[java-oidc-common] branch dev/JCOMOIDC-41 updated: Harmonize OIDC config with mainline
Phil Smart
philip.smart at jisc.ac.uk
Tue Sep 20 11:07:49 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=7f2b3fb43a3ab817d9dcee1279c5117db74162cc
The following commit(s) were added to refs/heads/dev/JCOMOIDC-41 by this push:
new 7f2b3fb Harmonize OIDC config with mainline
7f2b3fb is described below
commit 7f2b3fb43a3ab817d9dcee1279c5117db74162cc
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Sep 20 12:07:41 2022 +0100
Harmonize OIDC config with mainline
---
.../config/OIDCAuthorizationConfiguration.java | 475 ++++++++++++++-------
1 file changed, 327 insertions(+), 148 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index d1b005c..3c46e3a 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -17,10 +17,13 @@
package net.shibboleth.oidc.profile.config;
+import java.security.Principal;
import java.time.Duration;
import java.util.Collection;
import java.util.Collections;
+import java.util.Map;
import java.util.Set;
+import java.util.function.BiFunction;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -78,6 +81,9 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
/** Lookup function to supply attribute IDs to omit from UserInfo token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
+ /** Whether to include iss parameter in the authentication response. */
+ @Nonnull private Predicate<ProfileRequestContext> includeIssuerInResponsePredicate;
+
/** Enumeration of the HTTP methods used in OIDC authentication requests.*/
public enum OIDCHttpRequestMethod {
/**
@@ -90,20 +96,12 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
POST
}
- /**
- * Which HTTP method should be used to issue OIDC authentication requests.
- * Supported values are POST and GET. The default is GET.
- */
- @Nonnull private Function<ProfileRequestContext,OIDCHttpRequestMethod> httpRequestMethodLookupStrategy;
-
/** Whether to make a UserInfo Endpoint request for End-User claims.*/
@Nonnull private Predicate<ProfileRequestContext> retrieveUserInfoEndpointClaims;
/** An override to specify a specific redirect_uri to use over the normally computed one.*/
@Nonnull private Function<ProfileRequestContext, String> redirectUriOverrideLookupStrategy;
- //TODO I think we need a new config class for these 'proxy' attributes
- // because the switch of RP to OP is confusing otherwise
/**
* Lookup function to retrieve the client_id from the given profile request context.
* Typically obtained from the issuer_id of the downstream relying-party (OP).
@@ -124,6 +122,28 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
/** Lookup function to retrieve the scopes requested during authentication.*/
@Nonnull private Function<ProfileRequestContext, Set<String>> scopesLookupStrategy;
+ /** Lookup function to supply the strategy function for translating OIDC ACR claims. */
+ @Nonnull private Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>>
+ acrTranslationStrategyLookupStrategy;
+
+ /** Lookup function to supply the strategy function for translating OIDC ACR claims. */
+ @Nonnull private Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>>
+ amrTranslationStrategyLookupStrategy;
+
+ /** Whether authentication results should carry the proxied auth_time in the id_token. */
+ @Nonnull private Predicate<ProfileRequestContext> proxiedAuthnInstantPredicate;
+
+
+ /**
+ * Which HTTP method should be used to issue OIDC authentication requests.
+ * Supported values are POST and GET. The default is GET.
+ */
+ @Nonnull private Function<ProfileRequestContext,String> httpRequestMethodLookupStrategy;
+
+ /** Lookup function to supply strategy bi-function for manipulating authorization code claims set. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy;
/**
* Constructor.
@@ -140,24 +160,149 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
public OIDCAuthorizationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
- encodeConsentInTokensPredicate = Predicates.alwaysFalse();
- useRequestObjectPredicate = Predicates.alwaysFalse();
+ redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
+ clientIdLookupStrategy = FunctionSupport.constant(null);
+ clientCredentialLookupStrategy = FunctionSupport.constant(null);
+ responseModeLookupStrategy = FunctionSupport.constant(null);
+ responseTypeLookupStrategy = FunctionSupport.constant("code");
+ scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
signRequestObjectPredicate = Predicates.alwaysTrue();
encryptRequestObjectPredicate = Predicates.alwaysFalse();
retrieveUserInfoEndpointClaims = Predicates.alwaysTrue();
+ proxiedAuthnInstantPredicate = Predicates.alwaysTrue();
+ acrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
+ amrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
+ acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
+ encodeConsentInTokensPredicate = Predicates.alwaysFalse();
+ useRequestObjectPredicate = Predicates.alwaysFalse();
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
encodedAttributesLookupStrategy = FunctionSupport.constant(null);
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
- clientIdLookupStrategy = FunctionSupport.constant(null);
- clientCredentialLookupStrategy = FunctionSupport.constant(null);
- responseModeLookupStrategy = FunctionSupport.constant(null);
- responseTypeLookupStrategy = FunctionSupport.constant("code");
- scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
- httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
+ httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET.toString());
+
+ includeIssuerInResponsePredicate = Predicates.alwaysFalse();
+
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
+ }
+
+ /**
+ * Get whether all acr claim requests should be treated as Essential.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether all acr claim requests should be treated as Essential
+ */
+ public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
+ return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether all acr claim requests should be treated as Essential.
+ *
+ * @param flag flag to set
+ */
+ public void setAcrRequestAlwaysEssential(final boolean flag) {
+ acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether all acr claim requests should be treated as Essential.
+ *
+ * @param condition condition to set
+ */
+ public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Should authentication request parameters should be passed in a single, self contained, JWT?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return whether authentication request parameters should be passed in a single, self contained, JWT
+ */
+ public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
+ return useRequestObjectPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether the authentication request parameters should be passed in a single, self contained, JWT.
+ *
+ * @param flag flag to set
+ */
+ public void setUseRequestObject(final boolean flag) {
+ useRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether the authentication request parameters should be passed in a single,
+ * self contained, JWT.
+ *
+ * @param condition condition to set
+ */
+ public void setUseRequestObjectPredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
+ }
+
+ /**
+ * Get whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to encode consent in authorization code and access/refresh tokens
+ */
+ public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encodeConsentInTokensPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param flag flag to set
+ */
+ public void setEncodeConsentInTokens(final boolean flag) {
+ encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param condition condition to set
+ */
+ public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to make a request to the UserInfo Endpoint
+ */
+ public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
+ return retrieveUserInfoEndpointClaims.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param flag flag to set
+ */
+ public void setRetrieveUserInfoEndpointClaims(final boolean flag) {
+ retrieveUserInfoEndpointClaims = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param condition condition to set
+ */
+ public void setRetrieveUserInfoEndpointClaims(@Nonnull final Predicate<ProfileRequestContext> condition){
+ retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
}
/**
@@ -314,124 +459,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
public String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext) {
return redirectUriOverrideLookupStrategy.apply(profileRequestContext);
}
-
- /**
- * Get whether all acr claim requests should be treated as Essential.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether all acr claim requests should be treated as Essential
- */
- public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
- return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether all acr claim requests should be treated as Essential.
- *
- * @param flag flag to set
- */
- public void setAcrRequestAlwaysEssential(final boolean flag) {
- acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether all acr claim requests should be treated as Essential.
- *
- * @param condition condition to set
- */
- public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Should authentication request parameters should be passed in a single, self contained, JWT?
- *
- * @param profileRequestContext the profile request context
- *
- * @return whether authentication request parameters should be passed in a single, self contained, JWT
- */
- public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
- return useRequestObjectPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether the authentication request parameters should be passed in a single, self contained, JWT.
- *
- * @param flag flag to set
- */
- public void setUseRequestObject(final boolean flag) {
- useRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether the authentication request parameters should be passed in a single,
- * self contained, JWT.
- *
- * @param condition condition to set
- */
- public void setUseRequestObjectPredicate(
- @Nonnull final Predicate<ProfileRequestContext> condition) {
- useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
- }
-
- /**
- * Get whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to encode consent in authorization code and access/refresh tokens
- */
- public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
- return encodeConsentInTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param flag flag to set
- */
- public void setEncodeConsentInTokens(final boolean flag) {
- encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param condition condition to set
- */
- public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to make a request to the UserInfo Endpoint
- */
- public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
- return retrieveUserInfoEndpointClaims.test(profileRequestContext);
- }
-
- /**
- * Set whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param flag flag to set
- */
- public void setRetrieveUserInfoEndpointClaims(final boolean flag) {
- retrieveUserInfoEndpointClaims = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param condition condition to set
- */
- public void setRetrieveUserInfoEndpointClaims(@Nonnull final Predicate<ProfileRequestContext> condition){
- retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
- }
/**
* Get authz code lifetime.
@@ -479,7 +506,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
* @param strategy the strategy to set.
*/
public void setHttpRequestMethodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, OIDCHttpRequestMethod> strategy) {
+ @Nonnull final Function<ProfileRequestContext, String> strategy) {
httpRequestMethodLookupStrategy =
Constraint.isNotNull(strategy, "HTTP request method strategy can not be null");
}
@@ -489,16 +516,8 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @param method the HTTP method to set, either POST or GET.
*/
- public void setHttpRequestMethod(@Nonnull @NotEmpty final String method){
- Constraint.isNotEmpty(method, "HTTP request method strategy can not be null or empty");
- if ("POST".equals(method)) {
- httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.POST);
- } else if ("GET".equals(method)) {
- httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
- } else {
- throw new ConstraintViolationException("OIDC HTTP request method not "
- + "recognized, must be one of POST or GET");
- }
+ public void setHttpRequestMethod(@Nonnull @NotEmpty final OIDCHttpRequestMethod method){
+ httpRequestMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
}
/**
@@ -509,7 +528,16 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
* @return the HTTP request method
*/
public OIDCHttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext) {
- return httpRequestMethodLookupStrategy.apply(profileRequestContext);
+ final String method = httpRequestMethodLookupStrategy.apply(profileRequestContext);
+ if (method != null) {
+ try {
+ return OIDCHttpRequestMethod.valueOf(method);
+ } catch (final IllegalArgumentException e) {
+ throw new ConstraintViolationException("Unexpected HTTP method value: '" + method + "': "
+ + e.getMessage());
+ }
+ }
+ return null;
}
/**
@@ -696,5 +724,156 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
@Nullable public Set<String> getScopes(@Nullable final ProfileRequestContext profileRequestContext) {
return scopesLookupStrategy.apply(profileRequestContext);
}
+
+ /**
+ * Set the lookup function to locate the Authentication Methods References strategy used to translate
+ * between an inbound proxied OIDC AMR into an appropriate set of custom {@link Principal} objects
+ * to populate the subject.
+ *
+ * @param strategy translation function
+ */
+ public void setAuthenticationMethodsReferencesTranslationStrategyLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>> strategy){
+ amrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Get the function used to translate AMRs in the inbound id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
+ *
+ * @param prc current profile request context
+ *
+ * @return translation function
+ */
+ @Nullable public Function<Collection<String>,Collection<Principal>>
+ getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc){
+ return amrTranslationStrategyLookupStrategy.apply(prc);
+ }
+
+ /**
+ * Set the lookup function to locate the Authentication Context Class Reference strategy used to translate
+ * between an inbound proxied OIDC ACR into an appropriate set of custom {@link Principal} objects to
+ * populate the subject.
+ *
+ * @param strategy translation function
+ */
+ public void setAuthenticationContextClassReferenceTranslationStrategyLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>> strategy){
+ acrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Get the function used to translate ACRs in the inbound id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
+ *
+ * @param prc current profile request context
+ *
+ * @return translation function
+ */
+ @Nullable public Function<Collection<String>,Collection<Principal>>
+ getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc){
+ return acrTranslationStrategyLookupStrategy.apply(prc);
+ }
+
+ /**
+ * Gets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's auth_time from the id_token, rather than the current time.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to proxy across the inbound auth_time
+ */
+ public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext) {
+ return proxiedAuthnInstantPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Sets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's auth_time from the id_token, rather than the current time.
+ *
+ * @param flag flag to set
+ *
+ */
+ public void setProxiedAuthnInstant(final boolean flag) {
+ proxiedAuthnInstantPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+ /**
+ * Get whether to include iss parameter in the authentication response.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to include iss parameter in the authentication response
+ *
+ * @since 2.1.0
+ */
+ public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext) {
+ return includeIssuerInResponsePredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to include iss parameter in the authentication response.
+ *
+ * @param flag flag to set
+ *
+ * @since 2.1.0
+ */
+ public void setIncludeIssuerInResponse(final boolean flag) {
+ includeIssuerInResponsePredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether to include iss parameter in the authentication response.
+ *
+ * @param condition condition to set
+ *
+ * @since 2.1.0
+ */
+ public void setIncludeIssuerInResponsePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ includeIssuerInResponsePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Get the bi-function for manipulating authorization code claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return authorizationCodeClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-function for manipulating authorization code claims set.
+ *
+ * @param strategy bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ public void setAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-function for manipulating authorization code claims set.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 2.1.0
+ */
+ public void setAuthorizationCodeClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ strategy) {
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list