[java-oidc-common] 33/35: Harmonize OIDC config with mainline
Phil Smart
philip.smart at jisc.ac.uk
Tue Sep 20 14:19:33 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=8bf1e0e54d7fb18ace2c89ad0959b05ba4840907
commit 8bf1e0e54d7fb18ace2c89ad0959b05ba4840907
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Sep 20 12:07:41 2022 +0100
Harmonize OIDC config with mainline
---
.../config/OIDCAuthorizationConfiguration.java | 446 ++++++++++++++-------
1 file changed, 305 insertions(+), 141 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index e72eb31..040c63d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -17,6 +17,7 @@
package net.shibboleth.oidc.profile.config;
+import java.security.Principal;
import java.time.Duration;
import java.util.Collection;
import java.util.Collections;
@@ -95,25 +96,12 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
POST
}
- /**
- * Which HTTP method should be used to issue OIDC authentication requests.
- * Supported values are POST and GET. The default is GET.
- */
- @Nonnull private Function<ProfileRequestContext,String> httpRequestMethodLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating authorization code claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- authorizationCodeClaimsSetManipulationStrategyLookupStrategy;
-
/** Whether to make a UserInfo Endpoint request for End-User claims.*/
@Nonnull private Predicate<ProfileRequestContext> retrieveUserInfoEndpointClaims;
/** An override to specify a specific redirect_uri to use over the normally computed one.*/
@Nonnull private Function<ProfileRequestContext, String> redirectUriOverrideLookupStrategy;
- //TODO I think we need a new config class for these 'proxy' attributes
- // because the switch of RP to OP is confusing otherwise
/**
* Lookup function to retrieve the client_id from the given profile request context.
* Typically obtained from the issuer_id of the downstream relying-party (OP).
@@ -139,6 +127,28 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
/** Lookup function to retrieve the scopes requested during authentication.*/
@Nonnull private Function<ProfileRequestContext, Set<String>> scopesLookupStrategy;
+ /** Lookup function to supply the strategy function for translating OIDC ACR claims. */
+ @Nonnull private Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>>
+ acrTranslationStrategyLookupStrategy;
+
+ /** Lookup function to supply the strategy function for translating OIDC ACR claims. */
+ @Nonnull private Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>>
+ amrTranslationStrategyLookupStrategy;
+
+ /** Whether authentication results should carry the proxied auth_time in the id_token. */
+ @Nonnull private Predicate<ProfileRequestContext> proxiedAuthnInstantPredicate;
+
+
+ /**
+ * Which HTTP method should be used to issue OIDC authentication requests.
+ * Supported values are POST and GET. The default is GET.
+ */
+ @Nonnull private Function<ProfileRequestContext,String> httpRequestMethodLookupStrategy;
+
+ /** Lookup function to supply strategy bi-function for manipulating authorization code claims set. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy;
/**
* Constructor.
@@ -155,30 +165,151 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
public OIDCAuthorizationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
- encodeConsentInTokensPredicate = Predicates.alwaysFalse();
- useRequestObjectPredicate = Predicates.alwaysFalse();
+ redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
+ clientIdLookupStrategy = FunctionSupport.constant(null);
+ clientCredentialLookupStrategy = FunctionSupport.constant(null);
+ responseModeLookupStrategy = FunctionSupport.constant(null);
+ responseTypeLookupStrategy = FunctionSupport.constant("code");
+ scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
signRequestObjectPredicate = Predicates.alwaysTrue();
encryptRequestObjectPredicate = Predicates.alwaysFalse();
retrieveUserInfoEndpointClaims = Predicates.alwaysTrue();
+ proxiedAuthnInstantPredicate = Predicates.alwaysTrue();
+ acrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
+ amrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
+ acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
+ encodeConsentInTokensPredicate = Predicates.alwaysFalse();
+ useRequestObjectPredicate = Predicates.alwaysFalse();
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
encodedAttributesLookupStrategy = FunctionSupport.constant(null);
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
- clientIdLookupStrategy = FunctionSupport.constant(null);
- clientCredentialLookupStrategy = FunctionSupport.constant(null);
- responseModeLookupStrategy = FunctionSupport.constant(null);
- responseTypeLookupStrategy = FunctionSupport.constant("code");
- scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
- httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET);
+ httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET.toString());
includeIssuerInResponsePredicate = Predicates.alwaysFalse();
authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
}
+ /**
+ * Get whether all acr claim requests should be treated as Essential.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether all acr claim requests should be treated as Essential
+ */
+ public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
+ return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether all acr claim requests should be treated as Essential.
+ *
+ * @param flag flag to set
+ */
+ public void setAcrRequestAlwaysEssential(final boolean flag) {
+ acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether all acr claim requests should be treated as Essential.
+ *
+ * @param condition condition to set
+ */
+ public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Should authentication request parameters should be passed in a single, self contained, JWT?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return whether authentication request parameters should be passed in a single, self contained, JWT
+ */
+ public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
+ return useRequestObjectPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether the authentication request parameters should be passed in a single, self contained, JWT.
+ *
+ * @param flag flag to set
+ */
+ public void setUseRequestObject(final boolean flag) {
+ useRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether the authentication request parameters should be passed in a single,
+ * self contained, JWT.
+ *
+ * @param condition condition to set
+ */
+ public void setUseRequestObjectPredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
+ }
+
+ /**
+ * Get whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to encode consent in authorization code and access/refresh tokens
+ */
+ public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encodeConsentInTokensPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param flag flag to set
+ */
+ public void setEncodeConsentInTokens(final boolean flag) {
+ encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param condition condition to set
+ */
+ public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to make a request to the UserInfo Endpoint
+ */
+ public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
+ return retrieveUserInfoEndpointClaims.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param flag flag to set
+ */
+ public void setRetrieveUserInfoEndpointClaims(final boolean flag) {
+ retrieveUserInfoEndpointClaims = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param condition condition to set
+ */
+ public void setRetrieveUserInfoEndpointClaims(@Nonnull final Predicate<ProfileRequestContext> condition){
+ retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
/**
* Should the RequestObject (if configured) be signed?
*
@@ -393,124 +524,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
return redirectUriOverrideLookupStrategy.apply(profileRequestContext);
}
- /**
- * Get whether all acr claim requests should be treated as Essential.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether all acr claim requests should be treated as Essential
- */
- public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
- return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether all acr claim requests should be treated as Essential.
- *
- * @param flag flag to set
- */
- public void setAcrRequestAlwaysEssential(final boolean flag) {
- acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether all acr claim requests should be treated as Essential.
- *
- * @param condition condition to set
- */
- public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Should authentication request parameters should be passed in a single, self contained, JWT?
- *
- * @param profileRequestContext the profile request context
- *
- * @return whether authentication request parameters should be passed in a single, self contained, JWT
- */
- public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
- return useRequestObjectPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether the authentication request parameters should be passed in a single, self contained, JWT.
- *
- * @param flag flag to set
- */
- public void setUseRequestObject(final boolean flag) {
- useRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether the authentication request parameters should be passed in a single,
- * self contained, JWT.
- *
- * @param condition condition to set
- */
- public void setUseRequestObjectPredicate(
- @Nonnull final Predicate<ProfileRequestContext> condition) {
- useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
- }
-
- /**
- * Get whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to encode consent in authorization code and access/refresh tokens
- */
- public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
- return encodeConsentInTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param flag flag to set
- */
- public void setEncodeConsentInTokens(final boolean flag) {
- encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param condition condition to set
- */
- public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to make a request to the UserInfo Endpoint
- */
- public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
- return retrieveUserInfoEndpointClaims.test(profileRequestContext);
- }
-
- /**
- * Set whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param flag flag to set
- */
- public void setRetrieveUserInfoEndpointClaims(final boolean flag) {
- retrieveUserInfoEndpointClaims = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param condition condition to set
- */
- public void setRetrieveUserInfoEndpointClaims(@Nonnull final Predicate<ProfileRequestContext> condition){
- retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
/**
* Get authz code lifetime.
*
@@ -776,6 +789,157 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
return scopesLookupStrategy.apply(profileRequestContext);
}
+ /**
+ * Set the lookup function to locate the Authentication Methods References strategy used to translate
+ * between an inbound proxied OIDC AMR into an appropriate set of custom {@link Principal} objects
+ * to populate the subject.
+ *
+ * @param strategy translation function
+ */
+ public void setAuthenticationMethodsReferencesTranslationStrategyLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>> strategy){
+ amrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Get the function used to translate AMRs in the inbound id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
+ *
+ * @param prc current profile request context
+ *
+ * @return translation function
+ */
+ @Nullable public Function<Collection<String>,Collection<Principal>>
+ getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc){
+ return amrTranslationStrategyLookupStrategy.apply(prc);
+ }
+
+ /**
+ * Set the lookup function to locate the Authentication Context Class Reference strategy used to translate
+ * between an inbound proxied OIDC ACR into an appropriate set of custom {@link Principal} objects to
+ * populate the subject.
+ *
+ * @param strategy translation function
+ */
+ public void setAuthenticationContextClassReferenceTranslationStrategyLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>> strategy){
+ acrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Get the function used to translate ACRs in the inbound id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
+ *
+ * @param prc current profile request context
+ *
+ * @return translation function
+ */
+ @Nullable public Function<Collection<String>,Collection<Principal>>
+ getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc){
+ return acrTranslationStrategyLookupStrategy.apply(prc);
+ }
+
+ /**
+ * Gets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's auth_time from the id_token, rather than the current time.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to proxy across the inbound auth_time
+ */
+ public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext) {
+ return proxiedAuthnInstantPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Sets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's auth_time from the id_token, rather than the current time.
+ *
+ * @param flag flag to set
+ *
+ */
+ public void setProxiedAuthnInstant(final boolean flag) {
+ proxiedAuthnInstantPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+ /**
+ * Get whether to include iss parameter in the authentication response.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to include iss parameter in the authentication response
+ *
+ * @since 2.1.0
+ */
+ public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext) {
+ return includeIssuerInResponsePredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to include iss parameter in the authentication response.
+ *
+ * @param flag flag to set
+ *
+ * @since 2.1.0
+ */
+ public void setIncludeIssuerInResponse(final boolean flag) {
+ includeIssuerInResponsePredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether to include iss parameter in the authentication response.
+ *
+ * @param condition condition to set
+ *
+ * @since 2.1.0
+ */
+ public void setIncludeIssuerInResponsePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ includeIssuerInResponsePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Get the bi-function for manipulating authorization code claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return authorizationCodeClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-function for manipulating authorization code claims set.
+ *
+ * @param strategy bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ public void setAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-function for manipulating authorization code claims set.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 2.1.0
+ */
+ public void setAuthorizationCodeClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ strategy) {
+ authorizationCodeClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
+
/**
* Get whether to include iss parameter in the authentication response.
*
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list