set.
+ *
+ * @param <T> the claim type to extract
+ */
+ at ThreadSafe
+public abstract class AbstractClaimsSetAuditExtractor<T> extends AbstractInitializableComponent
+ implements ContextDataLookupFunction<ProfileRequestContext, T> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractClaimsSetAuditExtractor.class);
+
+ /** The name of the claim to extract from the ID token.*/
+ @NonnullAfterInit @NotEmpty @GuardedBy("this") private String claimName;
+
+ /** Strategy to retrieve the JWT ClaimSet to extract the claim from. */
+ @NonnullAfterInit @GuardedBy("this") private Function<ProfileRequestContext, ClaimsSet> claimsSetLookupStrategy;
+
+
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (claimName == null) {
+ throw new ComponentInitializationException("Claim name can not be null");
+ }
+ if (claimsSetLookupStrategy == null) {
+ throw new ComponentInitializationException("jwtLookupStrategy can not be null");
+ }
+ }
+
+ /**
+ * Get the claim name to extract.
+ *
+ * @return the claim name.
+ */
+ protected synchronized String getClaimName() {
+ return claimName;
+ }
+
+ /**
+ * Set the claim whose value is to be extracted from the id_token claims set.
+ *
+ * @param claim the claim name
+ */
+ public synchronized void setClaimName(@Nonnull final String claim) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ claimName = Constraint.isNotNull(claim, "claimName can not be null");
+ }
+
+ /**
+ * Set the strategy used to lookup the {@link JWTClaimsSet} to look for the claim in
+ *
+ * @param strategy the strategy
+ */
+ public synchronized void setClaimsSetLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, ClaimsSet> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ claimsSetLookupStrategy = Constraint.isNotNull(strategy, "claimsSetLookupStrategy can not be null");
+ }
+
+ /**
+ * Get the claims set lookup strategy.
+ *
+ * @return the strategy
+ */
+ private synchronized Function<ProfileRequestContext, ClaimsSet> getClaimsSetLookupStrategy() {
+ return claimsSetLookupStrategy;
+ }
+
+ /**
+ * Implemented to perform the actual lookup.
+ *
+ * @param req authentication request to perform the lookup from.
+ *
+ * @return lookup value or {@code null} if not found
+ *
+ * @throws ParseException on error lookin up the claim
+ */
+ @Nullable protected abstract T doLookup(final @Nonnull ClaimsSet req) throws ParseException;
+
+ @Override
+ @Nullable public T apply(@Nullable final ProfileRequestContext input) {
+
+ final ClaimsSet claims = getClaimsSetLookupStrategy().apply(input);
+ if (claims != null) {
+ try {
+ return doLookup(claims);
+ } catch (final ParseException e) {
+ log.debug("Unable to extract claim '{}'",getClaimName(), e);
+ return null;
+ }
+ }
+ return null;
+ }
+
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthenticationContextClassReferencesAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthenticationContextClassReferencesAuditExtractor.java
new file mode 100644
index 0000000..5c4dd2f
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthenticationContextClassReferencesAuditExtractor.java
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.List;
+import java.util.Objects;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.nimbusds.openid.connect.sdk.claims.ACR;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/** {@link Function} that extracts the ACRs from the {@link OIDCAuthenticationRequest}. */
+public class AuthenticationContextClassReferencesAuditExtractor
+ extends AbstractAuthenticationRequestAuditExtractor<List<String>> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ public AuthenticationContextClassReferencesAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ super(strategy);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public List<String> apply(@Nullable final ProfileRequestContext input) {
+ final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
+ if (request != null && !request.getAcrs().isEmpty()) {
+ return request.getAcrs().stream().filter(Objects::nonNull).map(ACR::getValue).collect(Collectors.toList());
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthenticationResponseStatusAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthenticationResponseStatusAuditExtractor.java
new file mode 100644
index 0000000..7b57ce8
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthenticationResponseStatusAuditExtractor.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.nimbusds.openid.connect.sdk.AuthenticationErrorResponse;
+import com.nimbusds.openid.connect.sdk.AuthenticationResponse;
+
+/** {@link Function} that extracts the status of an authentication response i.e. success, or an error code. */
+public class AuthenticationResponseStatusAuditExtractor extends AbstractAuthenticationResponseAuditExtractor<String> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for locating the authentication response
+ */
+ public AuthenticationResponseStatusAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext, AuthenticationResponse> strategy) {
+ super(strategy);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public String apply(@Nullable final ProfileRequestContext input) {
+ final AuthenticationResponse response = getResponseLookupStrategy().apply(input);
+
+ if (response != null && response.indicatesSuccess()) {
+ return "success";
+ } else if (response != null && !response.indicatesSuccess()) {
+ final AuthenticationErrorResponse error = response.toErrorResponse();
+ if (error.getErrorObject() != null) {
+ return error.getErrorObject().getCode();
+ }
+ }
+
+ return "unknown";
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthorizationEndpointAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthorizationEndpointAuditExtractor.java
new file mode 100644
index 0000000..1409163
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthorizationEndpointAuditExtractor.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/** {@link Function} that extracts the authorization endpoint from the {@link OIDCAuthenticationRequest}. */
+public class AuthorizationEndpointAuditExtractor extends AbstractAuthenticationRequestAuditExtractor<String> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for locating the authentication request
+ */
+ public AuthorizationEndpointAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ super(strategy);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public String apply(@Nullable final ProfileRequestContext input) {
+ final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
+ if (request != null && request.getEndpointURI() != null) {
+ return request.getEndpointURI().toString();
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java
new file mode 100644
index 0000000..03d12ab
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.text.ParseException;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/** Strategy to pull out a ClaimsSet from a located JWT.*/
+public class ClaimSetFromJWTLookupStrategy implements Function<ProfileRequestContext, ClaimsSet> {
+
+ /** Class logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(ClaimSetFromJWTLookupStrategy.class);
+
+ /** Strategy used to lookup the JWT to retrieve the claimsset from.*/
+ private final Function<ProfileRequestContext, JWT> jwtLookupStrategy;
+
+ /**
+ *
+ * Constructor.
+ *
+ * @param strategy the JWT lookup strategy to use.
+ */
+ public ClaimSetFromJWTLookupStrategy(
+ @ParameterName(name="jwtLookupStrategy") @Nonnull final Function<ProfileRequestContext, JWT> strategy) {
+ jwtLookupStrategy =
+ Constraint.isNotNull(strategy, "JWT lookup strategy can not be null");
+ }
+
+ @Override
+ @Nullable public ClaimsSet apply(@Nullable final ProfileRequestContext input) {
+ final JWT locatedJwt = jwtLookupStrategy.apply(input);
+ if (locatedJwt != null) {
+ try {
+ final ClaimsSet claims = new ClaimsSet();
+ claims.putAll(locatedJwt.getJWTClaimsSet().toJSONObject());
+ return claims;
+ } catch (final ParseException e) {
+ log.debug("Unable to parse JWT ClaimsSet from JWT",e);
+ return null;
+ }
+ }
+ return null;
+ }
+
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java
new file mode 100644
index 0000000..ab5f7f9
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.text.ParseException;
+import java.time.DateTimeException;
+import java.time.format.DateTimeFormatter;
+import java.util.Date;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+
+/** A JWT claim extractor function that returns a formatted String representation of the JSON Date.*/
+public class DateBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtractor<String> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(DateBasedJWTClaimAuditExtractor.class);
+
+ /** Formatter for date/time fields. */
+ @Nonnull private DateTimeFormatter dateTimeFormatter;
+
+ /** Constructor.*/
+ public DateBasedJWTClaimAuditExtractor() {
+ dateTimeFormatter = DateTimeFormatter.ISO_INSTANT;
+ }
+
+ /**
+ * Set the formatting string to apply when extracting date/time fields.
+ *
+ * @param format formatting string
+ */
+ public void setDateTimeFormat(@Nullable @NotEmpty final String format) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ if (format != null) {
+ dateTimeFormatter = DateTimeFormatter.ofPattern(StringSupport.trimOrNull(format));
+ }
+ }
+
+ @Override
+ protected String doLookup(final ClaimsSet claimsSet) throws ParseException {
+ final Date dateClaim = claimsSet.getDateClaim(getClaimName());
+ try {
+ return dateTimeFormatter.format(dateClaim.toInstant());
+ } catch (final DateTimeException e) {
+ log.debug("Unable to format date claim '{}'", dateClaim, e);
+ return null;
+ }
+ }
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java
new file mode 100644
index 0000000..914e845
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.nimbusds.openid.connect.sdk.Prompt;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/** {@link Function} that returns true if the OIDC prompt is set as 'login' in {@link OIDCAuthenticationRequest}. */
+public class ForceAuthnAuditExtractor extends AbstractAuthenticationRequestAuditExtractor<Boolean> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for locating the authentication request
+ */
+ public ForceAuthnAuditExtractor(@Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ super(strategy);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public Boolean apply(@Nullable final ProfileRequestContext input) {
+ final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
+ if (request != null && request.getPrompt() != null) {
+ return request.getPrompt().contains(Prompt.Type.LOGIN);
+ } else if (request != null && request.getPrompt() == null) {
+ return false;
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/InboundMessageClassLookupFunction.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/InboundMessageClassLookupFunction.java
new file mode 100644
index 0000000..6fccf82
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/InboundMessageClassLookupFunction.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * Looks up the value of the simple class name from the inbound message context's message object.
+ */
+public class InboundMessageClassLookupFunction implements Function<ProfileRequestContext, String> {
+
+ /**
+ * The simple name of the message class in the inbound message context. Null if it doesn't exist.
+ *
+ * {@inheritDoc}
+ */
+ @Nullable
+ public String apply(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (profileRequestContext.getInboundMessageContext() == null) {
+ return null;
+ }
+ final Object message = profileRequestContext.getInboundMessageContext().getMessage();
+ if (message == null) {
+ return null;
+ }
+ return message.getClass().getSimpleName();
+ }
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/NonceAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/NonceAuditExtractor.java
new file mode 100644
index 0000000..893f828
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/NonceAuditExtractor.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/** {@link Function} that extracts nonce in the {@link OIDCAuthenticationRequest}. */
+public class NonceAuditExtractor extends AbstractAuthenticationRequestAuditExtractor<String> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy strategy lookup strategy locating the authentication request
+ */
+ public NonceAuditExtractor(@Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ super(strategy);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public String apply(@Nullable final ProfileRequestContext input) {
+ final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
+ if (request != null && request.getNonce() != null) {
+ return request.getNonce().getValue();
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/RedirectURIAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/RedirectURIAuditExtractor.java
new file mode 100644
index 0000000..edb0d2a
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/RedirectURIAuditExtractor.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/** {@link Function} that extracts the redirect_uri from the {@link OIDCAuthenticationRequest}. */
+public class RedirectURIAuditExtractor extends AbstractAuthenticationRequestAuditExtractor<String> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy locating the authentication request
+ */
+ public RedirectURIAuditExtractor(@Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ super(strategy);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public String apply(@Nullable final ProfileRequestContext input) {
+ final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
+ if (request != null && request.getRedirectURI() != null) {
+ return request.getRedirectURI().toString();
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseModeAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseModeAuditExtractor.java
new file mode 100644
index 0000000..9860848
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseModeAuditExtractor.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/** {@link Function} that extracts response_mode in the {@link OIDCAuthenticationRequest}. */
+public class ResponseModeAuditExtractor extends AbstractAuthenticationRequestAuditExtractor<String> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy locating the authentication request
+ */
+ public ResponseModeAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ super(strategy);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public String apply(@Nullable final ProfileRequestContext input) {
+ final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
+ if (request != null && request.getResponseMode() != null) {
+ return request.getResponseMode().getValue();
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseTypeAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseTypeAuditExtractor.java
new file mode 100644
index 0000000..e87079e
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseTypeAuditExtractor.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/** {@link Function} that extracts response_type in the {@link OIDCAuthenticationRequest}. */
+public class ResponseTypeAuditExtractor extends AbstractAuthenticationRequestAuditExtractor<String> {
+
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy locating the authentication request
+ */
+ public ResponseTypeAuditExtractor(@Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ super(strategy);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public String apply(@Nullable final ProfileRequestContext input) {
+ final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
+ if (request != null && request.getResponseType() != null) {
+ return request.getResponseType().toString();
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ScopeAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ScopeAuditExtractor.java
new file mode 100644
index 0000000..4995785
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ScopeAuditExtractor.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+
+/** {@link Function} that extracts scope in the {@link OIDCAuthenticationRequest}. */
+public class ScopeAuditExtractor extends AbstractAuthenticationRequestAuditExtractor<String> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy locating the authentication request
+ */
+ public ScopeAuditExtractor(@Nonnull final Function<ProfileRequestContext, OIDCAuthenticationRequest> strategy) {
+ super(strategy);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable
+ public String apply(@Nullable final ProfileRequestContext input) {
+ final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
+ if (request != null) {
+ return request.getScope().toString();
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java
new file mode 100644
index 0000000..b8b3b14
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.text.ParseException;
+
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+
+/** A JWT claim extractor function that returns String objects.*/
+public class StringBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtractor<String> {
+
+ @Override
+ protected String doLookup(final ClaimsSet claimsSet) throws ParseException {
+ return claimsSet.getStringClaim(getClaimName());
+ }
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java
new file mode 100644
index 0000000..ce7c79b
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java
@@ -0,0 +1,32 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.audit.impl;
+
+import java.text.ParseException;
+import java.util.List;
+
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+
+/** A JWT claim extractor function that returns lists of string objects.*/
+public class StringListBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtractor<List<String>> {
+
+ @Override
+ protected List<String> doLookup(final ClaimsSet claimsSet) throws ParseException {
+ return claimsSet.getStringListClaim(getClaimName());
+ }
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list