[java-oidc-common] branch dev/JCOMOIDC-41 updated: Javadoc and checkstyle fixes
Phil Smart
philip.smart at jisc.ac.uk
Thu Sep 22 13:57:54 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=e5263251d67b97b604423600787e6367f37ea199
The following commit(s) were added to refs/heads/dev/JCOMOIDC-41 by this push:
new e526325 Javadoc and checkstyle fixes
e526325 is described below
commit e5263251d67b97b604423600787e6367f37ea199
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Sep 22 14:57:48 2022 +0100
Javadoc and checkstyle fixes
Small code improvements
---
.../oidc/security/JWTDecryptionConfiguration.java | 3 ++
.../oidc/security/JWTDecryptionParameters.java | 3 +-
.../oidc/security/JWTEncryptionConfiguration.java | 2 +-
.../oidc/security/JWTEncryptionParameters.java | 17 +++++++++
.../security/JWTSignatureSigningConfiguration.java | 3 ++
.../security/JWTSignatureSigningParameters.java | 2 +-
.../JWTSignatureSigningParametersResolver.java | 3 ++
.../JWTSignatureValidationConfiguration.java | 2 +-
....java => JWTSignatureValidationParameters.java} | 14 ++++----
... JWTSignatureValidationParametersResolver.java} | 6 ++--
.../context/JWTSecurityParametersContext.java | 10 +++---
.../credential/BasicExpiringJWKCredential.java | 17 +++++++++
.../security/credential/ExpiringJWKCredential.java | 17 +++++++++
.../JWTSignatureSigningConfigurationCriterion.java | 22 +++++++++++-
.../criterion/ProviderMetadataCriterion.java | 3 ++
.../criterion/StaticCredentialCriterion.java | 19 +++++++++-
.../impl/BasicJOSEObjectCredentialResolver.java | 9 +++--
.../impl/CriterionCredentialResolver.java | 1 +
.../impl/LocalJOSEObjectCredentialResolver.java | 2 +-
.../impl/ProviderMetadataCredentialResolver.java | 22 ++++++++----
.../impl/BaseJWTSignatureSecurityHandler.java | 5 +++
.../security/impl/BaseSignedJWTTrustEngine.java | 19 +++++++++-
...piringJWTSharedSecretCredentialFactoryBean.java | 5 +--
.../impl/BasicJWTEncryptionConfiguration.java | 2 +-
.../BasicJWTSignatureSigningConfiguration.java | 3 ++
...BasicJWTSignatureSigningParametersResolver.java | 9 ++---
... BasicJWTSignatureValidationConfiguration.java} | 4 +--
...cJWTSignatureValidationParametersResolver.java} | 35 ++++++++++++-------
.../DefaultJWTDecryptionParametersResolver.java | 11 ++++++
.../DefaultJWTEncryptionParametersResolver.java | 5 ++-
.../impl/ExplicitKeySignedJWTTrustEngine.java | 12 +++++++
.../oidc/security/impl/JWTDecrypter.java | 9 ++---
.../impl/JWTMessageSignatureSecurityHandler.java | 11 ++++++
.../PopulateJWTSignatureSigningParameters.java | 12 +++++--
...pulateJWTSignatureSigningParametersHandler.java | 40 ++++++++++++++++++++++
.../PopulateJWTSignatureValidationParameters.java | 12 +++----
...ateJWTSignatureValidationParametersHandler.java | 12 +++----
...ransportEncryptionAlgorithmsLookupStrategy.java | 2 +-
.../impl/OIDCProviderMetadataResolverTest.java | 18 +---------
.../audit/impl/ClaimSetFromJWTLookupStrategy.java | 19 ++++++----
.../impl/DateBasedJWTClaimAuditExtractor.java | 2 +-
.../impl/StringBasedJWTClaimAuditExtractor.java | 4 ++-
.../StringListBasedJWTClaimAuditExtractor.java | 4 ++-
43 files changed, 324 insertions(+), 108 deletions(-)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionConfiguration.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionConfiguration.java
index f55a1f9..fbac81f 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionConfiguration.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionConfiguration.java
@@ -23,6 +23,9 @@ import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
+/**
+ * The configuration information to use when decrypting encrypted JWTs.
+ */
public interface JWTDecryptionConfiguration extends AlgorithmPolicyConfiguration {
/**
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
index 6b8d2e6..d55ddb3 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTDecryptionParameters.java
@@ -40,6 +40,7 @@ public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
/** Carries additional criterion made available to the resolvers at runtime.*/
@Nonnull final CriteriaSet additionalCriteria;
+ /** Constructor .*/
public JWTDecryptionParameters() {
additionalCriteria = new CriteriaSet();
}
@@ -49,7 +50,7 @@ public class JWTDecryptionParameters extends AlgorithmPolicyParameters {
*
* @return the criteria set.
*/
- public CriteriaSet getAdditionalCriteria() {
+ @Nonnull public CriteriaSet getAdditionalCriteria() {
return additionalCriteria;
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTEncryptionConfiguration.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTEncryptionConfiguration.java
index c1528f4..95a6e73 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTEncryptionConfiguration.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTEncryptionConfiguration.java
@@ -49,7 +49,7 @@ public interface JWTEncryptionConfiguration extends AlgorithmPolicyConfiguration
@Nonnull @NonnullElements @Unmodifiable @NotLive public List<String> getKeyTransportEncryptionAlgorithms();
/**
- * Get the CredentialResolver resolve the content encryption key.
+ * Get the CredentialResolver to resolve the content encryption key.
*
* @return the KeyInfoCredentialResolver instance
*/
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTEncryptionParameters.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTEncryptionParameters.java
index 04601dc..2683b04 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTEncryptionParameters.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTEncryptionParameters.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security;
import javax.annotation.Nullable;
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningConfiguration.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningConfiguration.java
index 91f1d2a..300c9df 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningConfiguration.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningConfiguration.java
@@ -11,6 +11,9 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElemen
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+/**
+ * The configuration information to use when generating a signed JWT.
+ */
public interface JWTSignatureSigningConfiguration extends AlgorithmPolicyConfiguration {
/**
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningParameters.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningParameters.java
index 5fbd842..e0f4148 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningParameters.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningParameters.java
@@ -22,7 +22,7 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
/**
- * The effective parameters to use when generating an JWT signature.
+ * The effective parameters to use when generating a signed JWT.
*/
public class JWTSignatureSigningParameters {
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningParametersResolver.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningParametersResolver.java
index ac79925..da5c761 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningParametersResolver.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureSigningParametersResolver.java
@@ -20,6 +20,9 @@ package net.shibboleth.oidc.security;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.Resolver;
+/**
+ * An interface for components which resolve {@link JWTSignatureSigningParameters} based on a {@link CriteriaSet}.
+ */
public interface JWTSignatureSigningParametersResolver extends Resolver<JWTSignatureSigningParameters, CriteriaSet> {
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationConfiguration.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationConfiguration.java
index 6d349ea..2cf3c1d 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationConfiguration.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationConfiguration.java
@@ -25,7 +25,7 @@ import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
import com.nimbusds.jwt.SignedJWT;
/**
- * The configuration information to use when validating a JWT signature.
+ * The configuration information to use when validating a signed JWT.
*/
public interface JWTSignatureValidationConfiguration extends AlgorithmPolicyConfiguration {
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/SignatureValidationParameters.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationParameters.java
similarity index 81%
rename from oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/SignatureValidationParameters.java
rename to oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationParameters.java
index b814247..ab06577 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/SignatureValidationParameters.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationParameters.java
@@ -22,22 +22,22 @@ import javax.annotation.Nullable;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.xmlsec.AlgorithmPolicyParameters;
+import com.nimbusds.jwt.SignedJWT;
+
/**
- * The effective parameters to use when validating a signature of the given type.
- *
- * @param <T> the token type this validation parameter
+ * The effective parameters to use when validating a signed JWT.
*/
-public class SignatureValidationParameters<T> extends AlgorithmPolicyParameters {
+public class JWTSignatureValidationParameters extends AlgorithmPolicyParameters {
/** The signature trust engine to use. */
- @Nullable private TrustEngine<T> signatureTrustEngine;
+ @Nullable private TrustEngine<SignedJWT> signatureTrustEngine;
/**
* Get the signature trust engine to use.
*
* @return the signature trust engine
*/
- @Nullable public TrustEngine<T> getSignatureTrustEngine() {
+ @Nullable public TrustEngine<SignedJWT> getSignatureTrustEngine() {
return signatureTrustEngine;
}
@@ -46,7 +46,7 @@ public class SignatureValidationParameters<T> extends AlgorithmPolicyParameters
*
* @param engine the signature trust engine
*/
- public void setSignatureTrustEngine(@Nullable final TrustEngine<T> engine) {
+ public void setSignatureTrustEngine(@Nullable final TrustEngine<SignedJWT> engine) {
signatureTrustEngine = engine;
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/SignatureValidationParametersResolver.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationParametersResolver.java
similarity index 78%
rename from oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/SignatureValidationParametersResolver.java
rename to oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationParametersResolver.java
index 3c1a628..f22592c 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/SignatureValidationParametersResolver.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/JWTSignatureValidationParametersResolver.java
@@ -21,10 +21,8 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.Resolver;
/**
- * An interface for components which resolve {@link SignatureValidationParameters} based on a {@link CriteriaSet}.
- *
- * @param <T> the token type.
+ * An interface for components which resolve {@link JWTSignatureValidationParameters} based on a {@link CriteriaSet}.
*/
-public interface SignatureValidationParametersResolver<T> extends Resolver<SignatureValidationParameters<T>, CriteriaSet> {
+public interface JWTSignatureValidationParametersResolver extends Resolver<JWTSignatureValidationParameters, CriteriaSet> {
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
index ac35481..15e4ad8 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/context/JWTSecurityParametersContext.java
@@ -22,12 +22,10 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.BaseContext;
-import com.nimbusds.jwt.SignedJWT;
-
import net.shibboleth.oidc.security.JWTDecryptionParameters;
import net.shibboleth.oidc.security.JWTEncryptionParameters;
import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
-import net.shibboleth.oidc.security.SignatureValidationParameters;
+import net.shibboleth.oidc.security.JWTSignatureValidationParameters;
/**
* A context implementation for storing parameter instances for JWT signature signing and validation, and JWT
@@ -36,7 +34,7 @@ import net.shibboleth.oidc.security.SignatureValidationParameters;
public final class JWTSecurityParametersContext extends BaseContext {
/** Signature validation parameters. */
- @Nullable private SignatureValidationParameters<SignedJWT> signatureValidationParameters;
+ @Nullable private JWTSignatureValidationParameters signatureValidationParameters;
/** Signature signing parameters.*/
@Nullable private JWTSignatureSigningParameters signatureSigningParameters;
@@ -52,7 +50,7 @@ public final class JWTSecurityParametersContext extends BaseContext {
*
* @return the parameters
*/
- @Nullable public SignatureValidationParameters<SignedJWT> getSignatureValidationParameters() {
+ @Nullable public JWTSignatureValidationParameters getSignatureValidationParameters() {
return signatureValidationParameters;
}
@@ -64,7 +62,7 @@ public final class JWTSecurityParametersContext extends BaseContext {
* @return this context
*/
@Nonnull public JWTSecurityParametersContext setSignatureValidationParameters(
- @Nullable final SignatureValidationParameters<SignedJWT> params) {
+ @Nullable final JWTSignatureValidationParameters params) {
signatureValidationParameters = params;
return this;
}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicExpiringJWKCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicExpiringJWKCredential.java
index 5cf2c67..f48ff54 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicExpiringJWKCredential.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicExpiringJWKCredential.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.credential;
import java.time.Duration;
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/ExpiringJWKCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/ExpiringJWKCredential.java
index 46d6940..0fb75ea 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/ExpiringJWKCredential.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/ExpiringJWKCredential.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.credential;
import java.time.Duration;
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/JWTSignatureSigningConfigurationCriterion.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/JWTSignatureSigningConfigurationCriterion.java
index a2d0c49..8987acc 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/JWTSignatureSigningConfigurationCriterion.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/JWTSignatureSigningConfigurationCriterion.java
@@ -1,10 +1,27 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.criterion;
import java.util.List;
import javax.annotation.Nonnull;
-import org.opensaml.xmlsec.criterion.SignatureSigningConfigurationCriterion;
+import org.opensaml.xmlsec.SignatureSigningConfiguration;
import net.shibboleth.oidc.security.JWTSignatureSigningConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
@@ -14,6 +31,9 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.Criterion;
+/**
+ * Criterion which holds one or more instances of {@link JWTSignatureSigningConfigurationCriterion}.
+ */
public class JWTSignatureSigningConfigurationCriterion implements Criterion {
/** The list of configuration instances. */
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/ProviderMetadataCriterion.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/ProviderMetadataCriterion.java
index e0adc18..7adee02 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/ProviderMetadataCriterion.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/ProviderMetadataCriterion.java
@@ -24,6 +24,9 @@ import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.Criterion;
+/**
+ * Proviuder metadata criterion to make decisions based on OpenID Provider information.
+ */
public class ProviderMetadataCriterion implements Criterion {
/** The OIDC provider metadata. */
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/StaticCredentialCriterion.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/StaticCredentialCriterion.java
index 5f638da..56b6e20 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/StaticCredentialCriterion.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/criterion/StaticCredentialCriterion.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.criterion;
import javax.annotation.Nonnull;
@@ -7,7 +24,7 @@ import org.opensaml.security.credential.Credential;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.Criterion;
-/** A {@link Criterion} that holds a single credential.*/
+/** A {@link Criterion} that holds a single, fixed, credential.*/
public class StaticCredentialCriterion implements Criterion {
/** The credential to hold.*/
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
index 1dae249..2fb4e4d 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
@@ -25,7 +25,6 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
-import org.opensaml.xmlsec.keyinfo.impl.KeyInfoResolutionContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -87,7 +86,7 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
header != null ? header.getClass().getName() : "null");
}
- // Extention point for subclasses
+ // Extension point for subclasses
postProcess(criteriaSet, joseObject, credentials);
log.debug("A total of {} credentials were resolved", credentials.size());
@@ -99,8 +98,8 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
/**
* Hook for subclasses to do post-processing of the credential set after all JOSE header keys have been processed.
*
- * For example, the previously resolved credentials might be used to index into a store of local credentials, where
- * the index is a key name or the public half of a key pair extracted from the headers.
+ * <p>For example, the previously resolved credentials might be used to index into a store of local credentials,
+ * where the index is a key name or the public half of a key pair extracted from the headers.</p>
*
* @param criteriaSet the credential criteria used to resolve credentials
* @param joseObject the extracted JOSE object
@@ -111,7 +110,7 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
protected void postProcess(@Nullable final CriteriaSet criteriaSet, @Nonnull final JOSEObject joseObject,
@Nonnull final List<Credential> credentials)
throws ResolverException {
-
+ //no-op
}
/**
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
index 9a8eaa2..2255893 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CriterionCredentialResolver.java
@@ -35,6 +35,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
* Extracts a credential held inside the {@link StaticCredentialCriterion} from the given criteria set.
+ * Supports credential filter via evaluable criterion.
*/
public class CriterionCredentialResolver extends BasicJOSEObjectCredentialResolver {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
index 7f11e47..3c730b9 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
@@ -47,7 +47,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
* A simple specialization of {@link BasicJOSEObjectCredentialResolver}
- * which is capable of using resolving local credentials from a supplied {@link CredentialResolver}
+ * which is capable of resolving local credentials from a supplied {@link CredentialResolver}
* which manages local credentials.
*
* <p>
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
index 936480d..9244d4b 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
@@ -50,12 +50,12 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
- * A {@link LocalJOSEObjectCredentialResolver} that resolves credentials from jwks_uri of an
- * OpenID Provider. Further filtering of credentials is provided by the {@link AbstractCriteriaFilteringCredentialResolver}
- * parent class.
+ * A {@link LocalJOSEObjectCredentialResolver} that resolves credentials from the jwks_uri of an
+ * OpenID Provider. Further filtering of credentials is provided by the
+ * {@link AbstractCriteriaFilteringCredentialResolver} parent class.
*
- * <p>Note, only RSA or EC keys are resolved as these are the only key types which should be exposed in public JWKS
- * documents.</p>
+ * <p>Note, only RSA or EC keys are resolved as these are the only key types which should be exposed in
+ * public JWKS documents.</p>
*/
public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentialResolver
implements InitializableComponent {
@@ -70,8 +70,7 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
@NonnullAfterInit private RemoteJwkSetCache remoteJwkSetCache;
/** The remote key refresh interval. Default value: 30 minutes. */
- @Positive
- private Duration keyFetchInterval = Duration.ofMinutes(30);
+ @Positive private Duration keyFetchInterval = Duration.ofMinutes(30);
/** {@inheritDoc} */
@Override
@@ -124,6 +123,15 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
}
}
+ /**
+ * Fetch the remote JWK Set from the jwk_uri in the OpenID Provider's metadata. Convert each
+ * JWK into a {@link Credential} and return. Only supports EC (key agreement) and RSA (key encryption) keys.
+ *
+ * @param criteriaSet the criteria set
+ * @param metadata the OpenID Provider's metadata
+ *
+ * @return a collection of credentials that represents EC and RSA keys in the remote JWK Set (if any)
+ */
@Nonnull protected Collection<Credential> resolveFromMetadata(@Nonnull final CriteriaSet criteriaSet,
@Nonnull final OIDCProviderMetadata metadata) {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
index 93a63b9..875a27c 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
@@ -47,6 +47,9 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+/**
+ * Base class for SAML security message handlers which evaluate a JWT signature with a signature trust engine.
+ */
public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSecurityHandler<SignedJWT> {
/** Class logger. */
@@ -150,6 +153,8 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
criteriaSet.add( new UsageCriterion(UsageType.SIGNING) );
+ //TODO should we remove this?
+
// final SignedJWTSecurityParametersContext secParamsContext =
// messageContext.getSubcontext(SignedJWTSecurityParametersContext.class);
// if (secParamsContext != null && secParamsContext.getSignatureValidationParameters() != null) {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java
index 7fd80b6..3f1901f 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package net.shibboleth.oidc.security.impl;
import java.security.interfaces.ECPublicKey;
@@ -37,7 +54,7 @@ public abstract class BaseSignedJWTTrustEngine<TrustBasisType> implements TrustE
private final Logger log = LoggerFactory.getLogger(BaseSignedJWTTrustEngine.class);
/** Resolver of credentials from JOSEObject headers. */
- private JOSEObjectCredentialResolver joseObjectCredentialResolver;
+ private final JOSEObjectCredentialResolver joseObjectCredentialResolver;
/**
* Constructor.
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTSharedSecretCredentialFactoryBean.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTSharedSecretCredentialFactoryBean.java
index 5929dd2..e458357 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTSharedSecretCredentialFactoryBean.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicExpiringJWTSharedSecretCredentialFactoryBean.java
@@ -39,7 +39,8 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/** A factory bean for creating a {@link BasicExpiringJWKCredential} from the static secret injected.*/
-public class BasicExpiringJWTSharedSecretCredentialFactoryBean extends AbstractCredentialFactoryBean<ExpiringJWKCredential> {
+public class BasicExpiringJWTSharedSecretCredentialFactoryBean
+ extends AbstractCredentialFactoryBean<ExpiringJWKCredential> {
/** The secret to use when creating a BasicJWKCredential.*/
@Nullable private String secret;
@@ -47,7 +48,7 @@ public class BasicExpiringJWTSharedSecretCredentialFactoryBean extends AbstractC
/** The JCA algorithm to set on the {@link SecretKey}. Defaults to AES.*/
@Nullable private String jcaAlg = "AES";
- /** The algorithm ('alg') this credential supports.*/
+ /** The key management algorithm ('alg') this credential supports.*/
@Nullable private Algorithm alg;
/**
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTEncryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTEncryptionConfiguration.java
index 4ebc71b..f7be589 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTEncryptionConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTEncryptionConfiguration.java
@@ -33,7 +33,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Basic implementation of {@link JWTEncryptionConfiguration}.
+ * Basic implementation of {@link JWTEncryptionConfiguration} for handling JWE encryption.
*/
public class BasicJWTEncryptionConfiguration extends BasicAlgorithmPolicyConfiguration
implements JWTEncryptionConfiguration {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureSigningConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureSigningConfiguration.java
index 3df19c9..68e846a 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureSigningConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureSigningConfiguration.java
@@ -34,6 +34,9 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
+/**
+ * The configuration information to use when generating an signed JWT.
+ */
public class BasicJWTSignatureSigningConfiguration extends BasicAlgorithmPolicyConfiguration
implements JWTSignatureSigningConfiguration {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureSigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureSigningParametersResolver.java
index 223c68e..c6d8400 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureSigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureSigningParametersResolver.java
@@ -49,7 +49,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
*
- * Basic implementation of {@link JWTSignatureSigningParametersResolver}.
+ * Basic implementation of an {@link JWTSignatureSigningParametersResolver}.
*
* <p>
* The following {@link net.shibboleth.utilities.java.support.resolver.Criterion} inputs are supported:
@@ -60,8 +60,8 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
* <p>See also (for the SAML case) {@link BasicSignatureSigningParametersResolver}.</p>
*/
public class BasicJWTSignatureSigningParametersResolver
- extends AbstractSecurityParametersResolver<JWTSignatureSigningParameters>
- implements JWTSignatureSigningParametersResolver {
+ extends AbstractSecurityParametersResolver<JWTSignatureSigningParameters>
+ implements JWTSignatureSigningParametersResolver {
private final Logger log = LoggerFactory.getLogger(BasicJWTSignatureSigningParametersResolver.class);
@@ -148,7 +148,8 @@ public class BasicJWTSignatureSigningParametersResolver
}
/**
- * Validate that the {@link JWTSignatureSigningParameters} instance has all the required properties populated.
+ * Validate that the {@link JWTSignatureSigningParameters} instance has all the required
+ * properties populated.
*
* @param params the parameters instance to evaluate
*
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicSignatureValidationConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureValidationConfiguration.java
similarity index 94%
rename from oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicSignatureValidationConfiguration.java
rename to oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureValidationConfiguration.java
index b064df7..9471a3c 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicSignatureValidationConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureValidationConfiguration.java
@@ -28,9 +28,9 @@ import net.shibboleth.oidc.security.JWTSignatureValidationConfiguration;
/**
- * Basic implementation of {@link JWTSignatureValidationConfiguration}.
+ * Basic implementation of {@link JWTSignatureValidationConfiguration} for signed JWTs.
*/
-public class BasicSignatureValidationConfiguration extends BasicAlgorithmPolicyConfiguration
+public class BasicJWTSignatureValidationConfiguration extends BasicAlgorithmPolicyConfiguration
implements JWTSignatureValidationConfiguration {
/** The signature trust engine to use. */
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/OIDCProviderConfigurationSignatureValidationParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureValidationParametersResolver.java
similarity index 73%
rename from oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/OIDCProviderConfigurationSignatureValidationParametersResolver.java
rename to oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureValidationParametersResolver.java
index 444cd34..d0b5dbc 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/OIDCProviderConfigurationSignatureValidationParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BasicJWTSignatureValidationParametersResolver.java
@@ -23,7 +23,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.trust.TrustEngine;
-
+import org.opensaml.xmlsec.criterion.SignatureValidationConfigurationCriterion;
import org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver;
import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
import org.slf4j.Logger;
@@ -32,29 +32,40 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.security.JWTSignatureValidationConfiguration;
-import net.shibboleth.oidc.security.SignatureValidationParameters;
-import net.shibboleth.oidc.security.SignatureValidationParametersResolver;
+import net.shibboleth.oidc.security.JWTSignatureValidationParameters;
+import net.shibboleth.oidc.security.JWTSignatureValidationParametersResolver;
import net.shibboleth.oidc.security.criterion.JWTSignatureValidationConfigurationCriterion;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
-public class OIDCProviderConfigurationSignatureValidationParametersResolver
- extends AbstractSecurityParametersResolver<SignatureValidationParameters<SignedJWT>>
- implements SignatureValidationParametersResolver<SignedJWT> {
+
+/**
+ * Basic implementation of {@link JWTSignatureValidationParametersResolver}.
+ *
+ * <p>
+ * The following {@link net.shibboleth.utilities.java.support.resolver.Criterion} inputs are supported:
+ * </p>
+ * <ul>
+ * <li>{@link JWTSignatureValidationConfigurationCriterion} - required</li>
+ * </ul>
+ */
+public class BasicJWTSignatureValidationParametersResolver
+ extends AbstractSecurityParametersResolver<JWTSignatureValidationParameters>
+ implements JWTSignatureValidationParametersResolver {
/** Logger. */
@Nonnull
private final Logger log =
- LoggerFactory.getLogger(OIDCProviderConfigurationSignatureValidationParametersResolver.class);
+ LoggerFactory.getLogger(BasicJWTSignatureValidationParametersResolver.class);
/** {@inheritDoc} */
@Override
@Nonnull
- public Iterable<SignatureValidationParameters<SignedJWT>> resolve(@Nonnull final CriteriaSet criteria)
+ public Iterable<JWTSignatureValidationParameters> resolve(@Nonnull final CriteriaSet criteria)
throws ResolverException {
- final SignatureValidationParameters<SignedJWT> params = resolveSingle(criteria);
+ final JWTSignatureValidationParameters params = resolveSingle(criteria);
if (params != null) {
return Collections.singletonList(params);
}
@@ -64,12 +75,12 @@ public class OIDCProviderConfigurationSignatureValidationParametersResolver
/** {@inheritDoc} */
@Override
@Nullable
- public SignatureValidationParameters<SignedJWT> resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
+ public JWTSignatureValidationParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
Constraint.isNotNull(criteria, "CriteriaSet was null");
Constraint.isNotNull(criteria.get(JWTSignatureValidationConfigurationCriterion.class),
"Resolver requires an instance of SignatureValidationConfigurationCriterion");
- final SignatureValidationParameters<SignedJWT> params = new SignatureValidationParameters<>();
+ final JWTSignatureValidationParameters params = new JWTSignatureValidationParameters();
resolveAndPopulateIncludesExcludes(params, criteria,
criteria.get(JWTSignatureValidationConfigurationCriterion.class).getConfigurations());
@@ -86,7 +97,7 @@ public class OIDCProviderConfigurationSignatureValidationParametersResolver
*
* @param params the resolved param
*/
- protected void logResult(@Nonnull final SignatureValidationParameters<SignedJWT> params) {
+ protected void logResult(@Nonnull final JWTSignatureValidationParameters params) {
if (log.isDebugEnabled()) {
log.debug("Resolved JWT SignatureValidationParameters:");
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
index 45c7ea0..73ecabc 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTDecryptionParametersResolver.java
@@ -36,6 +36,16 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
+/**
+ * Basic implementation of {@link JWTDecryptionParametersResolver}.
+ *
+ * <p>
+ * The following {@link net.shibboleth.utilities.java.support.resolver.Criterion} inputs are supported:
+ * </p>
+ * <ul>
+ * <li>{@link JWTDecryptionConfigurationCriterion} - required</li>
+ * </ul>
+ */
public class DefaultJWTDecryptionParametersResolver extends AbstractSecurityParametersResolver<JWTDecryptionParameters>
implements JWTDecryptionParametersResolver {
@@ -64,6 +74,7 @@ public class DefaultJWTDecryptionParametersResolver extends AbstractSecurityPara
params.setContentEncryptionKeyCredentialResolver(resolveContentEncryptionKeyCredentialResolver(criteria));
params.setKEKCredentialResolver(resolveKEKCredentialResolver(criteria));
+
//TODO why not this?
//params.setEncryptedKeyResolver(resolveEncryptedKeyResolver(criteria));
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTEncryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTEncryptionParametersResolver.java
index a77ab90..980054e 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTEncryptionParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DefaultJWTEncryptionParametersResolver.java
@@ -66,8 +66,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
* Basic implementation of an {@link EncryptionParametersResolver}. The resolver delegates much of its functionality
- * to various lookup strategies and credential resolvers. Its main purpose is to compose the results of each strategy
- * and resolver.
+ * to various lookup strategies and credential resolvers. Its main purpose is to compose the results.
*
* <p>The set of usable key transport and data encryption algorithms are determined by injected strategies. The set of
* usable credentials are resolved by {@link CredentialResolver}s found from the {@link JWTEncryptionConfiguration}
@@ -442,7 +441,7 @@ public class DefaultJWTEncryptionParametersResolver extends AbstractSecurityPara
} else if (JWEAlgorithm.Family.AES_GCM_KW.contains(algorithm)
|| JWEAlgorithm.Family.AES_KW.contains(algorithm)) {
- // Key agreement requires a derived key
+ // Key wrapping requires a derived key
final JWKCredential credential =
findCredentialThatSupportsAlgorithm(keyTransportCredentials, algorithm);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
index f4d8869..78ee161 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
@@ -42,6 +42,18 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * An implementation of {@link org.opensaml.xmlsec.signature.support.SignatureTrustEngine} which evaluates the validity
+ * and trustworthiness of JWT signatures.
+ *
+ * <p>
+ * Processing is first performed as described in {@link BaseSignedJWTTrustEngine}. If based on this processing, it is
+ * determined that the token does not present or does not contain a resolveable valid (and trusted) signing
+ * key, then all trusted credentials obtained by the trusted credential resolver will be used to attempt to validate the
+ * signature.
+ * </p>
+ */
public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<Iterable<Credential>>
implements TrustedCredentialTrustEngine<SignedJWT> {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
index a199551..dfe4448 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTDecrypter.java
@@ -86,7 +86,7 @@ public class JWTDecrypter {
/** Class logger. */
private final Logger log = LoggerFactory.getLogger(JWTDecrypter.class);
- /** The OIDC decryption parameters. */
+ /** The JWT decryption parameters. */
private final JWTDecryptionParameters params;
/**
@@ -101,11 +101,12 @@ public class JWTDecrypter {
/**
* Decrypt a JWE object using credentials resolved from the CEK and KEK resolvers
- * inside the decryption parameters.
+ * inside the decryption parameters. Supports Direct Encryption, Key Encryption,
+ * Key Wrapping, and Key Agreement management modes.
*
* @param encryptedObject JWE object to decrypt.
*
- * @return Decrypted request object.
+ * @return Decrypted JWT object.
*
* @throws DecryptionException on failure to decrypt the JWT.
*/
@@ -166,7 +167,7 @@ public class JWTDecrypter {
final CriteriaSet newCriteriaSet = new CriteriaSet();
// Add any additional criteria that have been passed through from the params.
- if (params.getAdditionalCriteria() != null) {
+ if (!params.getAdditionalCriteria().isEmpty()) {
params.getAdditionalCriteria().forEach(newCriteriaSet::add);
}
if (criteria != null) {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java
index d5fcb04..a1389f8 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java
@@ -24,7 +24,9 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
+import org.opensaml.security.trust.TrustEngine;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -37,6 +39,15 @@ import net.shibboleth.utilities.java.support.component.ComponentInitializationEx
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+/**
+ * A {@link MessageHandler} that uses a {@link TrustEngine} to evaluate the signature of a signed JWT.
+ *
+ * <p>Note, if the JWT is not in a signed state an exception will be thrown i.e. JWTs must be signed by
+ * the time this handler executes.</p>
+ *
+ * <p>Also, the JWT must also have claims, otherwise an exception is throw. This restriction could be lifted
+ * if it is feasible to check the signature of a JWT with a null payload - even if pointless?</p>
+ */
public class JWTMessageSignatureSecurityHandler extends BaseJWTSignatureSecurityHandler {
/** Logger. */
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParameters.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParameters.java
index 84536d1..6dfb406 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParameters.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParameters.java
@@ -1,6 +1,5 @@
package net.shibboleth.oidc.security.impl;
-import java.util.Collections;
import java.util.List;
import java.util.function.Function;
@@ -14,7 +13,6 @@ import org.opensaml.profile.action.AbstractHandlerDelegatingProfileAction;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-import org.opensaml.xmlsec.SecurityConfigurationSupport;
import org.opensaml.xmlsec.SignatureSigningConfiguration;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -22,6 +20,7 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.security.JWTSignatureSigningConfiguration;
+import net.shibboleth.oidc.security.JWTSignatureSigningParameters;
import net.shibboleth.oidc.security.JWTSignatureSigningParametersResolver;
import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
@@ -30,6 +29,15 @@ import net.shibboleth.utilities.java.support.component.ComponentInitializationEx
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Action that resolves and populates {@link JWTSignatureSigningParameters} on a {@link JWTSecurityParametersContext}
+ * created/accessed via a lookup function, by default on the outbound message context.
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_MSG_CTX}
+ * @event {@link EventIds#INVALID_SEC_CFG}
+ */
public class PopulateJWTSignatureSigningParameters
extends AbstractHandlerDelegatingProfileAction<PopulateJWTSignatureSigningParametersHandler> {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java
index f1243cb..a87f54e 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureSigningParametersHandler.java
@@ -29,6 +29,9 @@ import org.opensaml.messaging.context.navigate.RecursiveTypedParentContextLookup
import org.opensaml.messaging.handler.AbstractMessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
+import org.opensaml.saml.criterion.RoleDescriptorCriterion;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -51,6 +54,15 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
+/**
+ *
+ * Handler that resolves and populates {@link JWTSignatureSigningParameters} on a {@link JWTSecurityParametersContext}
+ * created/accessed via a lookup function, by default as an immediate child context of the target
+ * {@link MessageContext}.
+ *
+ * <p>Extracts any OpenID client/provider metadata, SAML metadata, and static client credentials
+ * from relying party configuration as criteria to pass to the signing parameters resolver. </p>
+ */
public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessageHandler {
/** Class logger. */
@@ -66,6 +78,9 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
/** Strategy used to look up a per-request {@link JWTSignatureSigningConfiguration} list. */
@NonnullAfterInit private Function<MessageContext, List<JWTSignatureSigningConfiguration>> configurationLookupStrategy;
+ /** Strategy used to look up a SAML metadata context. */
+ @Nonnull private Function<MessageContext, SAMLMetadataContext> metadataContextLookupStrategy;
+
/** Strategy used to look up a OIDC client metadata context. */
@Nonnull private Function<MessageContext, OIDCMetadataContext> oidcClientMetadataContextLookupStrategy;
@@ -84,11 +99,17 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
/** Constructor.*/
public PopulateJWTSignatureSigningParametersHandler() {
+ // Create context by default.
securityParametersContextLookupStrategy = new ChildContextLookup<>(JWTSecurityParametersContext.class, true);
+ // Locate directly under input context.
oidcClientMetadataContextLookupStrategy = new ChildContextLookup<>(OIDCMetadataContext.class);
+ // Locate directly under input context.
oidcProviderMetadataContextLookupStrategy = new ChildContextLookup<>(OIDCProviderMetadataContext.class);
relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class)
.compose(new RecursiveTypedParentContextLookup<>(ProfileRequestContext.class));
+ // Default: msg context -> SAMLPeerEntityContext -> SAMLMetadataContext
+ metadataContextLookupStrategy = new ChildContextLookup<>(SAMLMetadataContext.class).compose(
+ new ChildContextLookup<>(SAMLPeerEntityContext.class));
}
/**
@@ -168,6 +189,19 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
existingParametersContextLookupStrategy = strategy;
}
+ /**
+ * Set lookup strategy for {@link SAMLMetadataContext} for input to resolution.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setMetadataContextLookupStrategy(
+ @Nonnull final Function<MessageContext,SAMLMetadataContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ metadataContextLookupStrategy =
+ Constraint.isNotNull(strategy, "SAMLMetadataContext lookup strategy cannot be null");
+ }
+
/**
* Set the strategy used to look up a per-request {@link JWTSignatureSigningConfiguration} list.
*
@@ -245,6 +279,12 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
}
final CriteriaSet criteria = new CriteriaSet(new JWTSignatureSigningConfigurationCriterion(configs));
+
+ final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(messageContext);
+ if (metadataCtx != null && metadataCtx.getRoleDescriptor() != null) {
+ log.debug("{} Adding metadata to resolution criteria for signing/digest algorithms", getLogPrefix());
+ criteria.add(new RoleDescriptorCriterion(metadataCtx.getRoleDescriptor()));
+ }
// Add client metadata criterion
final OIDCMetadataContext oidcMetadataCtx = oidcClientMetadataContextLookupStrategy.apply(messageContext);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java
index aa959c6..7f2b0c0 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParameters.java
@@ -32,11 +32,9 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import com.nimbusds.jwt.SignedJWT;
-
import net.shibboleth.oidc.security.JWTSignatureValidationConfiguration;
-import net.shibboleth.oidc.security.SignatureValidationParameters;
-import net.shibboleth.oidc.security.SignatureValidationParametersResolver;
+import net.shibboleth.oidc.security.JWTSignatureValidationParameters;
+import net.shibboleth.oidc.security.JWTSignatureValidationParametersResolver;
import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
@@ -45,7 +43,7 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- * Action that resolves and populates {@link SignatureValidationParameters} on a {@link JWTSecurityParametersContext}
+ * Action that resolves and populates {@link JWTSignatureValidationParameters} on a {@link JWTSecurityParametersContext}
* created/accessed via a lookup function, by default on the inbound message context.
*
* @event {@link EventIds#PROCEED_EVENT_ID}
@@ -66,7 +64,7 @@ public class PopulateJWTSignatureValidationParameters
private Function<ProfileRequestContext,List<JWTSignatureValidationConfiguration>> configurationLookupStrategy;
/** Resolver for parameters to store into context. */
- @NonnullAfterInit private SignatureValidationParametersResolver<SignedJWT> resolver;
+ @NonnullAfterInit private JWTSignatureValidationParametersResolver resolver;
/**
* Constructor.
@@ -115,7 +113,7 @@ public class PopulateJWTSignatureValidationParameters
* @param newResolver resolver to use
*/
public void setSignatureValidationParametersResolver(
- @Nonnull final SignatureValidationParametersResolver<SignedJWT> newResolver) {
+ @Nonnull final JWTSignatureValidationParametersResolver newResolver) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
resolver = Constraint.isNotNull(newResolver, "SignatureValidationParametersResolver cannot be null");
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java
index 2d99331..60a9881 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/PopulateJWTSignatureValidationParametersHandler.java
@@ -32,8 +32,8 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.security.JWTSignatureValidationConfiguration;
-import net.shibboleth.oidc.security.SignatureValidationParameters;
-import net.shibboleth.oidc.security.SignatureValidationParametersResolver;
+import net.shibboleth.oidc.security.JWTSignatureValidationParameters;
+import net.shibboleth.oidc.security.JWTSignatureValidationParametersResolver;
import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
import net.shibboleth.oidc.security.criterion.JWTSignatureValidationConfigurationCriterion;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
@@ -45,7 +45,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
- * Handler that resolves and populates {@link SignatureValidationParameters} on a {@link JWTSecurityParametersContext}
+ * Handler that resolves and populates {@link JWTSignatureValidationParameters} on a {@link JWTSecurityParametersContext}
* created/accessed via a lookup function, by default as an immediate child context of the target
* {@link MessageContext}.
*/
@@ -62,7 +62,7 @@ public class PopulateJWTSignatureValidationParametersHandler extends AbstractMes
private Function<MessageContext,List<JWTSignatureValidationConfiguration>> configurationLookupStrategy;
/** Resolver for parameters to store into context. */
- @NonnullAfterInit private SignatureValidationParametersResolver<SignedJWT> resolver;
+ @NonnullAfterInit private JWTSignatureValidationParametersResolver resolver;
/**
* Constructor.
@@ -104,7 +104,7 @@ public class PopulateJWTSignatureValidationParametersHandler extends AbstractMes
* @param newResolver resolver to use
*/
public void setSignatureValidationParametersResolver(
- @Nonnull final SignatureValidationParametersResolver<SignedJWT> newResolver) {
+ @Nonnull final JWTSignatureValidationParametersResolver newResolver) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
resolver = Constraint.isNotNull(newResolver, "SignatureValidationParametersResolver cannot be null");
@@ -144,7 +144,7 @@ public class PopulateJWTSignatureValidationParametersHandler extends AbstractMes
}
try {
- final SignatureValidationParameters<SignedJWT> params = resolver.resolveSingle(
+ final JWTSignatureValidationParameters params = resolver.resolveSingle(
new CriteriaSet(new JWTSignatureValidationConfigurationCriterion(configs)));
paramsCtx.setSignatureValidationParameters(params);
log.debug("{} {} SignatureValidationParameters", getLogPrefix(),
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy.java
index 0b88e00..bad6243 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy.java
@@ -58,7 +58,7 @@ public class ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy
/**
* A strategy to locate the algorithms ('alg') appropriate for the JWT to be encrypted.
- * Can return {@code null} if the metadata does not describe its support algorithms (which is optional).
+ * Can return {@code null} if the metadata does not describe its supported algorithms (which is optional).
*/
@Nonnull
private final Function<OIDCProviderMetadata, List<JWEAlgorithm>> providerKeyTransportAlgorithmsLookupStrategy;
diff --git a/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/OIDCProviderMetadataResolverTest.java b/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/OIDCProviderMetadataResolverTest.java
index c29e72f..a4727a7 100644
--- a/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/OIDCProviderMetadataResolverTest.java
+++ b/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/impl/OIDCProviderMetadataResolverTest.java
@@ -15,7 +15,6 @@
* limitations under the License.
*/
-
package net.shibboleth.oidc.metadata.impl;
import static org.mockito.ArgumentMatchers.any;
@@ -479,22 +478,7 @@ public class OIDCProviderMetadataResolverTest {
class WrongTypeOfCriterion implements Criterion {
}
-
-
- @Test
- void testResponseHandler() throws IOException {
- final OIDCProviderMetadataResponseHandler handler = new OIDCProviderMetadataResponseHandler();
- final BasicHttpResponse httpResponse =
- new BasicHttpResponse(new ProtocolVersion("HTTP", 1, 1), HttpStatus.SC_OK, "OK");
- final ByteArrayEntity entity = new ByteArrayEntity(GOOD_PROVIDER_CONFIGURATION_INFO.getBytes());
- entity.setContentType(new BasicHeader(HttpHeaders.CONTENT_TYPE, "application/json"));
- httpResponse.setEntity(entity);
- final OIDCProviderMetadata metadata = handler.handleResponse(httpResponse);
-
- assertNotNull(metadata);
- assertTrue("https://example.oidc.op.org".equals(metadata.getIssuer().getValue()));
- }
-
+
@Test
void testResponseHandler_WrongMIMEType() throws IOException {
final OIDCProviderMetadataResponseHandler handler = new OIDCProviderMetadataResponseHandler();
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java
index 03d12ab..dea56c9 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java
@@ -28,6 +28,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
@@ -58,15 +59,19 @@ public class ClaimSetFromJWTLookupStrategy implements Function<ProfileRequestCon
@Override
@Nullable public ClaimsSet apply(@Nullable final ProfileRequestContext input) {
final JWT locatedJwt = jwtLookupStrategy.apply(input);
- if (locatedJwt != null) {
- try {
+ if (locatedJwt == null) {
+ return null;
+ }
+ try {
+ final JWTClaimsSet jwtClaims = locatedJwt.getJWTClaimsSet();
+ if (jwtClaims!= null) {
final ClaimsSet claims = new ClaimsSet();
- claims.putAll(locatedJwt.getJWTClaimsSet().toJSONObject());
- return claims;
- } catch (final ParseException e) {
- log.debug("Unable to parse JWT ClaimsSet from JWT",e);
- return null;
+ claims.putAll(jwtClaims.toJSONObject());
+ return claims;
}
+ } catch (final ParseException e) {
+ log.debug("Unable to parse JWT ClaimsSet from JWT",e);
+ return null;
}
return null;
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java
index 2b018e3..d8874c7 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java
@@ -56,7 +56,7 @@ public class DateBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtra
public void setDateTimeFormat(@Nullable @NotEmpty final String format) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- if (format != null) {
+ if (StringSupport.trimOrNull(format) != null) {
dateTimeFormatter = DateTimeFormatter.ofPattern(StringSupport.trimOrNull(format));
}
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java
index b8b3b14..8f2f092 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java
@@ -19,13 +19,15 @@ package net.shibboleth.oidc.profile.audit.impl;
import java.text.ParseException;
+import javax.annotation.Nullable;
+
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
/** A JWT claim extractor function that returns String objects.*/
public class StringBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtractor<String> {
@Override
- protected String doLookup(final ClaimsSet claimsSet) throws ParseException {
+ @Nullable protected String doLookup(final ClaimsSet claimsSet) throws ParseException {
return claimsSet.getStringClaim(getClaimName());
}
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java
index ce7c79b..df51444 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java
@@ -20,13 +20,15 @@ package net.shibboleth.oidc.profile.audit.impl;
import java.text.ParseException;
import java.util.List;
+import javax.annotation.Nullable;
+
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
/** A JWT claim extractor function that returns lists of string objects.*/
public class StringListBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtractor<List<String>> {
@Override
- protected List<String> doLookup(final ClaimsSet claimsSet) throws ParseException {
+ @Nullable protected List<String> doLookup(final ClaimsSet claimsSet) throws ParseException {
return claimsSet.getStringListClaim(getClaimName());
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list