[java-oidc-common] 05/35: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
Phil Smart
philip.smart at jisc.ac.uk
Tue Sep 20 14:19:05 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=c98ded0baaa6accbde2e4bd179d075ced68733fd
commit c98ded0baaa6accbde2e4bd179d075ced68733fd
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jun 1 17:02:25 2022 +0100
JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter
classes to commons
- Add JWT decryption configuration, parameter, and context classes
- Add JWK factory beans for creating credentials with both 'alg' and
'enc' algorithms set
- Add decryption parameter resolver - similar to the SAML case
- Port over the BasicJWKCredentialFactoryBean from the OP
https://shibboleth.atlassian.net/browse/JCOMOIDC-41
---
.../oidc/security/DecryptionConfiguration.java | 41 ++++++
.../oidc/security/JWTDecryptionParameters.java | 94 ++++++++++++++
.../security/JWTDecryptionParametersResolver.java | 28 +++++
.../context/JWTSecurityParametersContext.java | 64 +---------
.../DecryptionConfigurationCriterion.java | 107 ++++++++++++++++
.../impl/EvaluableKeyIDCredentialCriterion.java | 17 +++
.../impl/JWKEncryptionCredentialContext.java | 54 ++++++++
...piringJWTSharedSecretCredentialFactoryBean.java | 137 +++++++++++++++++++++
...asicExpiringJWTStaticCredentialFactoryBean.java | 86 -------------
.../impl/BasicJWKCredentialFactoryBean.java | 125 +++++++++++++++++++
.../impl/BasicJWTDecryptionConfiguration.java | 68 ++++++++++
.../DefaultJWTDecryptionParametersResolver.java | 117 ++++++++++++++++++
.../impl/ProviderMetadataCredentialResolver.java | 4 +-
.../profile/config/OIDCSecurityConfiguration.java | 24 ++++
14 files changed, 820 insertions(+), 146 deletions(-)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
new file mode 100644
index 0000000..0fbf4e7
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/DecryptionConfiguration.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.security.credential.CredentialResolver;
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+
+public interface DecryptionConfiguration extends AlgorithmPolicyConfiguration {
+
+ /**
+ * Get the CredentialResolver to use when processing the encrypted content.
+ *
+ * @return the KeyInfoCredentialResolver instance
+ */
+ @Nullable CredentialResolver getContentEncryptionKeyCredentialResolver();
+
+ /**
+ * Get the CredentialResolver to use when processing the EncryptedKey (the
+ * Key Encryption Key or KEK).
+ *
+ * @return the CredentialResolver instance
+ */
+ @Nullable CredentialResolver getKEKCredentialResolver();
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
new file mode 100644
index 0000000..5a996b6
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
@@ -0,0 +1,94 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.security.credential.CredentialResolver;
+import org.opensaml.xmlsec.AlgorithmPolicyParameters;
+
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+
+/**
+ * Describes the decryption parameters the system is required to used to decrypt a JWT.
+ */
+public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
+
+ /** The EncryptedKey's credential resolver. */
+ @Nullable private CredentialResolver kekKeyCredentialResolver;
+
+ /** The content encryption key (CEK) resolver.*/
+ @Nullable private CredentialResolver contentEncryptionKeyCredentialResolver;
+
+ /** Carries additional criterion made available to the resolvers at runtime.*/
+ @Nonnull final CriteriaSet additionalCriteria;
+
+ public JWTDecryptionParameters() {
+ additionalCriteria = new CriteriaSet();
+ }
+
+ /**
+ * Get the criteria set to add additional criterion too.
+ *
+ * @return the criteria set.
+ */
+ public CriteriaSet getAdditionalCriteria() {
+ return additionalCriteria;
+ }
+
+ /**
+ * Get the CredentialResolver to use when processing the encrypted content.
+ *
+ * @return the KeyInfoCredentialResolver instance
+ */
+ @Nullable public CredentialResolver getContentEncryptionKeyCredentialResolver() {
+ return contentEncryptionKeyCredentialResolver;
+ }
+
+ /**
+ * Set the KeyInfoCredentialResolver to use when processing the encrypted content.
+ *
+ * @param resolver the CredentialResolver instance
+ */
+ public void setContentEncryptionKeyCredentialResolver(@Nullable final CredentialResolver resolver) {
+ contentEncryptionKeyCredentialResolver = resolver;
+ }
+
+ /**
+ * Get the CredentialResolver to use when processing the EncryptedKey (the
+ * Key Encryption Key or KEK).
+ *
+ * @return the CredentialResolver instance
+ */
+ @Nullable public CredentialResolver getKEKCredentialResolver() {
+ return kekKeyCredentialResolver;
+ }
+
+ /**
+ * Set the CredentialResolver to use when processing the EncryptedKey (the
+ * Key Encryption Key or KEK).
+ *
+ * @param resolver the CredentialResolver instance
+ */
+ public void setKEKCredentialResolver(@Nullable final CredentialResolver resolver) {
+ kekKeyCredentialResolver = resolver;
+ }
+
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParametersResolver.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParametersResolver.java
new file mode 100644
index 0000000..7fd49c0
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParametersResolver.java
@@ -0,0 +1,28 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security;
+
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.Resolver;
+
+/**
+ * An interface for components which resolve {@link JWTDecryptionParameters} based on a {@link CriteriaSet}.
+ */
+public interface JWTDecryptionParametersResolver extends Resolver<JWTDecryptionParameters, CriteriaSet> {
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
index 3c8ebc9..220b4cc 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
@@ -21,55 +21,24 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.BaseContext;
-import org.opensaml.xmlsec.DecryptionParameters;
-import org.opensaml.xmlsec.EncryptionParameters;
-import org.opensaml.xmlsec.SignatureSigningParameters;
import com.nimbusds.jwt.SignedJWT;
+import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.SignatureValidationParameters;
/**
* A context implementation for storing parameter instances for JWT signature signing and validation, and JWT
* encryption and decryption.
*/
-//TODO some of this is generic enough to use in any context?
-public class JWTSecurityParametersContext extends BaseContext {
-
- /** Signature signing parameters. */
- @Nullable private SignatureSigningParameters signatureSigningParameters;
+public class JWTSecurityParametersContext extends BaseContext {
/** Signature validation parameters. */
@Nullable private SignatureValidationParameters<SignedJWT> signatureValidationParameters;
- /** Encryption parameters. */
- @Nullable private EncryptionParameters encryptionParameters;
-
/** Decryption parameters. */
- @Nullable private DecryptionParameters decryptionParameters;
-
- /**
- * Get the parameters to use for XML signature signing operations.
- *
- * @return the parameters
- */
- @Nullable public SignatureSigningParameters getSignatureSigningParameters() {
- return signatureSigningParameters;
- }
-
- /**
- * Set the parameters to use for XML signature signing operations.
- *
- * @param params the parameters
- *
- * @return this context
- */
- @Nonnull public JWTSecurityParametersContext setSignatureSigningParameters(
- @Nullable final SignatureSigningParameters params) {
- signatureSigningParameters = params;
- return this;
- }
-
+ @Nullable private JWTDecryptionParameters decryptionParameters;
+
/**
* Get the parameters to use for XML signature validation operations.
*
@@ -92,33 +61,12 @@ public class JWTSecurityParametersContext extends BaseContext {
return this;
}
- /**
- * Get the parameters to use for XML encryption operations.
- *
- * @return the parameters
- */
- @Nullable public EncryptionParameters getEncryptionParameters() {
- return encryptionParameters;
- }
-
- /**
- * Set the parameters to use for XML encryption operations.
- *
- * @param params the parameters
- *
- * @return this context
- */
- @Nonnull public JWTSecurityParametersContext setEncryptionParameters(@Nullable final EncryptionParameters params) {
- encryptionParameters = params;
- return this;
- }
-
/**
* Get the parameters to use for XML decryption operations.
*
* @return the parameters
*/
- @Nullable public DecryptionParameters getDecryptionParameters() {
+ @Nullable public JWTDecryptionParameters getDecryptionParameters() {
return decryptionParameters;
}
@@ -129,7 +77,7 @@ public class JWTSecurityParametersContext extends BaseContext {
*
* @return this context
*/
- @Nonnull public JWTSecurityParametersContext setDecryptionParameters(@Nullable final DecryptionParameters params) {
+ @Nonnull public JWTSecurityParametersContext setDecryptionParameters(@Nullable final JWTDecryptionParameters params) {
decryptionParameters = params;
return this;
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/DecryptionConfigurationCriterion.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/DecryptionConfigurationCriterion.java
new file mode 100644
index 0000000..0fb0d22
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/DecryptionConfigurationCriterion.java
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.criterion;
+
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.oidc.security.DecryptionConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.Criterion;
+
+/**
+ * Criterion which holds one or more instances of {@link DecryptionConfiguration}.
+ */
+public class DecryptionConfigurationCriterion implements Criterion {
+
+ /** The list of configuration instances. */
+ @Nonnull @NonnullElements private final List<DecryptionConfiguration> configs;
+
+ /**
+ * Constructor.
+ *
+ * @param configurations list of configuration instances
+ */
+ public DecryptionConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
+ List<DecryptionConfiguration> configurations) {
+ configs = List.copyOf(Constraint.isNotNull(configurations, "List of configurations cannot be null"));
+ Constraint.isNotEmpty(configs, "At least one configuration is required");
+
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param configurations varargs array of configuration instances
+ */
+ public DecryptionConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
+ DecryptionConfiguration... configurations) {
+ configs = List.of(Constraint.isNotNull(configurations, "List of configurations cannot be null"));
+ Constraint.isNotEmpty(configs, "At least one configuration is required");
+ }
+
+ /**
+ * Get the list of configuration instances.
+ *
+ * @return the list of configuration instances
+ */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable @NotEmpty
+ public List<DecryptionConfiguration> getConfigurations() {
+ return configs;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String toString() {
+ final StringBuilder builder = new StringBuilder();
+ builder.append("DecryptionConfigurationCriterion [configs=");
+ builder.append(configs);
+ builder.append("]");
+ return builder.toString();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int hashCode() {
+ return configs.hashCode();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean equals(final Object obj) {
+ if (this == obj) {
+ return true;
+ }
+
+ if (obj == null) {
+ return false;
+ }
+
+ if (obj instanceof DecryptionConfigurationCriterion) {
+ return configs.equals(((DecryptionConfigurationCriterion) obj).getConfigurations());
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableKeyIDCredentialCriterion.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableKeyIDCredentialCriterion.java
index 5b4854d..45832a6 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableKeyIDCredentialCriterion.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableKeyIDCredentialCriterion.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.credential.impl;
import javax.annotation.Nonnull;
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/JWKEncryptionCredentialContext.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/JWKEncryptionCredentialContext.java
new file mode 100644
index 0000000..05a355d
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/JWKEncryptionCredentialContext.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential.impl;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.credential.CredentialContext;
+
+import com.nimbusds.jose.EncryptionMethod;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * A {@link CredentialContext} that holds additional JWE information.
+ */
+public class JWKEncryptionCredentialContext implements CredentialContext {
+
+ /** The encryption algorithm associated with this credential.*/
+ @Nonnull private final EncryptionMethod encryptionAlgorithm;
+
+ /**
+ *
+ * Constructor.
+ *
+ * @param enc the encryption (enc) methods associated with this credential.
+ */
+ public JWKEncryptionCredentialContext(@Nonnull final EncryptionMethod enc) {
+ encryptionAlgorithm = Constraint.isNotNull(enc, "Encryption method can not be null");
+ }
+
+ /**
+ * Get the encryption algorithm associated with this credential.
+ *
+ * @return the encryption algorithm
+ */
+ public EncryptionMethod getEncryptionAlgorithm() {
+ return encryptionAlgorithm;
+ }
+}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTSharedSecretCredentialFactoryBean.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTSharedSecretCredentialFactoryBean.java
new file mode 100644
index 0000000..13dcb11
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTSharedSecretCredentialFactoryBean.java
@@ -0,0 +1,137 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+import java.time.Duration;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import javax.crypto.spec.SecretKeySpec;
+
+import org.opensaml.security.credential.UsageType;
+
+import com.google.common.base.Enums;
+import com.nimbusds.jose.Algorithm;
+import com.nimbusds.jose.EncryptionMethod;
+
+import net.shibboleth.idp.profile.spring.factory.AbstractCredentialFactoryBean;
+import net.shibboleth.oidc.security.credential.BasicExpiringJWKCredential;
+import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.credential.ExpiringJWKCredential;
+import net.shibboleth.oidc.security.credential.impl.JWKEncryptionCredentialContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/** A factory bean for creating a {@link BasicExpiringJWKCredential} from the static secret injected.*/
+public class BasicExpiringJWTSharedSecretCredentialFactoryBean extends AbstractCredentialFactoryBean<ExpiringJWKCredential> {
+
+ /** The secret to use when creating a BasicJWKCredential.*/
+ @Nullable private String secret;
+
+ /** If the usage type is ENCRYPTION, this is the encryption method this credential supports.*/
+ @Nullable private EncryptionMethod encMethod;
+
+ /** The algorithm ('alg') this credential supports.*/
+ @Nullable private Algorithm alg;
+
+ /**
+ * When the credential expires in seconds since 1970-01-01T0:0:0Z.
+ * 0 seconds represents no expiry. Defaults to 0.
+ */
+ @Nonnull private Duration credentialExpiresAt;
+
+ /** Constructor.*/
+ public BasicExpiringJWTSharedSecretCredentialFactoryBean() {
+ credentialExpiresAt = Duration.ZERO;
+ }
+
+ /**
+ * Set the expiry in seconds since 1970-01-01T0:0:0Z.
+ *
+ * @param expiresAt the expiry.
+ */
+ public void setCredentialExpiresAt(@Nonnull final Duration expiresAt) {
+ credentialExpiresAt = Constraint.isNotNull(expiresAt, "Credential expiry can not be null");
+ }
+
+ /**
+ * Set the encryption method associated with this credential. Can be {@literal null} if this
+ * credential does not support encryption, for example is only used for signing.
+ *
+ * @param method the encryption method. Can be {@literal null}.
+ */
+ public void setEncMethod(@Nullable @NonnullElements final String method) {
+ encMethod = EncryptionMethod.parse(method);
+ }
+
+ /**
+ * Set the algorithm 'alg' associated with this credential.
+ *
+ * @param algorithm the algorithm.
+ */
+ public void setAlg(@Nonnull final Algorithm algorithm) {
+ alg = Constraint.isNotNull(algorithm, "Algorithm 'alg' can not be null");
+ }
+
+ /**
+ * Set the secret to use.
+ *
+ * @param secretIn the secret
+ */
+ public void setSecret(@Nonnull @NotEmpty final String secretIn) {
+ secret = Constraint.isNotEmpty(secretIn, "Secret can not be null or empty");
+ }
+
+ @Override
+ protected ExpiringJWKCredential doCreateInstance() throws Exception {
+
+ final BasicExpiringJWKCredential jwkCredential = new BasicExpiringJWKCredential();
+ jwkCredential.setSecretKey(new SecretKeySpec(JWSAssemblyUtils.getSecretBytes(secret), "NONE"));
+ jwkCredential.setCredentialExpiresAt(credentialExpiresAt);
+ jwkCredential.setEntityId(getEntityID());
+ jwkCredential.setAlgorithm(alg);
+ if (getUsageType() != null) {
+ jwkCredential.setUsageType(Enums.getIfPresent(UsageType.class, getUsageType()).or(UsageType.UNSPECIFIED));
+ } else {
+ jwkCredential.setUsageType(UsageType.UNSPECIFIED);
+ }
+ final List<String> keyNames = getKeyNames();
+ if (keyNames != null) {
+ jwkCredential.getKeyNames().addAll(keyNames);
+ }
+ // Check if usage is encryption at least one algorithm has been set
+ if (UsageType.ENCRYPTION == jwkCredential.getUsageType() && encMethod == null){
+ throw new Exception("Can not create JWK encryption credential without an encryption method specified");
+ }
+ // Set the enc methods
+ if (encMethod != null) {
+ final JWKEncryptionCredentialContext encContext = new JWKEncryptionCredentialContext(encMethod);
+ jwkCredential.getCredentialContextSet().add(encContext);
+ }
+
+ return jwkCredential;
+ }
+
+ @Override
+ public Class<?> getObjectType() {
+ return BasicJWKCredential.class;
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTStaticCredentialFactoryBean.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTStaticCredentialFactoryBean.java
deleted file mode 100644
index 851a31b..0000000
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTStaticCredentialFactoryBean.java
+++ /dev/null
@@ -1,86 +0,0 @@
-package net.shibboleth.oidc.security.impl;
-
-import java.time.Duration;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.crypto.spec.SecretKeySpec;
-
-import org.opensaml.security.credential.UsageType;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.google.common.base.Enums;
-
-import net.shibboleth.idp.profile.spring.factory.AbstractCredentialFactoryBean;
-import net.shibboleth.oidc.security.credential.BasicExpiringJWKCredential;
-import net.shibboleth.oidc.security.credential.BasicJWKCredential;
-import net.shibboleth.oidc.security.credential.ExpiringJWKCredential;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-/** A factory bean for creating a {@link BasicExpiringJWKCredential} from the static secret injected.*/
-//TODO do we need to fix the algorithm here? maybe not, as it depends on its usage
-public class BasicExpiringJWTStaticCredentialFactoryBean extends AbstractCredentialFactoryBean<ExpiringJWKCredential> {
-
- /** Class logger. */
- private final Logger log = LoggerFactory.getLogger(BasicExpiringJWTStaticCredentialFactoryBean.class);
-
- /** The secret to use when creating a BasicJWKCredential.*/
- @Nullable private String secret;
-
- /**
- * When the credential expires in seconds since 1970-01-01T0:0:0Z.
- * 0 seconds represents no expiry. Defaults to 0.
- */
- @Nonnull private Duration credentialExpiresAt;
-
- /** Constructor.*/
- public BasicExpiringJWTStaticCredentialFactoryBean() {
- credentialExpiresAt = Duration.ZERO;
- }
-
- /**
- * Set the expiry in seconds since 1970-01-01T0:0:0Z.
- *
- * @param expiresAt the expiry.
- */
- public void setCredentialExpiresAt(@Nonnull final Duration expiresAt) {
- credentialExpiresAt = Constraint.isNotNull(expiresAt, "Credential expiry can not be null");
- }
-
- /**
- * Set the secret to use.
- *
- * @param secretIn the secret
- */
- public void setSecret(@Nonnull @NotEmpty final String secretIn) {
- secret = Constraint.isNotEmpty(secretIn, "Secret can not be null or empty");
- }
-
- @Override
- protected ExpiringJWKCredential doCreateInstance() throws Exception {
-
- final BasicExpiringJWKCredential jwkCredential = new BasicExpiringJWKCredential();
- jwkCredential.setSecretKey(new SecretKeySpec(JWSAssemblyUtils.getSecretBytes(secret), "NONE"));
- jwkCredential.setCredentialExpiresAt(credentialExpiresAt);
- jwkCredential.setEntityId(getEntityID());
- if (getUsageType() != null) {
- jwkCredential.setUsageType(Enums.getIfPresent(UsageType.class, getUsageType()).or(UsageType.UNSPECIFIED));
- } else {
- jwkCredential.setUsageType(UsageType.UNSPECIFIED);
- }
- final List<String> keyNames = getKeyNames();
- if (keyNames != null) {
- jwkCredential.getKeyNames().addAll(keyNames);
- }
- return jwkCredential;
- }
-
- @Override
- public Class<?> getObjectType() {
- return BasicJWKCredential.class;
- }
-
-}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWKCredentialFactoryBean.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWKCredentialFactoryBean.java
new file mode 100644
index 0000000..569f26f
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWKCredentialFactoryBean.java
@@ -0,0 +1,125 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.text.ParseException;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.FatalBeanException;
+import org.springframework.beans.factory.BeanCreationException;
+import org.springframework.core.io.Resource;
+
+import com.google.common.io.ByteStreams;
+import com.nimbusds.jose.jwk.AsymmetricJWK;
+import com.nimbusds.jose.jwk.JWK;
+import com.nimbusds.jose.jwk.KeyType;
+import com.nimbusds.jose.jwk.OctetSequenceKey;
+
+import net.shibboleth.idp.profile.spring.factory.AbstractCredentialFactoryBean;
+import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+
+/** factory bean for Basic JSON Web Keys (JWK). */
+public class BasicJWKCredentialFactoryBean extends AbstractCredentialFactoryBean<BasicJWKCredential> {
+
+ /** Class logger. */
+ private final Logger log = LoggerFactory.getLogger(BasicJWKCredentialFactoryBean.class);
+
+ /** Where the private key is to be found. */
+ @Nullable private Resource jwkResource;
+
+ /** Should the factory throw an exception if the resource is null?.*/
+ private boolean failIfResourceIsNull;
+
+ /** Constructor.*/
+ public BasicJWKCredentialFactoryBean() {
+ failIfResourceIsNull = true;
+ }
+
+ /**
+ * Should the factory throw an exeception if the resource is null?
+ *
+ * @param flag the flag
+ */
+ public void setFailIfResourceIsNull(final boolean flag) {
+ failIfResourceIsNull = flag;
+ }
+
+ /**
+ * Set the resource containing the private key.
+ *
+ * @param res private key resource, never <code>null</code>
+ */
+ public void setResource(@Nonnull final Resource res) {
+ jwkResource = res;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected BasicJWKCredential doCreateInstance() throws Exception {
+
+ if (jwkResource == null && failIfResourceIsNull) {
+ log.error("{}: No JWK credential provided", getConfigDescription());
+ throw new BeanCreationException("No JWK credential provided");
+ } else if (jwkResource == null) {
+ return null;
+ }
+ JWK jwk = null;
+ BasicJWKCredential jwkCredential = null;
+ try (InputStream is = jwkResource.getInputStream()) {
+ jwk = JWK.parse(new String(ByteStreams.toByteArray(is)));
+ jwkCredential = new BasicJWKCredential();
+ if (jwk.getKeyType() == KeyType.EC || jwk.getKeyType() == KeyType.RSA) {
+ if (jwk.isPrivate()) {
+ jwkCredential.setPrivateKey(((AsymmetricJWK) jwk).toPrivateKey());
+ }
+ jwkCredential.setPublicKey(((AsymmetricJWK) jwk).toPublicKey());
+ } else if (jwk.getKeyType() == KeyType.OCT) {
+ jwkCredential.setSecretKey(((OctetSequenceKey) jwk).toSecretKey());
+ } else {
+ throw new FatalBeanException("Unsupported KeyFile at " + jwkResource.getDescription());
+ }
+ } catch (final IOException | ParseException e) {
+ log.error("{}: Could not decode KeyFile at {}: {}", getConfigDescription(), jwkResource.getDescription(),
+ e);
+ throw new FatalBeanException("Could not decode provided KeyFile " + jwkResource.getDescription(), e);
+ }
+ jwkCredential.setUsageType(CredentialConversionUtil.getUsageType(jwk));
+ jwkCredential.setEntityId(getEntityID());
+ jwkCredential.setAlgorithm(jwk.getAlgorithm());
+ jwkCredential.setKid(jwk.getKeyID());
+ final List<String> keyNames = getKeyNames();
+ if (keyNames != null) {
+ jwkCredential.getKeyNames().addAll(keyNames);
+ }
+ return jwkCredential;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Class<?> getObjectType() {
+ return BasicJWKCredential.class;
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java
new file mode 100644
index 0000000..7d414fc
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTDecryptionConfiguration.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.security.credential.CredentialResolver;
+import org.opensaml.xmlsec.impl.BasicAlgorithmPolicyConfiguration;
+
+import net.shibboleth.oidc.security.DecryptionConfiguration;
+
+/**
+ * Basic implementation of {@link DecryptionConfiguration} for handling JWEs.
+ */
+public class BasicJWTDecryptionConfiguration
+ extends BasicAlgorithmPolicyConfiguration implements DecryptionConfiguration {
+
+ /** The EncryptedKey's credential resolver. */
+ @Nullable private CredentialResolver kekKeyCredentialResolver;
+
+ /** The content encryption key (CEK) resolver.*/
+ @Nullable private CredentialResolver contentEncryptionKeyCredentialResolver;
+
+ @Override
+ @Nullable public CredentialResolver getContentEncryptionKeyCredentialResolver() {
+ return contentEncryptionKeyCredentialResolver;
+ }
+
+ /**
+ * Set the KeyInfoCredentialResolver to use when processing the encrypted content.
+ *
+ * @param resolver the CredentialResolver instance
+ */
+ public void setContentEncryptionKeyCredentialResolver(@Nullable final CredentialResolver resolver) {
+ contentEncryptionKeyCredentialResolver = resolver;
+ }
+
+ @Override
+ @Nullable public CredentialResolver getKEKCredentialResolver() {
+ return kekKeyCredentialResolver;
+ }
+
+ /**
+ * Set the CredentialResolver to use when processing the EncryptedKey (the
+ * Key Encryption Key or KEK).
+ *
+ * @param resolver the CredentialResolver instance
+ */
+ public void setKEKCredentialResolver(@Nullable final CredentialResolver resolver) {
+ kekKeyCredentialResolver = resolver;
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
new file mode 100644
index 0000000..5022b9d
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
@@ -0,0 +1,117 @@
+package net.shibboleth.oidc.security.impl;
+
+import java.util.Collections;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.security.credential.CredentialResolver;
+import org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.oidc.security.DecryptionConfiguration;
+import net.shibboleth.oidc.security.JWTDecryptionParameters;
+import net.shibboleth.oidc.security.JWTDecryptionParametersResolver;
+import net.shibboleth.oidc.security.criterion.DecryptionConfigurationCriterion;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+public class DefaultJWTDecryptionParametersResolver extends AbstractSecurityParametersResolver<JWTDecryptionParameters>
+ implements JWTDecryptionParametersResolver {
+
+ /** Logger. */
+ private final Logger log = LoggerFactory.getLogger(DefaultJWTDecryptionParametersResolver.class);
+
+ @Override
+ public Iterable<JWTDecryptionParameters> resolve(final CriteriaSet criteria) throws ResolverException {
+ final JWTDecryptionParameters params = resolveSingle(criteria);
+ if (params != null) {
+ return Collections.singletonList(params);
+ }
+ return Collections.emptyList();
+ }
+
+ @Override
+ public JWTDecryptionParameters resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ Constraint.isNotNull(criteria, "CriteriaSet was null");
+ Constraint.isNotNull(criteria.get(DecryptionConfigurationCriterion.class),
+ "Resolver requires an instance of DecryptionConfigurationCriterion");
+
+ final JWTDecryptionParameters params = new JWTDecryptionParameters();
+
+ resolveAndPopulateIncludesExcludes(params, criteria,
+ criteria.get(DecryptionConfigurationCriterion.class).getConfigurations());
+
+ params.setContentEncryptionKeyCredentialResolver(resolveContentEncryptionKeyCredentialResolver(criteria));
+ params.setKEKCredentialResolver(resolveKEKCredentialResolver(criteria));
+ //params.setEncryptedKeyResolver(resolveEncryptedKeyResolver(criteria));
+
+ // Add all the runtime criteria into the parameters for later use by the resolvers.
+ criteria.forEach(c -> params.getAdditionalCriteria().add(c));
+
+ logResult(params);
+
+ return params;
+ }
+
+ /**
+ * Resolve and return the effective {@link CredentialResolver} used to
+ * decrypt content encryption keys.
+ *
+ * @param criteria the input criteria being evaluated
+ * @return the effective resolver, or null
+ */
+ @Nullable protected CredentialResolver resolveKEKCredentialResolver(
+ @Nonnull final CriteriaSet criteria) {
+
+ for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
+ .getConfigurations()) {
+ if (config.getKEKCredentialResolver() != null) {
+ return config.getKEKCredentialResolver();
+ }
+ }
+ return null;
+ }
+
+ /**
+ * Resolve and return the effective {@link CredentialResolver} used to resolve
+ * the content encryption key.
+ *
+ * @param criteria the input criteria being evaluated
+ * @return the effective resolver, or null
+ */
+ @Nullable protected CredentialResolver resolveContentEncryptionKeyCredentialResolver(
+ @Nonnull final CriteriaSet criteria) {
+
+ for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
+ .getConfigurations()) {
+ if (config.getContentEncryptionKeyCredentialResolver() != null) {
+ return config.getContentEncryptionKeyCredentialResolver();
+ }
+ }
+ return null;
+ }
+
+
+ /**
+ * Log the resolved parameters.
+ *
+ * @param params the resolved param
+ */
+ protected void logResult(@Nonnull final JWTDecryptionParameters params) {
+ if (log.isDebugEnabled()) {
+ log.debug("Resolved DecryptionParameters:");
+
+ log.debug("\tAlgorithm includes: {}", params.getIncludedAlgorithms());
+ log.debug("\tAlgorithm excludes: {}", params.getExcludedAlgorithms());
+
+ log.debug("\tContent Encryption Key CredentialResolver: {}",
+ params.getContentEncryptionKeyCredentialResolver() != null ? "present" : "null");
+ log.debug("\tKEK CredentialResolver: {}",
+ params.getKEKCredentialResolver() != null ? "present" : "null");
+ }
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java
index f94a120..9da94c1 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataCredentialResolver.java
@@ -171,7 +171,7 @@ public class ProviderMetadataCredentialResolver extends AbstractCriteriaFilterin
* @param criteriaUsage the value from specified criteria
* @return true if the two usage specifiers match for purposes of resolving validation information, false otherwise
*/
- protected boolean matchUsage(@Nonnull final KeyUse metadataUsage, @Nonnull final UsageType criteriaUsage) {
+ private boolean matchUsage(@Nonnull final KeyUse metadataUsage, @Nonnull final UsageType criteriaUsage) {
if (KeyUse.SIGNATURE.equals(metadataUsage) && criteriaUsage == UsageType.SIGNING) {
return true;
} else if (KeyUse.ENCRYPTION.equals(metadataUsage) && criteriaUsage == UsageType.ENCRYPTION) {
@@ -187,7 +187,7 @@ public class ProviderMetadataCredentialResolver extends AbstractCriteriaFilterin
* @param criteriaSet the criteria set being processed
* @return the effective usage value
*/
- @Nonnull protected UsageType getEffectiveUsageInput(@Nonnull final CriteriaSet criteriaSet) {
+ @Nonnull private UsageType getEffectiveUsageInput(@Nonnull final CriteriaSet criteriaSet) {
final UsageCriterion usageCriteria = criteriaSet.get(UsageCriterion.class);
if (usageCriteria != null) {
return usageCriteria.getUsage();
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java
index c8399ef..0a6e650 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java
@@ -30,6 +30,7 @@ import net.shibboleth.idp.profile.config.SecurityConfiguration;
* Class extends SecurityConfiguration to support separate configuration for request object decryption and signature
* validation.
*/
+//TODO split packages?
public class OIDCSecurityConfiguration extends SecurityConfiguration {
/** Configuration used when decrypting request object information. */
@@ -47,6 +48,29 @@ public class OIDCSecurityConfiguration extends SecurityConfiguration {
/** Configuration used when validating id_token JWT signatures. */
@Nullable
private net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> idTokenJwtSignatureValidationConfig;
+
+ /** Configuration used when decrypting JWTs. */
+ @Nullable
+ private net.shibboleth.oidc.security.DecryptionConfiguration idTokenJwtDecryptConfig;
+
+ /**
+ * Set the configuration used to decrypt JWTs.
+ *
+ * @param config configuration used when decrypting JWTs, or null
+ */
+ public void setIdTokenJwtDecryptionConfig(@Nullable final
+ net.shibboleth.oidc.security.DecryptionConfiguration config) {
+ idTokenJwtDecryptConfig = config;
+ }
+
+ /**
+ * Get the configuration used when decrypting JWTs.
+ *
+ * @return configuration used when decrypting JWTs, or null
+ */
+ @Nullable public net.shibboleth.oidc.security.DecryptionConfiguration getIdtokenJwtDecryptionConfig() {
+ return idTokenJwtDecryptConfig;
+ }
/**
* Get the configuration used when decrypting request object information.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list