[java-oidc-common] 09/35: Add userinfo signature and encrypt/decrypt configuration
Phil Smart
philip.smart at jisc.ac.uk
Tue Sep 20 14:19:09 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=c56818763587a7f612c9d3d87f99d46d40aad705
commit c56818763587a7f612c9d3d87f99d46d40aad705
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jun 17 14:14:53 2022 +0100
Add userinfo signature and encrypt/decrypt configuration
Add authentication request params to RP OIDC config.
---
.../oidc/security/JWTDecryptionParameters.java | 2 +-
.../impl/ExplicitKeySignedJWTTrustEngine.java | 4 +-
.../config/OIDCAuthorizationConfiguration.java | 108 ++++++++++++++++++++-
.../profile/config/OIDCSecurityConfiguration.java | 57 ++++++++++-
4 files changed, 161 insertions(+), 10 deletions(-)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
index 5a996b6..53004be 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
@@ -30,7 +30,7 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
*/
public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
- /** The EncryptedKey's credential resolver. */
+ /** The encrypted content encrypted key's (CEK) credential resolver. */
@Nullable private CredentialResolver kekKeyCredentialResolver;
/** The content encryption key (CEK) resolver.*/
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
index 367e63a..f4d8869 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
@@ -31,6 +31,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.google.common.base.Strings;
+import com.nimbusds.jose.JOSEObject;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
@@ -57,8 +58,7 @@ public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<It
* Constructor.
*
* @param resolver credential resolver used to resolve trusted credentials.
- * @param keyInfoResolver KeyInfo credential resolver used to obtain the (advisory) signing credential from a
- * Signature's KeyInfo element.
+ * @param joseObjectResolver resolver which resolve credentials from the headers of a {@link JOSEObject} instance.
*/
public ExplicitKeySignedJWTTrustEngine(@Nonnull final @ParameterName(name="resolver") CredentialResolver resolver,
@Nonnull final @ParameterName(name="JOSEObjectResolver") JOSEObjectCredentialResolver joseObjectResolver) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 708f902..615e3a0 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -120,10 +120,20 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
@Nonnull private Function<ProfileRequestContext, Credential> clientCredentialLookupStrategy;
/** Lookup function to determine the client_authentication method. */
-// @Nonnull private Function<ProfileRequestContext, ClientAuthentication> clientAuthenticationLookupStrategy;
+ // @Nonnull private Function<ProfileRequestContext, ClientAuthentication> clientAuthenticationLookupStrategy;
//TODO same as tokenEndpointAuthMethodsLookupStrategy?
@Nonnull private Function<ProfileRequestContext, String> clientAuthenticationMethodLookupStrategy;
+ /** Lookup function to override the default response_mode for a given response_type.*/
+ @Nonnull private Function<ProfileRequestContext, String> responseModeLookupStrategy;
+
+ /** Lookup function to retrieve the response_type.*/
+ @Nonnull private Function<ProfileRequestContext, String> responseTypeLookupStrategy;
+
+ /** Lookup function to retrieve the scopes requested during authentication.*/
+ @Nonnull private Function<ProfileRequestContext, Set<String>> scopesLookupStrategy;
+
+
/**
* Constructor.
*/
@@ -150,8 +160,10 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
clientIdLookupStrategy = FunctionSupport.constant(null);
- clientAuthenticationMethodLookupStrategy = FunctionSupport.constant(null);
clientCredentialLookupStrategy = FunctionSupport.constant(null);
+ responseModeLookupStrategy = FunctionSupport.constant(null);
+ responseTypeLookupStrategy = FunctionSupport.constant("code");
+ scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
includeIssuerInResponsePredicate = Predicates.alwaysFalse();
@@ -603,6 +615,98 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /**
+ * Set the lookup strategy to determine the response_mode for authentication requests.
+ *
+ * @param strategy the strategy to use
+ */
+ public void setResponseModeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
+ responseModeLookupStrategy = Constraint.isNotNull(strategy, "ResponseMode lookup strategy can not be null");
+ }
+
+ /**
+ * Get the response_mode to use for authentication requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_mode
+ */
+ public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext) {
+ return responseModeLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the response_mode to use for authentication requests.
+ *
+ * @param responseMode the response_mode to use
+ */
+ public void setResponseMode(@Nonnull final String responseMode) {
+ responseModeLookupStrategy = FunctionSupport.constant(responseMode);
+ }
+
+ /**
+ * Set the lookup strategy to determine the response_type for authentication requests.
+ *
+ * @param strategy the strategy to use
+ */
+ public void setResponseTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
+ responseTypeLookupStrategy = Constraint.isNotNull(strategy, "ResponseType lookup strategy can not be null");
+ }
+
+ /**
+ * Set the response_type to use for authentication requests.
+ *
+ * @param responseType the response_type to use
+ */
+ public void setResponseType(@Nullable final String responseType) {
+ responseTypeLookupStrategy = FunctionSupport.constant(responseType);
+ }
+
+ /**
+ * Get the response_type to use for authentication requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_type
+ */
+ public String getResponseType(@Nullable final ProfileRequestContext profileRequestContext) {
+ return responseTypeLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the lookup strategy to determine the scopes to use for authentication requests.
+ *
+ * @param strategy the strategy to use
+ */
+ public void setScopesLookupStrategy(@Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
+ scopesLookupStrategy = Constraint.isNotNull(strategy, "Scopes lookup strategy can not be null");
+ }
+
+ /**
+ * Set the scopes to use for authentication requests
+ *
+ * @param scopes the scopes
+ */
+ public void setScopes(@Nullable @NonnullElements final Set<String> scopes) {
+ if (scopes == null || scopes.isEmpty()) {
+ scopesLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ scopesLookupStrategy = FunctionSupport.constant(
+ Set.copyOf(StringSupport.normalizeStringCollection(scopes)));
+ }
+ }
+
+ /**
+ * Get the scopes to use in authentication requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the scopes
+ */
+ @Nullable public Set<String> getScopes(@Nullable final ProfileRequestContext profileRequestContext) {
+ return scopesLookupStrategy.apply(profileRequestContext);
+ }
+
/**
* Get whether to include iss parameter in the authentication response.
*
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java
index 0a6e650..814eadc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSecurityConfiguration.java
@@ -49,14 +49,22 @@ public class OIDCSecurityConfiguration extends SecurityConfiguration {
@Nullable
private net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> idTokenJwtSignatureValidationConfig;
- /** Configuration used when decrypting JWTs. */
+ /** Configuration used when decrypting id_tokens. */
@Nullable
private net.shibboleth.oidc.security.DecryptionConfiguration idTokenJwtDecryptConfig;
+ /** Configuration used when decrypting UserInfo tokens. */
+ @Nullable
+ private net.shibboleth.oidc.security.DecryptionConfiguration userInfoJwtDecryptConfig;
+
+ /** Configuration used when validating UserInfo JWT signatures. */
+ @Nullable
+ private net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> userInfoTokenJwtSignatureValidationConfig;
+
/**
- * Set the configuration used to decrypt JWTs.
+ * Set the configuration used to decrypt id_tokens.
*
- * @param config configuration used when decrypting JWTs, or null
+ * @param config configuration used when decrypting id_tokens, or null
*/
public void setIdTokenJwtDecryptionConfig(@Nullable final
net.shibboleth.oidc.security.DecryptionConfiguration config) {
@@ -64,13 +72,32 @@ public class OIDCSecurityConfiguration extends SecurityConfiguration {
}
/**
- * Get the configuration used when decrypting JWTs.
+ * Get the configuration used when decrypting id_tokens.
*
- * @return configuration used when decrypting JWTs, or null
+ * @return configuration used when decrypting id_tokens, or null
*/
@Nullable public net.shibboleth.oidc.security.DecryptionConfiguration getIdtokenJwtDecryptionConfig() {
return idTokenJwtDecryptConfig;
}
+
+ /**
+ * Set the configuration used to decrypt UserInfo JWTs.
+ *
+ * @param config configuration used when decrypting UserInfo JWTs, or null
+ */
+ public void setUserInfoJwtDecryptionConfig(@Nullable final
+ net.shibboleth.oidc.security.DecryptionConfiguration config) {
+ userInfoJwtDecryptConfig = config;
+ }
+
+ /**
+ * Get the configuration used when decrypting UserInfo JWTs.
+ *
+ * @return configuration used when decrypting UserInfo JWTs, or null
+ */
+ @Nullable public net.shibboleth.oidc.security.DecryptionConfiguration getUserInfoJwtDecryptionConfig() {
+ return userInfoJwtDecryptConfig;
+ }
/**
* Get the configuration used when decrypting request object information.
@@ -149,5 +176,25 @@ public class OIDCSecurityConfiguration extends SecurityConfiguration {
@Nullable final net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> config) {
idTokenJwtSignatureValidationConfig = config;
}
+
+ /**
+ * Get the configuration used when validating id_token JWT signatures.
+ *
+ * @return configuration used when validating id_token JWT signatures, or null
+ */
+ @Nullable
+ public net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> getUserInfoTokenJwtSignatureValidationConfig() {
+ return userInfoTokenJwtSignatureValidationConfig;
+ }
+
+ /**
+ * Set the configuration used when validating id_token JWT signatures.
+ *
+ * @param config configuration used when validating id_token JWT signatures, or null
+ */
+ public void setUserInfoTokenJwtSignatureValidationConfig(
+ @Nullable final net.shibboleth.oidc.security.SignatureValidationConfiguration<SignedJWT> config) {
+ userInfoTokenJwtSignatureValidationConfig = config;
+ }
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list