[java-oidc-common] 23/28: Harmonize OIDC config with mainline
Phil Smart
philip.smart at jisc.ac.uk
Wed Oct 5 10:34:54 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=8ab0173bbd57ae8ea042d09fea658ffa2c3951c8
commit 8ab0173bbd57ae8ea042d09fea658ffa2c3951c8
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Sep 20 12:07:41 2022 +0100
Harmonize OIDC config with mainline
---
.../shibboleth/oidc/profile/audit/AuditFields.java | 7 +-
.../config/OIDCAuthorizationConfiguration.java | 460 +++++++++++----------
.../shibboleth/oidc/profile/core/OidcEventIds.java | 5 +
...bstractAuthenticationRequestAuditExtractor.java | 17 +
4 files changed, 277 insertions(+), 212 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/audit/AuditFields.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/audit/AuditFields.java
index 909b476..dc838ff 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/audit/AuditFields.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/audit/AuditFields.java
@@ -36,7 +36,7 @@ public final class AuditFields {
/** OIDC issuer. */
@Nonnull @NotEmpty public static final String ISSUER = SAMLAuditFields.IDENTITY_PROVIDER;
- /** OIDC proxy issuer. The downstream identity provider. */
+ /** OIDC proxy issuer. The upstream identity provider. */
@Nonnull @NotEmpty public static final String PROXY_ISSUER = SAMLAuditFields.SERVICE_PROVIDER;
/** The inbound (Nimbus) message class. */
@@ -97,7 +97,10 @@ public final class AuditFields {
@Nonnull @NotEmpty public static final String ACRS = "ACRS";
/** The authentication response result, including any error code if there are any. Useful in the proxy case.*/
- @Nonnull @NotEmpty public static final String AUTHENTICATION_RESULT = "AUTHZR";
+ @Nonnull @NotEmpty public static final String AUTHENTICATION_RESULT = "AUTHNR";
+
+ /** The authentication flow step e.g. authentication request, authentication response etc.*/
+ @Nonnull @NotEmpty public static final String AUTHENTICATION_FLOW_STEP = "AUTHNFS";
/**
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index e72eb31..291b864 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -17,6 +17,7 @@
package net.shibboleth.oidc.profile.config;
+import java.security.Principal;
import java.time.Duration;
import java.util.Collection;
import java.util.Collections;
@@ -95,25 +96,12 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
POST
}
- /**
- * Which HTTP method should be used to issue OIDC authentication requests.
- * Supported values are POST and GET. The default is GET.
- */
- @Nonnull private Function<ProfileRequestContext,String> httpRequestMethodLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating authorization code claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- authorizationCodeClaimsSetManipulationStrategyLookupStrategy;
-
/** Whether to make a UserInfo Endpoint request for End-User claims.*/
@Nonnull private Predicate<ProfileRequestContext> retrieveUserInfoEndpointClaims;
/** An override to specify a specific redirect_uri to use over the normally computed one.*/
@Nonnull private Function<ProfileRequestContext, String> redirectUriOverrideLookupStrategy;
- //TODO I think we need a new config class for these 'proxy' attributes
- // because the switch of RP to OP is confusing otherwise
/**
* Lookup function to retrieve the client_id from the given profile request context.
* Typically obtained from the issuer_id of the downstream relying-party (OP).
@@ -126,7 +114,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
@Nonnull private Function<ProfileRequestContext, Credential> clientCredentialLookupStrategy;
/** Lookup function to determine the client_authentication method. */
- // @Nonnull private Function<ProfileRequestContext, ClientAuthentication> clientAuthenticationLookupStrategy;
//TODO same as tokenEndpointAuthMethodsLookupStrategy?
@Nonnull private Function<ProfileRequestContext, String> clientAuthenticationMethodLookupStrategy;
@@ -139,6 +126,28 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
/** Lookup function to retrieve the scopes requested during authentication.*/
@Nonnull private Function<ProfileRequestContext, Set<String>> scopesLookupStrategy;
+ /** Lookup function to supply the strategy function for translating OIDC ACR claims. */
+ @Nonnull private Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>>
+ acrTranslationStrategyLookupStrategy;
+
+ /** Lookup function to supply the strategy function for translating OIDC ACR claims. */
+ @Nonnull private Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>>
+ amrTranslationStrategyLookupStrategy;
+
+ /** Whether authentication results should carry the proxied auth_time in the id_token. */
+ @Nonnull private Predicate<ProfileRequestContext> proxiedAuthnInstantPredicate;
+
+
+ /**
+ * Which HTTP method should be used to issue OIDC authentication requests.
+ * Supported values are POST and GET. The default is GET.
+ */
+ @Nonnull private Function<ProfileRequestContext,String> httpRequestMethodLookupStrategy;
+
+ /** Lookup function to supply strategy bi-function for manipulating authorization code claims set. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy;
/**
* Constructor.
@@ -155,30 +164,151 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
public OIDCAuthorizationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
- encodeConsentInTokensPredicate = Predicates.alwaysFalse();
- useRequestObjectPredicate = Predicates.alwaysFalse();
+ redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
+ clientIdLookupStrategy = FunctionSupport.constant(null);
+ clientCredentialLookupStrategy = FunctionSupport.constant(null);
+ responseModeLookupStrategy = FunctionSupport.constant(null);
+ responseTypeLookupStrategy = FunctionSupport.constant("code");
+ scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
signRequestObjectPredicate = Predicates.alwaysTrue();
encryptRequestObjectPredicate = Predicates.alwaysFalse();
retrieveUserInfoEndpointClaims = Predicates.alwaysTrue();
+ proxiedAuthnInstantPredicate = Predicates.alwaysTrue();
+ acrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
+ amrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
+ acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
+ encodeConsentInTokensPredicate = Predicates.alwaysFalse();
+ useRequestObjectPredicate = Predicates.alwaysFalse();
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
encodedAttributesLookupStrategy = FunctionSupport.constant(null);
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
- clientIdLookupStrategy = FunctionSupport.constant(null);
- clientCredentialLookupStrategy = FunctionSupport.constant(null);
- responseModeLookupStrategy = FunctionSupport.constant(null);
- responseTypeLookupStrategy = FunctionSupport.constant("code");
- scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
- httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
+ httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET.toString());
includeIssuerInResponsePredicate = Predicates.alwaysFalse();
authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
}
+ /**
+ * Get whether all acr claim requests should be treated as Essential.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether all acr claim requests should be treated as Essential
+ */
+ public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
+ return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether all acr claim requests should be treated as Essential.
+ *
+ * @param flag flag to set
+ */
+ public void setAcrRequestAlwaysEssential(final boolean flag) {
+ acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether all acr claim requests should be treated as Essential.
+ *
+ * @param condition condition to set
+ */
+ public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Should authentication request parameters should be passed in a single, self contained, JWT?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return whether authentication request parameters should be passed in a single, self contained, JWT
+ */
+ public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
+ return useRequestObjectPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether the authentication request parameters should be passed in a single, self contained, JWT.
+ *
+ * @param flag flag to set
+ */
+ public void setUseRequestObject(final boolean flag) {
+ useRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether the authentication request parameters should be passed in a single,
+ * self contained, JWT.
+ *
+ * @param condition condition to set
+ */
+ public void setUseRequestObjectPredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
+ }
+
+ /**
+ * Get whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to encode consent in authorization code and access/refresh tokens
+ */
+ public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encodeConsentInTokensPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param flag flag to set
+ */
+ public void setEncodeConsentInTokens(final boolean flag) {
+ encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param condition condition to set
+ */
+ public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to make a request to the UserInfo Endpoint
+ */
+ public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
+ return retrieveUserInfoEndpointClaims.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param flag flag to set
+ */
+ public void setRetrieveUserInfoEndpointClaims(final boolean flag) {
+ retrieveUserInfoEndpointClaims = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param condition condition to set
+ */
+ public void setRetrieveUserInfoEndpointClaims(@Nonnull final Predicate<ProfileRequestContext> condition){
+ retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
/**
* Should the RequestObject (if configured) be signed?
*
@@ -255,31 +385,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
clientIdLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(clientId));
}
- /**
- * Set the client authentication lookup strategy which will locate the client_authentication method
- * for a given client.
- *
- * @param strategy the strategy to use
- */
- public void setClientAuthenticationLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, ClientAuthentication> strategy) {
- clientAuthenticationLookupStrategy =
- Constraint.isNotNull(strategy, "Client authentication strategy can not be null");
- }
-
- /**
- * Get the client_authentication for the given context. Typically that associated with the
- * current client_id.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client_authentication method
- */
- public ClientAuthentication getClientAuthentication(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return clientAuthenticationLookupStrategy.apply(profileRequestContext);
- }
-
/**
* Get the client_id appropriate for the given context. Typically that associated
* with the chosen downstream OpenID Connect Provider.
@@ -393,124 +498,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
return redirectUriOverrideLookupStrategy.apply(profileRequestContext);
}
- /**
- * Get whether all acr claim requests should be treated as Essential.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether all acr claim requests should be treated as Essential
- */
- public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
- return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether all acr claim requests should be treated as Essential.
- *
- * @param flag flag to set
- */
- public void setAcrRequestAlwaysEssential(final boolean flag) {
- acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether all acr claim requests should be treated as Essential.
- *
- * @param condition condition to set
- */
- public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Should authentication request parameters should be passed in a single, self contained, JWT?
- *
- * @param profileRequestContext the profile request context
- *
- * @return whether authentication request parameters should be passed in a single, self contained, JWT
- */
- public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
- return useRequestObjectPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether the authentication request parameters should be passed in a single, self contained, JWT.
- *
- * @param flag flag to set
- */
- public void setUseRequestObject(final boolean flag) {
- useRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether the authentication request parameters should be passed in a single,
- * self contained, JWT.
- *
- * @param condition condition to set
- */
- public void setUseRequestObjectPredicate(
- @Nonnull final Predicate<ProfileRequestContext> condition) {
- useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
- }
-
- /**
- * Get whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to encode consent in authorization code and access/refresh tokens
- */
- public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
- return encodeConsentInTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param flag flag to set
- */
- public void setEncodeConsentInTokens(final boolean flag) {
- encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param condition condition to set
- */
- public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to make a request to the UserInfo Endpoint
- */
- public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
- return retrieveUserInfoEndpointClaims.test(profileRequestContext);
- }
-
- /**
- * Set whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param flag flag to set
- */
- public void setRetrieveUserInfoEndpointClaims(final boolean flag) {
- retrieveUserInfoEndpointClaims = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param condition condition to set
- */
- public void setRetrieveUserInfoEndpointClaims(@Nonnull final Predicate<ProfileRequestContext> condition){
- retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
/**
* Get authz code lifetime.
*
@@ -712,6 +699,41 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
public void setResponseMode(@Nonnull final String responseMode) {
responseModeLookupStrategy = FunctionSupport.constant(responseMode);
}
+
+ /**
+ * Get whether to include iss parameter in the authentication response.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to include iss parameter in the authentication response
+ *
+ * @since 2.1.0
+ */
+ public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext) {
+ return includeIssuerInResponsePredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to include iss parameter in the authentication response.
+ *
+ * @param flag flag to set
+ *
+ * @since 2.1.0
+ */
+ public void setIncludeIssuerInResponse(final boolean flag) {
+ includeIssuerInResponsePredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether to include iss parameter in the authentication response.
+ *
+ * @param condition condition to set
+ *
+ * @since 2.1.0
+ */
+ public void setIncludeIssuerInResponsePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ includeIssuerInResponsePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
/**
* Set the lookup strategy to determine the response_type for authentication requests.
@@ -741,6 +763,25 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
public String getResponseType(@Nullable final ProfileRequestContext profileRequestContext) {
return responseTypeLookupStrategy.apply(profileRequestContext);
}
+
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return authorizationCodeClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-function for manipulating authorization code claims set.
+ *
+ * @param strategy bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ public void setAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
/**
* Set the lookup strategy to determine the scopes to use for authentication requests.
@@ -777,80 +818,79 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
}
/**
- * Get whether to include iss parameter in the authentication response.
- *
- * @param profileRequestContext profile request context
+ * Set the lookup function to locate the Authentication Methods References strategy used to translate
+ * between an inbound proxied OIDC AMR into an appropriate set of custom {@link Principal} objects
+ * to populate the subject.
*
- * @return whether to include iss parameter in the authentication response
- *
- * @since 2.1.0
+ * @param strategy translation function
*/
- public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext) {
- return includeIssuerInResponsePredicate.test(profileRequestContext);
+ public void setAuthenticationMethodsReferencesTranslationStrategyLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>> strategy){
+ amrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/**
- * Set whether to include iss parameter in the authentication response.
+ * Get the function used to translate AMRs in the inbound id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
*
- * @param flag flag to set
+ * @param prc current profile request context
*
- * @since 2.1.0
+ * @return translation function
*/
- public void setIncludeIssuerInResponse(final boolean flag) {
- includeIssuerInResponsePredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ @Nullable public Function<Collection<String>,Collection<Principal>>
+ getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc){
+ return amrTranslationStrategyLookupStrategy.apply(prc);
}
/**
- * Set condition for whether to include iss parameter in the authentication response.
+ * Set the lookup function to locate the Authentication Context Class Reference strategy used to translate
+ * between an inbound proxied OIDC ACR into an appropriate set of custom {@link Principal} objects to
+ * populate the subject.
*
- * @param condition condition to set
- *
- * @since 2.1.0
+ * @param strategy translation function
*/
- public void setIncludeIssuerInResponsePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- includeIssuerInResponsePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ public void setAuthenticationContextClassReferenceTranslationStrategyLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>> strategy){
+ acrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/**
- * Get the bi-function for manipulating authorization code claims set.
- *
- * @param profileRequestContext profile request context
+ * Get the function used to translate ACRs in the inbound id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
*
- * @return the bi-function for manipulating authorization code claims set
+ * @param prc current profile request context
*
- * @since 2.1.0
+ * @return translation function
*/
- @Nonnull
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getAuthorizationCodeClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return authorizationCodeClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ @Nullable public Function<Collection<String>,Collection<Principal>>
+ getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc){
+ return acrTranslationStrategyLookupStrategy.apply(prc);
}
/**
- * Set the bi-function for manipulating authorization code claims set.
+ * Gets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's auth_time from the id_token, rather than the current time.
*
- * @param strategy bi-function for manipulating authorization code claims set
+ * <p>Defaults to true.</p>
*
- * @since 2.1.0
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to proxy across the inbound auth_time
*/
- public void setAuthorizationCodeClaimsSetManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext) {
+ return proxiedAuthnInstantPredicate.test(profileRequestContext);
}
/**
- * Set a lookup strategy for the bi-function for manipulating authorization code claims set.
+ * Sets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's auth_time from the id_token, rather than the current time.
*
- * @param strategy lookup strategy
+ * @param flag flag to set
*
- * @since 2.1.0
*/
- public void setAuthorizationCodeClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- authorizationCodeClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
+ public void setProxiedAuthnInstant(final boolean flag) {
+ proxiedAuthnInstantPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java
index 4f8a10e..d05aead 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java
@@ -92,6 +92,11 @@ public final class OidcEventIds {
*/
@Nonnull @NotEmpty public static final String INVALID_ID_TOKEN = "InvalidIdToken";
+ /**
+ * The token is invalid.
+ */
+ @Nonnull @NotEmpty public static final String INVALID_TOKEN = "InvalidToken";
+
/**
* The id_token is invalid.
*/
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationRequestAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationRequestAuditExtractor.java
index 595797c..b6aa400 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationRequestAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractAuthenticationRequestAuditExtractor.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.profile.audit.impl;
import java.util.function.Function;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list