[java-oidc-common] 15/35: Reposition credential resolvers under BasicJOSEObjectCredentialResolver
Phil Smart
philip.smart at jisc.ac.uk
Tue Sep 20 14:19:15 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=7a1d9cacea48b089878aab3c6cf089c8eb7b9c8f
commit 7a1d9cacea48b089878aab3c6cf089c8eb7b9c8f
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Jul 14 11:29:57 2022 +0100
Reposition credential resolvers under BasicJOSEObjectCredentialResolver
---
.../impl/BasicJOSEObjectCredentialResolver.java | 20 ++++++++------------
.../credential/impl/CriterionCredentialResolver.java | 3 +--
.../impl/ProviderMetadataCredentialResolver.java | 4 ++--
.../shibboleth/oidc/security/impl/JWTDecrypter.java | 15 ++++++++++-----
4 files changed, 21 insertions(+), 21 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
index c3690c4..f9a13d9 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
@@ -7,6 +7,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -31,24 +32,18 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
* A basic implementation of {@link JOSEObjectCredentialResolver}.
*
*/
-public class BasicJOSEObjectCredentialResolver implements JOSEObjectCredentialResolver {
- // TODO support auto-magical filtering ala OpenSAML AbstractCriteriaFilteringCredentialResolver?
- // It's impl, so would have to copy or refactor to common library or promote to API.
+public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
+ implements JOSEObjectCredentialResolver {
+ // TODO AbstractCriteriaFilteringCredentialResolver It's impl, so would have to copy or refactor to
+ // common library or promote to API.
/** Logger. */
private final Logger log = LoggerFactory.getLogger(BasicJOSEObjectCredentialResolver.class);
- /** {@inheritDoc} */
- @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
- final Iterable<Credential> creds = resolve(criteriaSet);
- if (creds.iterator().hasNext()) {
- return creds.iterator().next();
- }
- return null;
- }
@Override
- @Nonnull @NonnullElements public Iterable<Credential> resolve(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
+ @Nonnull @NonnullElements protected Iterable<Credential> resolveFromSource(
+ @Nullable final CriteriaSet criteriaSet) throws ResolverException {
JOSEObjectCriterion joseObjectCriteria = null;
if (criteriaSet != null) {
joseObjectCriteria = criteriaSet.get(JOSEObjectCriterion.class);
@@ -146,5 +141,6 @@ public class BasicJOSEObjectCredentialResolver implements JOSEObjectCredentialRe
}
return credential;
}
+
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
index e86bdcb..ca790a6 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
@@ -42,8 +42,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
*/
//TODO Docs
//TODO Algorithm filters?
-public class CriterionCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
- implements JOSEObjectCredentialResolver {
+public class CriterionCredentialResolver extends BasicJOSEObjectCredentialResolver {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(CriterionCredentialResolver.class);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
index da0f8ff..ec50a34 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
@@ -57,8 +57,8 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
//TODO Docs
//TODO Algorithm filters?
-public class ProviderMetadataCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
- implements InitializableComponent, JOSEObjectCredentialResolver {
+public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentialResolver
+ implements InitializableComponent {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ProviderMetadataCredentialResolver.class);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
index 853a016..d2fe1dd 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
@@ -64,6 +64,7 @@ import com.nimbusds.jwt.JWTParser;
import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.credential.JWKCredential;
import net.shibboleth.oidc.security.credential.impl.JWKEncryptionCredentialContext;
+import net.shibboleth.oidc.security.criterion.JOSEObjectCriterion;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.Criterion;
@@ -72,7 +73,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
* Supports decryption of encrypted JSON Web Tokens using the JSON Web Encryption standard.
* The {@link EncryptedJWT} will be decrypted in-place, with its {@link State} changing to {@link State#DECRYPTED}
- * on successful decryption. Any error will throw a {@link DecryptionException}.
+ * on successful decryption. Any error that occurs decrypting the JWT will throw an {@link DecryptionException}.
*
* <p>A decrypter should be created for each new decryption operation.</p>
*/
@@ -180,7 +181,8 @@ public class JWTDecrypter {
throw new DecryptionException("Decryption can not be attempted, KEK resolver is not available");
}
- final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION),
+ new JOSEObjectCriterion(encryptedObject)));
try {
for (final Credential cred : params.getKEKCredentialResolver().resolve(criteria)) {
@@ -225,7 +227,8 @@ public class JWTDecrypter {
throw new DecryptionException("Decryption can not be attempted, KEK resolver is not available");
}
- final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION),
+ new JOSEObjectCriterion(encryptedObject)));
try {
for (final Credential cred : params.getKEKCredentialResolver().resolve(criteria)) {
@@ -270,7 +273,8 @@ public class JWTDecrypter {
throw new DecryptionException("Decryption can not be attempted, KEK resolver is not available");
}
- final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION),
+ new JOSEObjectCriterion(encryptedObject)));
try {
for (final Credential cred : params.getKEKCredentialResolver().resolve(criteria)) {
@@ -316,7 +320,8 @@ public class JWTDecrypter {
throw new DecryptionException("Decryption can not be attempted, CEK resolver is not available");
}
- final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ final CriteriaSet criteria = buildCriteria(List.of(new UsageCriterion(UsageType.ENCRYPTION),
+ new JOSEObjectCriterion(encryptedObject)));
try {
for (final Credential cred : params.getContentEncryptionKeyCredentialResolver().resolve(criteria)) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list