[java-idp-plugin-oidc-rp] branch main updated: Convert authentication request builder actions into message handlers
Phil Smart
philip.smart at jisc.ac.uk
Thu Sep 29 16:35:53 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=38e438fe96757aa87fe2b51ddb32965788d37193
The following commit(s) were added to refs/heads/main by this push:
new 38e438f Convert authentication request builder actions into message handlers
38e438f is described below
commit 38e438fe96757aa87fe2b51ddb32965788d37193
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Sep 29 17:35:47 2022 +0100
Convert authentication request builder actions into message handlers
- these work over the message context object, so seems a better fit
---
.../AbstractOIDCAuthenticationRequestAction.java | 16 +-
...AuthenticationRequestActionMessageHandler.java} | 195 +++++++++------
...actOIDCAuthenticationRequestMessageHandler.java | 10 +-
...thenticationContextClassReferencesHandler.java} | 22 +-
.../impl/AddEndpointURIHandler.java} | 25 +-
.../impl/AddForceAuthenticationPromptHandler.java} | 24 +-
.../impl/AddNonceHandler.java} | 22 +-
.../impl/AddRedirectURIHandler.java} | 43 +---
.../impl/AddRequestedClaimsHandler.java} | 36 +--
.../impl/AddResponseTypeAndModeHandler.java} | 49 +---
.../impl/AddScopesHandler.java} | 19 +-
.../oidc-relying-party-authn-beans.xml | 274 ++++++++++-----------
.../oidc-relying-party-authn-flow.xml | 9 +-
...ticationContextClassReferencesHandlerTest.java} | 23 +-
.../impl/AddEndpointURIHandlerTest.java} | 42 ++--
.../AddForceAuthenticationPromptHandlerTest.java} | 38 +--
.../impl/AddRedirectURIHandlerTest.java} | 48 ++--
.../impl/AddRequestedClaimsHandlerTest.java} | 40 +--
.../impl/AddResponseTypeAndModeHandlerTest.java} | 50 ++--
.../impl/AddScopesHandlerTest.java} | 40 ++-
.../conf/authn/oidc-providermetadata-resolvers.xml | 2 +-
.../src/test/resources/logback-test.xml | 1 +
22 files changed, 456 insertions(+), 572 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java
index d3e3e53..6727aa2 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java
@@ -53,6 +53,8 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
* in-building authentication request.</p>
*
*/
+ at Deprecated
+//because we message handlers to handle the authn request?
public abstract class AbstractOIDCAuthenticationRequestAction extends AbstractAuthenticationAction {
/** Class logger. */
@@ -145,13 +147,13 @@ public abstract class AbstractOIDCAuthenticationRequestAction extends AbstractAu
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
-
- final MessageContext inboundMessageCtx = profileRequestContext.getInboundMessageContext();
- if (inboundMessageCtx == null) {
- log.error("{} No inbound message context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
+//
+// final MessageContext inboundMessageCtx = profileRequestContext.getInboundMessageContext();
+// if (inboundMessageCtx == null) {
+// log.error("{} No inbound message context", getLogPrefix());
+// ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
+// return false;
+// }
final MessageContext outboundMsgContext = profileRequestContext.getOutboundMessageContext();
if (outboundMsgContext == null) {
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestActionMessageHandler.java
similarity index 53%
copy from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java
copy to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestActionMessageHandler.java
index d3e3e53..58194f8 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractOIDCAuthenticationRequestAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestActionMessageHandler.java
@@ -15,51 +15,55 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import java.util.function.Function;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.servlet.http.HttpServletRequest;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
+import org.opensaml.messaging.handler.AbstractMessageHandler;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
+import org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import com.google.common.base.Predicates;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-import net.shibboleth.idp.authn.AbstractAuthenticationAction;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext;
-import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
-/**
- *
- * Abstract class for actions performing operations on a {@link OIDCAuthenticationRequest} located under
- * the outbound message context.
- *
- * <p>Makes available the OpenID Provider metadata context, the applicable profile configuration, and the
- * in-building authentication request.</p>
+/**
+ * An abstract message handler that runs inside an {@link WebFlowMessageHandlerAdaptor}
+ * that provides functions to make available various OIDC contexts.
*
+ * <p>The {@link MessageContext} will either be INBOUND or OUTBOUND depending on the direction defined
+ * by the calling {@link WebFlowMessageHandlerAdaptor} action.</p>
*/
-public abstract class AbstractOIDCAuthenticationRequestAction extends AbstractAuthenticationAction {
-
+public abstract class AbstractOIDCAuthenticationRequestActionMessageHandler extends AbstractMessageHandler {
+
+ /** Lookup function for parent ProfileRequestContext. */
+ @Nonnull private static final ParentProfileRequestContextLookup<MessageContext> PRC_LOOKUP
+ = new ParentProfileRequestContextLookup<>();
+
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractOIDCAuthenticationRequestAction.class);
+ @Nonnull private final Logger log =
+ LoggerFactory.getLogger(AbstractOIDCAuthenticationRequestActionMessageHandler.class);
/** Lookup strategy to locate the OpenID Provider metadata to use.*/
- @Nonnull private Function<ProfileRequestContext, OIDCProviderMetadataContext> providerMetadataLookupStrategy;
+ @Nonnull private Function<MessageContext, OIDCProviderMetadataContext> providerMetadataLookupStrategy;
/** Lookup function for relying party context. */
@Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
@@ -73,42 +77,35 @@ public abstract class AbstractOIDCAuthenticationRequestAction extends AbstractAu
/** Applicable profile configuration. */
@Nullable private OIDCAuthorizationConfiguration profileConfiguration;
- /** Constructor.*/
- protected AbstractOIDCAuthenticationRequestAction() {
+ /** Current HTTP request, if available. */
+ @Nullable private HttpServletRequest httpServletRequest;
+
+ protected AbstractOIDCAuthenticationRequestActionMessageHandler() {
providerMetadataLookupStrategy = new ChildContextLookup<>(OIDCProviderMetadataContext.class).compose(
- new ChildContextLookup<>(OIDCPeerEntityContext.class).compose(
- new OutboundMessageContextLookup()));
+ new ChildContextLookup<>(OIDCPeerEntityContext.class));
relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
}
/**
- * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
- * {@link ProfileRequestContext}.
+ * Get the current HTTP request if available.
*
- * @param strategy lookup strategy
+ * @return current HTTP request
*/
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- relyingPartyContextLookupStrategy =
- Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ @Nullable public HttpServletRequest getHttpServletRequest() {
+ return httpServletRequest;
}
-
+
/**
- * Set the lookup strategy to locate the OpenID providers metadata.
+ * Set the current HTTP request.
*
- * @param strategy the strategy.
+ * @param request current HTTP request
*/
- public void setProviderMetadataLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, OIDCProviderMetadataContext> strategy) {
+ public void setHttpServletRequest(@Nullable final HttpServletRequest request) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- providerMetadataLookupStrategy =
- Constraint.isNotNull(strategy,"Provider metadata lookup strategy can not be null");
- }
+ httpServletRequest = request;
+ }
/**
* Returns the authentication request build by this IdP. Should never be
@@ -140,59 +137,105 @@ public abstract class AbstractOIDCAuthenticationRequestAction extends AbstractAu
@Nullable protected OIDCProviderMetadata getProviderMetadata() {
return providerMetadata;
}
-
+
+ /**
+ * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link ProfileRequestContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ relyingPartyContextLookupStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the lookup strategy to locate the OpenID providers metadata.
+ *
+ * @param strategy the strategy.
+ */
+ public void setProviderMetadataLookupStrategy(
+ @Nonnull final Function<MessageContext, OIDCProviderMetadataContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ providerMetadataLookupStrategy =
+ Constraint.isNotNull(strategy,"Provider metadata lookup strategy can not be null");
+ }
+
+
+ /**
+ * Adapt a {@link ProfileRequestContext} function to a {@link MessageContext} function via composing
+ * with a lookup function.
+ *
+ * @param function the profile request context function
+ * @return the message context function
+ *
+ * @param <T> the output type of the functions
+ */
+ @Nullable protected <T> Function<MessageContext, T> adapt(
+ @Nullable final Function<ProfileRequestContext, T> function) {
+ if (function == null) {
+ return null;
+ }
+ return function.compose(PRC_LOOKUP);
+ }
+
+ /**
+ * Lookup the profile request context from the given message context using the function {@value #PRC_LOOKUP}.
+ *
+ * @param messageContext the message context to find the profile request context from
+ * @return the profile request context, or {@literal null} if not found
+ */
+ @Nullable protected ProfileRequestContext lookupProfileRequestContext(
+ @Nonnull final MessageContext messageContext) {
+ return PRC_LOOKUP.apply(messageContext);
+ }
+
+ /**
+ * Adapt a {@link ProfileRequestContext} predicate into a {@link MessageContext} predicate via composing
+ * with a lookup function.
+ *
+ * @param predicate the profile request context predicate
+ * @return the message context predicate
+ */
+ @Nullable protected Predicate<MessageContext> adapt(@Nullable final Predicate<ProfileRequestContext> predicate) {
+ if (predicate == null) {
+ return null;
+ }
+ return Predicates.compose(predicate::test, PRC_LOOKUP::apply);
+ }
+
@Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
-
+ protected boolean doPreInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
- final MessageContext inboundMessageCtx = profileRequestContext.getInboundMessageContext();
- if (inboundMessageCtx == null) {
- log.error("{} No inbound message context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
+ if (!(messageContext.getMessage() instanceof OIDCAuthenticationRequest)) {
+ throw new MessageHandlerException("Message was not an authentication request");
}
-
- final MessageContext outboundMsgContext = profileRequestContext.getOutboundMessageContext();
- if (outboundMsgContext == null) {
- log.error("{} Outbound message context was null", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- if (!(outboundMsgContext.getMessage() instanceof OIDCAuthenticationRequest)) {
- log.error("{} Outbound message was not an authentication request", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
- authnRequest = (OIDCAuthenticationRequest) outboundMsgContext.getMessage();
+ authnRequest = (OIDCAuthenticationRequest) messageContext.getMessage();
final OIDCProviderMetadataContext providerMetadataContext =
- providerMetadataLookupStrategy.apply(profileRequestContext);
+ providerMetadataLookupStrategy.apply(messageContext);
if (providerMetadataContext == null) {
- log.error("{} No provider metadata context found for peer", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
+ throw new MessageHandlerException("No provider metadata context found for peer");
}
-
providerMetadata = providerMetadataContext.getProviderInformation();
if (providerMetadata == null) {
- log.error("{} No provider metadata found for peer", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
+ throw new MessageHandlerException("No provider metadata context found for peer");
}
-
- final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
+ final RelyingPartyContext rpCtx = adapt(relyingPartyContextLookupStrategy).apply(messageContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
profileConfiguration = (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
}
if (profileConfiguration == null) {
- log.error("{} OIDCCoreProtocolConfiguration not found", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
- return false;
+ throw new MessageHandlerException(" OIDCCoreProtocolConfiguration not found");
}
- return true;
+ return super.doPreInvoke(messageContext);
}
+
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java
index 3be7355..cda0193 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AbstractOIDCAuthenticationRequestMessageHandler.java
@@ -30,13 +30,17 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.OutboundMessageHandlerContext;
+import net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
-/** An abstract message handler that pulls out the {@link OutboundMessageHandlerContext} from the message context.*/
+/**
+ * An abstract message handler that does *not* run inside an {@link WebFlowMessageHandlerAdaptor}
+ * that pulls out the {@link OutboundMessageHandlerContext} from the message context.
+ */
public abstract class AbstractOIDCAuthenticationRequestMessageHandler extends AbstractMessageHandler {
-
+
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(AbstractOIDCAuthenticationRequestMessageHandler.class);
@@ -93,7 +97,7 @@ public abstract class AbstractOIDCAuthenticationRequestMessageHandler extends Ab
@Override
protected boolean doPreInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
-
+
outboundMessageContext = outboundMessageHandlerContextLookupStrategy.apply(messageContext);
if (outboundMessageContext == null) {
log.debug("{} Outbound message context is null", getLogPrefix());
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferences.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java
similarity index 79%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferences.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java
index 666ad04..5600356 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferences.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandler.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import java.security.Principal;
import java.util.List;
@@ -24,36 +24,38 @@ import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.ACR;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProxyAwareDefaultOIDCAuthenticationContextClassRequestLookupFunction;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
/**
- * An action that adds any authentication context class references from the those derived from the
+ * A message handler that adds any authentication context class references from the those derived from the
* profile config - which may be proxied and mapped from the original request.
*/
-public class AddAuthenticationContextClassReferences extends AbstractOIDCAuthenticationRequestAction {
+public class AddAuthenticationContextClassReferencesHandler
+ extends AbstractOIDCAuthenticationRequestActionMessageHandler {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddAuthenticationContextClassReferences.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddAuthenticationContextClassReferencesHandler.class);
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
+ @Override protected void doInvoke(@Nonnull final MessageContext messageContext)
+ throws MessageHandlerException {
- final List<ACR> acrs = buildRequestedAuthnContext(profileRequestContext);
+ final List<ACR> acrs = buildRequestedAuthnContext(lookupProfileRequestContext(messageContext));
if (acrs != null) {
log.debug("{} setting ACRs to '{}' for client '{}'", getLogPrefix(), acrs,
getAuthenticationRequest().getClientID());
getAuthenticationRequest().setAcrs(acrs);
} else {
- log.debug("{} no ACRs requested for client '{}'", getLogPrefix(), getAuthenticationRequest().getClientID());
+ log.debug("{} no ACRs requested for client '{}'", getLogPrefix(),
+ getAuthenticationRequest().getClientID());
}
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURI.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandler.java
similarity index 64%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURI.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandler.java
index 3e4d715..e95b271 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURI.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandler.java
@@ -15,37 +15,30 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import javax.annotation.Nonnull;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.oidc.profile.core.OidcEventIds;
-
/**
- * An action that adds the authorization endpoint URI from the providers metadata
+ * A message handler that adds the authorization endpoint URI from the providers metadata
* to the under constructions authentication request. If an authorization endpoint does
* not exist, an error event is returned.
*/
-public class AddEndpointURI extends AbstractOIDCAuthenticationRequestAction {
+public class AddEndpointURIHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddEndpointURI.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddEndpointURIHandler.class);
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
+ @Override protected void doInvoke(@Nonnull final MessageContext messageContext)
+ throws MessageHandlerException {
if (getProviderMetadata().getAuthorizationEndpointURI() == null) {
- log.error("{} OAuth 2.0 Authorization Endpoint URI not found in provider metadata",
- getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_AUTHZ_ENDPOINT_URI);
- return;
+ throw new MessageHandlerException("OAuth 2.0 Authorization Endpoint URI not found in provider metadata");
}
getAuthenticationRequest().setEndpointURI(getProviderMetadata().getAuthorizationEndpointURI());
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddForceAuthenticationPrompt.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandler.java
similarity index 68%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddForceAuthenticationPrompt.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandler.java
index d184761..87fefdd 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddForceAuthenticationPrompt.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandler.java
@@ -15,44 +15,38 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import javax.annotation.Nonnull;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.Prompt;
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-
/**
* An action that sets the 'prompt' parameter to 'login' if force authn was requested by the upstream SP - is
* is overridden in the profile config.
*/
-public class AddForceAuthenticationPrompt extends AbstractOIDCAuthenticationRequestAction {
+public class AddForceAuthenticationPromptHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddForceAuthenticationPrompt.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddForceAuthenticationPromptHandler.class);
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
+ @Override protected void doInvoke(@Nonnull final MessageContext messageContext)
+ throws MessageHandlerException {
- if (getProfileConfiguration().isForceAuthn(profileRequestContext)) {
+ if (getProfileConfiguration().isForceAuthn(lookupProfileRequestContext(messageContext))) {
log.debug("{} Setting prompt=login (ForceAuthn) for OIDC AuthnRequest for client '{}'", getLogPrefix(),
getAuthenticationRequest().getClientID());
try {
getAuthenticationRequest().setPrompt(Prompt.parse(Prompt.Type.LOGIN.toString()));
} catch (final ParseException e) {
// This should never happen
- log.error("{} Unable to honour force-authn, setting prompt to 'login' failed", getLogPrefix(), e);
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
- return;
+ throw new MessageHandlerException("Unable to honour force-authn, setting prompt to 'login' failed", e);
}
} else {
log.debug("{} No ForceAuthn requirement, so no prompt set for client '{}'", getLogPrefix(),
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddNonce.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddNonceHandler.java
similarity index 77%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddNonce.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddNonceHandler.java
index cfb6e16..af40a5c 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddNonce.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddNonceHandler.java
@@ -15,36 +15,38 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.Nonce;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.impl.OIDCProxySupport;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- * An action that adds a nonce from a lookup strategy to the authentication request.
+ * A message handler that adds a nonce from a lookup strategy to the authentication request.
* The injected nonce generation strategy could generate a {@literal null} nonce.
*/
-public class AddNonce extends AbstractOIDCAuthenticationRequestAction {
+public class AddNonceHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddNonce.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddNonceHandler.class);
/** Strategy used to generate a nonce. Could generate a {@literal null} nonce.*/
@Nonnull private Function<ProfileRequestContext, Nonce> nonceGenerationStrategy;
/** Constructor.*/
- public AddNonce() {
+ public AddNonceHandler() {
// Simple strategy that uses a secure random implementation to generate a nonce of length 16
nonceGenerationStrategy = prc -> new Nonce(OIDCProxySupport.generateNonce(16));
}
@@ -61,12 +63,12 @@ public class AddNonce extends AbstractOIDCAuthenticationRequestAction {
nonceGenerationStrategy = Constraint.isNotNull(strategy, "Nonce generation strategy can not be null");
}
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
+ @Override protected void doInvoke(@Nonnull final MessageContext messageContext)
+ throws MessageHandlerException {
- getAuthenticationRequest().setNonce(nonceGenerationStrategy.apply(profileRequestContext));
+ getAuthenticationRequest().setNonce(
+ nonceGenerationStrategy.apply(lookupProfileRequestContext(messageContext)));
log.debug("{} Added nonce '{}' to authentication request for client '{}'",getLogPrefix(),
getAuthenticationRequest().getNonce(), getAuthenticationRequest().getClientID());
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRedirectURI.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandler.java
similarity index 66%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRedirectURI.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandler.java
index cafd3f9..188bfb5 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRedirectURI.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandler.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import java.net.URI;
import java.util.function.BiFunction;
@@ -27,12 +27,12 @@ import javax.servlet.http.HttpServletRequest;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.RecursiveTypedParentContextLookup;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -40,38 +40,16 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- * Action that adds a redirect_uri to the authentication request.
+ * A message handler that adds a redirect_uri to the authentication request.
*/
-public class AddRedirectURI extends AbstractOIDCAuthenticationRequestAction {
+public class AddRedirectURIHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
/** Logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddRedirectURI.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddRedirectURIHandler.class);
/** Function to create a suitable redirect URI from the given servlet request and profile request context.*/
@NonnullAfterInit private BiFunction<HttpServletRequest, ProfileRequestContext, URI> redirectUriCreationStrategy;
-
- /** Locat the profile request context from the given message context. */
- @Nonnull private Function<MessageContext, ProfileRequestContext> locateProfileRequestContextStrategy;
-
- /** Constructor.*/
- public AddRedirectURI() {
- locateProfileRequestContextStrategy = new RecursiveTypedParentContextLookup<>(ProfileRequestContext.class);
- }
-
- /**
- * Set the strategy used to locate the profile request context from the message context.
- *
- * @param strategy the strategy.
- */
- public void setLocateProfileRequestContextStrategy(@Nonnull
- final Function<MessageContext, ProfileRequestContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
- locateProfileRequestContextStrategy =
- Constraint.isNotNull(strategy, "LocateProfileRequestStrategy cannot be null");
- }
-
/**
* Set the creation strategy used to compute or lookup a redirect URI.
*
@@ -97,16 +75,13 @@ public class AddRedirectURI extends AbstractOIDCAuthenticationRequestAction {
}
}
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
+ @Override protected void doInvoke(@Nonnull final MessageContext messageContext)
+ throws MessageHandlerException {
final URI redirectUri =
- redirectUriCreationStrategy.apply(getHttpServletRequest(), profileRequestContext);
+ redirectUriCreationStrategy.apply(getHttpServletRequest(), lookupProfileRequestContext(messageContext));
if (redirectUri == null) {
- log.error("{} Redirect URI could not be located or created using the strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_REDIRECT_URI);
- return;
+ throw new MessageHandlerException("Redirect URI could not be located or created using the strategy");
}
log.trace("{} Created redirect_uri '{}'", getLogPrefix(), redirectUri);
getAuthenticationRequest().setRedirectURI(redirectUri);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaims.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java
similarity index 72%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaims.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java
index 4be3ca6..322f827 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaims.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandler.java
@@ -15,38 +15,39 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * An action that adds requested claims to the under constructions authentication request.
+ * A message handler that adds requested claims to the under constructions authentication request.
*
* <p>The claims are added from a customizable strategy/hook. No additional claims are provided by default.</p>
*/
-public class AddRequestedClaims extends AbstractOIDCAuthenticationRequestAction {
+public class AddRequestedClaimsHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddRequestedClaims.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddRequestedClaimsHandler.class);
/** A hook that creates requested claims JSON Object from the profile request object.*/
@Nonnull private Function<ProfileRequestContext, OIDCClaimsRequest> requestedClaimsHook;
/** Constructor.*/
- public AddRequestedClaims() {
+ public AddRequestedClaimsHandler() {
requestedClaimsHook = FunctionSupport.constant(null);
}
@@ -64,33 +65,22 @@ public class AddRequestedClaims extends AbstractOIDCAuthenticationRequestAction
}
}
- @Override
- protected boolean doPreExecute(final ProfileRequestContext profileRequestContext,
- final AuthenticationContext authenticationContext) {
-
- if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
- return false;
- }
+ @Override protected void doInvoke(@Nonnull final MessageContext messageContext)
+ throws MessageHandlerException {
if (!getProviderMetadata().supportsClaimsParam()) {
log.trace("{} OpenID Provider does not support the 'claims' parameter", getLogPrefix());
- return false;
+ return;
}
- return true;
- }
-
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
-
- final OIDCClaimsRequest requestedClaims = requestedClaimsHook.apply(profileRequestContext);
+ final OIDCClaimsRequest requestedClaims =
+ requestedClaimsHook.apply(lookupProfileRequestContext(messageContext));
if (requestedClaims != null) {
getAuthenticationRequest().setRequestedClaims(requestedClaims);
log.trace("{} Added requested claims '{}' to the authentication request for client '{}'",getLogPrefix(),
requestedClaims, getAuthenticationRequest().getClientID());
} else {
- log.trace("{} No individual 'claims' requested claims", getLogPrefix());
+ log.trace("{} No individual claims requested", getLogPrefix());
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndMode.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java
similarity index 75%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndMode.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java
index 2ebdf04..0a8091a 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndMode.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandler.java
@@ -15,69 +15,46 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ResponseMode;
import com.nimbusds.oauth2.sdk.ResponseType;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.profile.IdPEventIds;
-
/**
- * Action that populates the authentication request response_mode and response_type from various stratagies,
+ * Action that populates the authentication request response_mode and response_type from various strategies,
* by default from the profile configuration.
*
* <p>Unless explicitly set, the default response_mode for the specified response_type will be used.</p>
*/
-public class AddResponseTypeAndMode extends AbstractOIDCAuthenticationRequestAction {
+public class AddResponseTypeAndModeHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
/** The Default response type if none is selected.*/
@Nonnull private static final ResponseType DEFAULT_RESPONSE_TYPE = ResponseType.CODE;
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddResponseTypeAndMode.class);
-
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddResponseTypeAndModeHandler.class);
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
-
- if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
- return false;
- }
-
- // Fail fast here in case there is no inbound context to pull information from.
- if (profileRequestContext.getInboundMessageContext() == null) {
- log.debug("{} Inbound message context was null", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
-
- return true;
- }
- /** {@inheritDoc} */
- @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
+ @Override protected void doInvoke(@Nonnull final MessageContext messageContext)
+ throws MessageHandlerException {
- final String responseTypeFromProfile = getProfileConfiguration().getResponseType(profileRequestContext);
+ final String responseTypeFromProfile =
+ getProfileConfiguration().getResponseType(lookupProfileRequestContext(messageContext));
final ResponseType responseType = parseResponseType(responseTypeFromProfile);
if (responseType == null){
- log.error("{} Response_type '{}' is not supported", getLogPrefix(), responseTypeFromProfile);
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
- return;
+ throw new MessageHandlerException("Response_type '"+responseTypeFromProfile+"' is not supported");
}
- final String responseModeFromProfile = getProfileConfiguration().getResponseMode(profileRequestContext);
+ final String responseModeFromProfile =
+ getProfileConfiguration().getResponseMode(lookupProfileRequestContext(messageContext));
final ResponseMode responseModeOverride = parseResponseMode(responseModeFromProfile);
final ResponseMode compatibleMode = ResponseMode.resolve(null, responseType);
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddScopes.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandler.java
similarity index 72%
rename from idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddScopes.java
rename to idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandler.java
index be6231a..c6fb212 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddScopes.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandler.java
@@ -15,31 +15,30 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import java.util.Set;
import javax.annotation.Nonnull;
-import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-
/**
- * An action that adds the scopes from the profile request object to the under constructions authentication request.
+ * A message handler that adds the scopes from the profile request object to the authentication request.
*/
-public class AddScopes extends AbstractOIDCAuthenticationRequestAction {
+public class AddScopesHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddScopes.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddScopesHandler.class);
@Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
+ protected void doInvoke(@Nonnull final MessageContext messageContext)
+ throws MessageHandlerException {
- final Set<String> scopes = getProfileConfiguration().getScopes(profileRequestContext);
+ final Set<String> scopes = getProfileConfiguration().getScopes(lookupProfileRequestContext(messageContext));
if (scopes != null && !scopes.isEmpty()) {
scopes.forEach(s -> getAuthenticationRequest().getScope().add(s));
}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 72ae80c..71a860d 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -100,90 +100,84 @@
<bean id="PostLookupPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostLookupAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostLookupAuditExtractors')}" />
-
+
<bean id="InitializeAuthorizationRequest"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeAuthorizationRequest" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
- <bean id="AddResponseTypeAndMode" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddResponseTypeAndMode"
- p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
-
- <bean id="AddScopes" scope="prototype" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddScopes"
- p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
-
- <bean id="AddNonce" scope="prototype" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddNonce"
- p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
-
- <bean id="AddEndpointURI" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddEndpointURI"
- p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
-
- <bean id="AddRequestedClaims" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddRequestedClaims"
- p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
- p:requestedClaimsHook="#{getObject('shibboleth.authn.oidc.rp.RequestedClaimsHook')}" />
-
-
- <bean id="AddRedirectURI" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddRedirectURI"
- p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:redirectUriCreationStrategy="#{getObject('shibboleth.authn.oidc.rp.RedirectUriCreationStrategy') ?: getObject('shibboleth.authn.oidc.rp.DefaultRedirectUriCreationStrategy')}" />
-
- <bean id="AddAuthenticationContextClassReferences" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddAuthenticationContextClassReferences"
- p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
-
- <bean id="AddForceAuthenticationPrompt" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.AddForceAuthenticationPrompt"
- p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
+ <!-- Construct a suitable outbound authentication request -->
+ <bean id="BuildAuthenticationRequest" parent="NestedWebFlowMessageHandlerAdaptor" scope="prototype"
+ c:executionDirection="OUTBOUND">
+ <constructor-arg>
+ <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
+ <property name="handlers">
+ <list>
+ <bean id="AddResponseTypeAndMode" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddResponseTypeAndModeHandler"/>
+ <bean id="AddScopes" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddScopesHandler"/>
+ <bean id="AddNonce" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddNonceHandler"/>
+ <bean id="AddEndpointURI" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddEndpointURIHandler"/>
+ <bean id="AddRequestedClaims" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddRequestedClaimsHandler"
+ p:requestedClaimsHook="#{getObject('shibboleth.authn.oidc.rp.RequestedClaimsHook')}" />
+ <bean id="AddRedirectURI" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddRedirectURIHandler"
+ p:httpServletRequest-ref="shibboleth.HttpServletRequest"
+ p:redirectUriCreationStrategy="#{getObject('shibboleth.authn.oidc.rp.RedirectUriCreationStrategy') ?:
+ getObject('shibboleth.authn.oidc.rp.DefaultRedirectUriCreationStrategy')}" />
+ <bean id="AddAuthenticationContextClassReferences" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddAuthenticationContextClassReferencesHandler"/>
+ <bean id="AddForceAuthenticationPrompt" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddForceAuthenticationPromptHandler" />
+ </list>
+ </property>
+ </bean>
+ </constructor-arg>
+ <property name="errorEvent">
+ <util:constant static-field="org.opensaml.profile.action.EventIds.INVALID_MESSAGE" />
+ </property>
+ </bean>
+
<bean id="PostRequestPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostRequestAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostRequestAuditExtractors')}" />
-
+
<bean id="WriteAuditLog" class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:formattingMap-ref="shibboleth.AuditFormattingMap"
p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
-
-
+
+
<!-- Build RequestObject if required -->
<bean id="RequestObjectRequiredAndSupportedPredicate"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.RequestObjectRequiredAndSupported" />
- <bean id="SignRequestObjectProxyCondition"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.SignRequestObjectPredicate"
- p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.Proxy.RelyingPartyContext"/>
- <bean id="SignRequestObjectCondition"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.SignRequestObjectPredicate"
- p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.RelyingParty"/>
-
- <bean id="EncryptRequestObjectCondition"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.EncryptRequestObjectPredicate"
- p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.RelyingParty"/>
-
+ <bean id="SignRequestObjectProxyCondition"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.SignRequestObjectPredicate"
+ p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.Proxy.RelyingPartyContext" />
+ <bean id="SignRequestObjectCondition"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.SignRequestObjectPredicate"
+ p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.RelyingParty" />
+
+ <bean id="EncryptRequestObjectCondition"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.EncryptRequestObjectPredicate"
+ p:relyingPartyContextLookupStrategy-ref="shibboleth.ChildLookup.RelyingParty" />
+
<bean id="PopulateRequestObjectSignatureSigningParameters" scope="prototype"
class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters"
- c:strategy-ref="shibboleth.ChildLookup.Proxy.MessageContextLookup.Inbound"
- p:noResultIsError="true"
+ c:strategy-ref="shibboleth.ChildLookup.Proxy.MessageContextLookup.Inbound" p:noResultIsError="true"
p:configurationLookupStrategy-ref="RequestObjectSignatureSigningConfigurationLookup"
p:providerMetadataContextLookupStrategy-ref="shibboleth.ChildLookup.OIDCProviderMetadataContextFromOutbound"
p:signatureSigningParametersResolver-ref="shibboleth.authn.oidc.rp.RequestObjectSignatureSigningParametersResolver"
- p:activationCondition-ref="SignRequestObjectProxyCondition"/>
+ p:activationCondition-ref="SignRequestObjectProxyCondition" />
<bean id="shibboleth.authn.oidc.rp.RequestObjectSignatureSigningParametersResolver"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.RelyingPartyProxySigningParametersResolver"
@@ -196,16 +190,16 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectSignatureSigningConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
-
+
<bean id="PopulateRequestObjectEncryptionParameters"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.PopulateJWTEncryptionParameters" scope="prototype"
p:forFriendlyName="Request Object"
p:configurationLookupStrategy-ref="RequestObjectEncryptionConfigurationLookup"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:providerMetadataContextLookupStrategy-ref="shibboleth.ChildLookup.OIDCProviderMetadataContextFromOutbound"
- p:encryptionParametersResolver-ref="shibboleth.authn.oidc.rp.EncryptionParametersResolver"
- p:activationCondition-ref="EncryptRequestObjectCondition"/>
-
+ p:encryptionParametersResolver-ref="shibboleth.authn.oidc.rp.EncryptionParametersResolver"
+ p:activationCondition-ref="EncryptRequestObjectCondition" />
+
<bean id="RequestObjectEncryptionConfigurationLookup" lazy-init="true"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectEncryptionConfigurationLookupFunction"
p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyConfigurationResolver" />
@@ -214,28 +208,31 @@
<bean id="shibboleth.authn.oidc.rp.EncryptionParametersResolver"
class="net.shibboleth.oidc.security.impl.DefaultJWTEncryptionParametersResolver">
<property name="keyTransportEncryptionAlgorithmsLookupStrategy">
- <bean class="net.shibboleth.oidc.security.impl.ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy">
+ <bean
+ class="net.shibboleth.oidc.security.impl.ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy">
<constructor-arg>
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectKeyTransportAlgorithmsLookupFunction"/>
+ <bean
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectKeyTransportAlgorithmsLookupFunction" />
</constructor-arg>
</bean>
</property>
<property name="dataEncryptionAlgorithmsLookupStrategy">
<bean class="net.shibboleth.oidc.security.impl.ProviderMetadataDataEncryptionAlgorithmsLookupStrategy">
<constructor-arg>
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectEncryptionMethodsLookupFunction"/>
+ <bean
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.ProviderRequestObjectEncryptionMethodsLookupFunction" />
</constructor-arg>
</bean>
</property>
-
+
</bean>
-
-
+
+
<bean id="BuildRequestObject" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.BuildRequestObject"
scope="prototype" p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
- p:claimsSetIsValidPredicate="#{getObject('shibboleth.authn.oidc.rp.RequestObjectClaimsSetIsValidPredicate')}"
- p:requestObjectToBeSignedPredicate-ref="SignRequestObjectCondition"/>
+ p:claimsSetIsValidPredicate="#{getObject('shibboleth.authn.oidc.rp.RequestObjectClaimsSetIsValidPredicate')}"
+ p:requestObjectToBeSignedPredicate-ref="SignRequestObjectCondition" />
<!-- Message Encoder factory is a prototype to allow reuse of the encoders -->
@@ -275,25 +272,28 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.BuildPlainRequestObjectJWT"
scope="prototype" />
- <bean id="SignRequestObject"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.SignJWT" scope="prototype"
- p:forFriendlyName="RequestObject">
+ <bean id="SignRequestObject" class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.SignJWT"
+ scope="prototype" p:forFriendlyName="RequestObject">
<property name="claimsToSignLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.JWTClaimsSetFromRequestObjectLookupFunction"/>
+ <bean
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.JWTClaimsSetFromRequestObjectLookupFunction" />
</property>
- <property name="jwtUpdateConsumer">
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectTokenUpdateStrategy"/>
+ <property name="jwtUpdateConsumer">
+ <bean
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectTokenUpdateStrategy" />
</property>
- </bean>
-
+ </bean>
+
<bean id="EncryptRequestObject"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.EncryptJWT" scope="prototype"
p:forFriendlyName="RequestObject">
<property name="payloadToEncryptLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.PayloadFromRequestObjectLookupFunction"/>
+ <bean
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.PayloadFromRequestObjectLookupFunction" />
</property>
<property name="jwtUpdateConsumer">
- <bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectTokenUpdateStrategy"/>
+ <bean
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.RequestObjectTokenUpdateStrategy" />
</property>
</bean>
</list>
@@ -353,15 +353,15 @@
</bean>
</property>
</bean>
-
+
<bean id="AuthenticationResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.AuthenticationResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultAuthenticationResponseAuditExtractors')}" />
-
-
- <bean id="IsCodeFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsCodeFlowPredicate"/>
- <bean id="IsHybridFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsHybridFlowPredicate"/>
- <bean id="IsImplicitFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsImplicitFlowPredicate"/>
+
+
+ <bean id="IsCodeFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsCodeFlowPredicate" />
+ <bean id="IsHybridFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsHybridFlowPredicate" />
+ <bean id="IsImplicitFlow" class="net.shibboleth.idp.plugin.authn.oidc.rp.config.logic.IsImplicitFlowPredicate" />
<!-- CODE flow beans -->
@@ -427,8 +427,8 @@
<!-- ID_TOKEN Decryption -->
- <!-- TODO should we use an activation condition to decide if decryption params are needed e.g. JWT is not a JWE
- to stop redundent resolution of credentials -->
+ <!-- TODO should we use an activation condition to decide if decryption params are needed e.g. JWT is not a JWE to stop
+ redundent resolution of credentials -->
<bean id="PopulateIDTokenDecryptionParameters"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.PopulateJWTDecryptionParameters" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
@@ -557,11 +557,11 @@
<bean id="OIDCProviderMetadataContextChildLookup"
class="org.opensaml.messaging.context.navigate.ChildContextLookup"
c:type="#{ T(net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext) }" />
-
+
<bean id="IDTokenRequiredClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims-ref="IDTokenRequiredOIDCClaims"/>
-
+ p:requiredClaims-ref="IDTokenRequiredOIDCClaims" />
+
<util:set id="IDTokenRequiredOIDCClaims">
<value>iss</value>
<value>sub</value>
@@ -650,7 +650,7 @@
c:type="#{ T(net.shibboleth.idp.plugin.authn.oidc.rp.context.OIDCPeerEntityContext) }" />
<util:list id="IDTokenClaimsValidators" value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <ref bean="IDTokenRequiredClaimsValidator"/>
+ <ref bean="IDTokenRequiredClaimsValidator" />
<ref bean="IssuerClaimsValidator" /> <!-- TODO prevent: if it contains additional audiences not trusted by the Client. -->
<ref bean="AudienceClaimsValidator" />
<ref bean="AzpClaimRequiredValidator" />
@@ -666,11 +666,11 @@
<bean id="CheckUserInfoRequiredCondition"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.UserInfoLookupCondition" />
-
+
<bean id="TokenResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.TokenResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultTokenResponseAuditExtractors')}" />
-
+
<!-- UserInfo endpoint beans -->
@@ -694,7 +694,7 @@
<!-- UserInfo decryption and signature check if JWT type -->
<!-- FIXME: (might not be an issue) Will populate the same security params context as the id_token, but overwrite the
- decryption config. The SAML one uses the same context for signature and decryption, so this seems OK?-->
+ decryption config. The SAML one uses the same context for signature and decryption, so this seems OK? -->
<bean id="PopulateUserInfoDecryptionParameters"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.PopulateJWTDecryptionParameters" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
@@ -762,7 +762,7 @@
<property name="providerMetadataLookupStrategy">
<ref bean="shibboleth.ChildLookup.OIDCProviderMetadataFromPeerEntityContext" />
</property>
- </bean>
+ </bean>
</list>
</property>
</bean>
@@ -786,7 +786,7 @@
class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator"
p:claimValidators-ref="UserInfoClaimsValidators" />
-
+
<bean id="UserInfoTokenRequiredClaimsValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator">
<property name="requiredClaims">
@@ -795,8 +795,8 @@
</list>
</property>
</bean>
-
- <bean id="SubMatchesIDTokenClaimValidator"
+
+ <bean id="SubMatchesIDTokenClaimValidator"
class="net.shibboleth.oidc.security.jwt.claims.impl.ExactMatchClaimsValidator" p:claimName="sub">
<property name="valueToMatchLookupStrategy">
<bean class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.SubFromIDTokenLookupFunction" />
@@ -809,41 +809,41 @@
<ref bean="IssuerClaimsValidator" />
<ref bean="AudienceClaimsValidator" />
</util:list>
-
+
<bean id="PostJWTUserInfoResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostJWTUserInfoResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostJWTUserInfoResponseAuditExtractors')}" />
-
-
+
+
<!-- This is a very simplified and hard coded version of the claims verification used for a JWT. Maybe look to replace -->
<bean id="ValidateUserInfoPlainResponseClaims" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateUserInfoJSONObjectClaims"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
-
- <bean id="PostPlainUserInfoResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+
+ <bean id="PostPlainUserInfoResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostPlainUserInfoResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostPlainUserInfoResponseAuditExtractors')}" />
-
+
<bean id="ProcessEndUserClaims" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ProcessEndUserClaims"
scope="prototype" p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
- p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
+ p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
p:claimMergingStrategy="#{getObject('shibboleth.authn.oidc.rp.ClaimMergingStrategy') ?: getObject('shibboleth.authn.oidc.rp.DefaultClaimMergingStrategy')}"
- p:claimSanitizationStrategy="#{getObject('shibboleth.authn.oidc.rp.ClaimSanitizationStrategy') ?: getObject('shibboleth.authn.oidc.rp.DefaultClaimSanitizationStrategy')}"/>
-
-
- <bean id="shibboleth.authn.oidc.rp.DefaultClaimMergingStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultClaimMergingStrategy"/>
-
- <bean id="shibboleth.authn.oidc.rp.DefaultClaimSanitizationStrategy"
- class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultClaimSanitizationStrategy"/>
-
+ p:claimSanitizationStrategy="#{getObject('shibboleth.authn.oidc.rp.ClaimSanitizationStrategy') ?: getObject('shibboleth.authn.oidc.rp.DefaultClaimSanitizationStrategy')}" />
+
+
+ <bean id="shibboleth.authn.oidc.rp.DefaultClaimMergingStrategy"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultClaimMergingStrategy" />
+
+ <bean id="shibboleth.authn.oidc.rp.DefaultClaimSanitizationStrategy"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.DefaultClaimSanitizationStrategy" />
+
<bean id="PostResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.authn.oidc.rp.PostResponseAuditExtractors') ?: getObject('shibboleth.authn.oidc.rp.DefaultPostResponseAuditExtractors')}" />
-
+
<bean id="CheckUserInfoPlainResponseTypeCondition"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.context.logic.UserInfoPlainResponseTypeCondition" />
@@ -858,39 +858,39 @@
p:requesterLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple"
p:attributeFilter-ref="shibboleth.AttributeFilterService"
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService" />
-
- <bean id="PopulateSubjectCanonicalizationContext"
+
+ <bean id="PopulateSubjectCanonicalizationContext"
class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
- p:availableFlows-ref="shibboleth.authn.oidc.rp.c14n.PostLoginSubjectCanonicalizationFlows"/>
-
+ p:availableFlows-ref="shibboleth.authn.oidc.rp.c14n.PostLoginSubjectCanonicalizationFlows" />
+
<bean id="shibboleth.authn.oidc.rp.c14n.PostLoginSubjectCanonicalizationFlows"
class="net.shibboleth.ext.spring.factory.CombiningListFactoryBean"
p:firstList-ref="InbuiltPostLoginSubjectCanonicalizationFlows"
- p:secondList-ref="shibboleth.PostLoginSubjectCanonicalizationFlows"/>
-
- <util:list id="InbuiltPostLoginSubjectCanonicalizationFlows">
- <ref bean="c14n/OIDCSubjectIdentifier"/>
+ p:secondList-ref="shibboleth.PostLoginSubjectCanonicalizationFlows" />
+
+ <util:list id="InbuiltPostLoginSubjectCanonicalizationFlows">
+ <ref bean="c14n/OIDCSubjectIdentifier" />
</util:list>
-
- <bean id="UnsupportedResponseTypeAction" class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.UnsupportedResponseTypeAction"/>
- <!--
- Allows the WriteAuditLog action to be run in a transition, and a 'success' event is produced such that
- the transition is executed.
- -->
- <bean id="WriteAuditLogInTransition"
+ <bean id="UnsupportedResponseTypeAction"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.UnsupportedResponseTypeAction" />
+
+ <!-- Allows the WriteAuditLog action to be run in a transition, and a 'success' event is produced such that the transition
+ is executed. -->
+ <bean id="WriteAuditLogInTransition"
class="net.shibboleth.idp.plugin.authn.oidc.rp.audit.impl.TransitionActionWriteAuditLog" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:formattingMap-ref="shibboleth.AuditFormattingMap"
p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
-
-
- <!-- Can override one or more of the beans above. Note, the property override is mostly to allow tests
- to change the location of the user config file. -->
- <import resource="conditional:%{idp.home}/conf/authn/%{shibboleth.authn.oidc.rp.user.config:oidc-rp-config.xml}" />
+
+
+ <!-- Can override one or more of the beans above. Note, the property override is mostly to allow tests to change the
+ location of the user config file. -->
+ <import
+ resource="conditional:%{idp.home}/conf/authn/%{shibboleth.authn.oidc.rp.user.config:oidc-rp-config.xml}" />
</beans>
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
index 34c802f..41e626a 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-flow.xml
@@ -37,14 +37,7 @@
<evaluate expression="InitializeOAuth2ClientContext" />
<evaluate expression="InitializeAuthorizationRequest" />
- <evaluate expression="AddResponseTypeAndMode" />
- <evaluate expression="AddScopes" />
- <evaluate expression="AddNonce" />
- <evaluate expression="AddForceAuthenticationPrompt" />
- <evaluate expression="AddEndpointURI" />
- <evaluate expression="AddRequestedClaims" />
- <evaluate expression="AddRedirectURI"/>
- <evaluate expression="AddAuthenticationContextClassReferences" />
+ <evaluate expression="BuildAuthenticationRequest"/>
<evaluate expression="PostRequestPopulateAuditContext" />
<evaluate expression="WriteAuditLog" />
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferencesTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandlerTest.java
similarity index 80%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferencesTest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandlerTest.java
index dd801ab..56e675f 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddAuthenticationContextClassReferencesTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddAuthenticationContextClassReferencesHandlerTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertEquals;
@@ -29,6 +29,7 @@ import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
@@ -36,10 +37,10 @@ import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePr
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
/** Tests for AddAuthenticationContextClassReferences.*/
-public class AddAuthenticationContextClassReferencesTest extends AbstractOIDCTest {
+public class AddAuthenticationContextClassReferencesHandlerTest extends AbstractOIDCTest {
/** The action to test.*/
- private AddAuthenticationContextClassReferences action;
+ private AddAuthenticationContextClassReferencesHandler handler;
/** The RPC.*/
private RelyingPartyContext rpc;
@@ -51,7 +52,7 @@ public class AddAuthenticationContextClassReferencesTest extends AbstractOIDCTe
@BeforeMethod
public void setup() throws Exception {
super.setup();
- action = new AddAuthenticationContextClassReferences();
+ handler = new AddAuthenticationContextClassReferencesHandler();
rpc = prc.getSubcontext(RelyingPartyContext.class, true);
oidcAuthzConfig = new OIDCAuthorizationConfiguration();
@@ -59,12 +60,6 @@ public class AddAuthenticationContextClassReferencesTest extends AbstractOIDCTe
rpc.setProfileConfig(oidcAuthzConfig);
rpc.setConfiguration(rpConfig);
- action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
- new ChildContextLookup<>(AuthenticationContext.class)
- .compose(new WebflowRequestContextProfileRequestContextLookup())));
-
- action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
-
oidcAuthzConfig.setDefaultAuthenticationMethods(List.of(
new AuthenticationContextClassReferencePrincipal("test-value-1"),
new AuthenticationContextClassReferencePrincipal("test-value-2"),
@@ -74,9 +69,9 @@ public class AddAuthenticationContextClassReferencesTest extends AbstractOIDCTe
@Test
public void testSuccess() throws Exception {
- action.initialize();
+ handler.initialize();
- action.execute(src);
+ handler.invoke(prc.getOutboundMessageContext());
assertEquals(authnRequest.getAcrs().size(),3);
assertEquals(authnRequest.getAcrs().get(0).getValue(),"test-value-1");
@@ -88,9 +83,9 @@ public class AddAuthenticationContextClassReferencesTest extends AbstractOIDCTe
public void testSuccess_NoPrincipals() throws Exception {
oidcAuthzConfig.setDefaultAuthenticationMethods(Collections.emptyList());
- action.initialize();
+ handler.initialize();
- action.execute(src);
+ handler.invoke(prc.getOutboundMessageContext());
assertEquals(authnRequest.getAcrs().size(),0);
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURITest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandlerTest.java
similarity index 63%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURITest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandlerTest.java
index b77e310..2980891 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddEndpointURITest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddEndpointURIHandlerTest.java
@@ -15,30 +15,25 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertEquals;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.context.navigate.ParentContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.springframework.webflow.execution.Event;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-/** Tests for {@link AddEndpointURI}.*/
-public class AddEndpointURITest extends AbstractOIDCTest {
+/** Tests for {@link AddEndpointURIHandler}.*/
+public class AddEndpointURIHandlerTest extends AbstractOIDCTest {
/** The action to test.*/
- private AddEndpointURI action;
+ private AddEndpointURIHandler handler;
/** The RPC.*/
private RelyingPartyContext rpc;
@@ -50,41 +45,34 @@ public class AddEndpointURITest extends AbstractOIDCTest {
@BeforeMethod
public void setup() throws Exception {
super.setup();
- action = new AddEndpointURI();
+ handler = new AddEndpointURIHandler();
rpc = prc.getSubcontext(RelyingPartyContext.class, true);
oidcAuthzConfig = new OIDCAuthorizationConfiguration();
final RelyingPartyConfiguration rpConfig = new RelyingPartyConfiguration();
rpc.setProfileConfig(oidcAuthzConfig);
rpc.setConfiguration(rpConfig);
-
- action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
- new ChildContextLookup<>(AuthenticationContext.class)
- .compose(new WebflowRequestContextProfileRequestContextLookup())));
-
- action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
+
}
@Test
- public void testSuccess() throws ComponentInitializationException {
- action.initialize();
+ public void testSuccess() throws ComponentInitializationException, MessageHandlerException {
+ handler.initialize();
- action.execute(src);
+ handler.invoke(prc.getOutboundMessageContext());
assertEquals(authnRequest.getEndpointURI(),
providerCtx.getProviderInformation().getAuthorizationEndpointURI());
}
- @Test
- public void testNoAuthzEndpoint() throws ComponentInitializationException {
+ @Test(expectedExceptions = MessageHandlerException.class)
+ public void testNoAuthzEndpoint() throws ComponentInitializationException, MessageHandlerException {
providerCtx.getProviderInformation().setAuthorizationEndpointURI(null);
- action.initialize();
-
- final Event event = action.execute(src);
- assertEquals(event.getId(),OidcEventIds.INVALID_AUTHZ_ENDPOINT_URI);
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddForceAuthenticationPromptTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandlerTest.java
similarity index 60%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddForceAuthenticationPromptTest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandlerTest.java
index 558a821..748cb04 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddForceAuthenticationPromptTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddForceAuthenticationPromptHandlerTest.java
@@ -15,31 +15,26 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNull;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.context.navigate.ParentContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.openid.connect.sdk.Prompt;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-/** Tests for {@link AddForceAuthenticationPrompt}.*/
-public class AddForceAuthenticationPromptTest extends AbstractOIDCTest {
+/** Tests for {@link AddForceAuthenticationPromptHandler}.*/
+public class AddForceAuthenticationPromptHandlerTest extends AbstractOIDCTest {
/** The action to test.*/
- private AddForceAuthenticationPrompt action;
+ private AddForceAuthenticationPromptHandler handler;
/** The RPC.*/
private RelyingPartyContext rpc;
@@ -51,43 +46,34 @@ public class AddForceAuthenticationPromptTest extends AbstractOIDCTest {
@BeforeMethod
public void setup() throws Exception {
super.setup();
- action = new AddForceAuthenticationPrompt();
+ handler = new AddForceAuthenticationPromptHandler();
rpc = prc.getSubcontext(RelyingPartyContext.class, true);
oidcAuthzConfig = new OIDCAuthorizationConfiguration();
final RelyingPartyConfiguration rpConfig = new RelyingPartyConfiguration();
rpc.setProfileConfig(oidcAuthzConfig);
- rpc.setConfiguration(rpConfig);
-
- action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
- new ChildContextLookup<>(AuthenticationContext.class)
- .compose(new WebflowRequestContextProfileRequestContextLookup())));
-
- action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
}
@Test
- public void testSuccess() throws ComponentInitializationException {
+ public void testSuccess() throws Exception {
oidcAuthzConfig.setForceAuthn(true);
- action.initialize();
-
- action.execute(src);
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
assertEquals(authnRequest.getPrompt().size(), 1);
assertEquals(authnRequest.getPrompt().iterator().next(), Prompt.Type.LOGIN);
}
@Test
- public void testForceAuthnNotRequired() throws ComponentInitializationException {
+ public void testForceAuthnNotRequired() throws Exception {
oidcAuthzConfig.setForceAuthn(false);
- action.initialize();
-
- action.execute(src);
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
assertNull(authnRequest.getPrompt());
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRedirectURITest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandlerTest.java
similarity index 53%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRedirectURITest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandlerTest.java
index f592387..7e5db27 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRedirectURITest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRedirectURIHandlerTest.java
@@ -15,34 +15,26 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.fail;
import java.net.URI;
-import java.net.URISyntaxException;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.context.navigate.ParentContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.springframework.webflow.execution.Event;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.core.OidcEventIds;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/** Tests for {@link AddRedirectURI}.*/
-public class AddRedirectURITest extends AbstractOIDCTest {
+public class AddRedirectURIHandlerTest extends AbstractOIDCTest {
/** The action to test.*/
- private AddRedirectURI action;
+ private AddRedirectURIHandler handler;
/** The RPC.*/
private RelyingPartyContext rpc;
@@ -54,7 +46,7 @@ public class AddRedirectURITest extends AbstractOIDCTest {
@BeforeMethod
public void setup() throws Exception {
super.setup();
- action = new AddRedirectURI();
+ handler = new AddRedirectURIHandler();
rpc = prc.getSubcontext(RelyingPartyContext.class, true);
oidcAuthzConfig = new OIDCAuthorizationConfiguration();
@@ -62,38 +54,28 @@ public class AddRedirectURITest extends AbstractOIDCTest {
rpc.setProfileConfig(oidcAuthzConfig);
rpc.setConfiguration(rpConfig);
- action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
- new ChildContextLookup<>(AuthenticationContext.class)
- .compose(new WebflowRequestContextProfileRequestContextLookup())));
-
- action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
-
}
@Test
- public void testSuccess() throws ComponentInitializationException, URISyntaxException {
+ public void testSuccess() throws Exception {
final URI redirectUri = new URI("https://rp.example.com/callback");
- action.setRedirectUriCreationStrategy((http, prc) -> redirectUri);
-
- action.initialize();
+ handler.setRedirectUriCreationStrategy((http, prc) -> redirectUri);
- action.execute(src);
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
assertEquals(authnRequest.getRedirectURI(),redirectUri);
}
- @Test
- public void testNullURI() throws ComponentInitializationException, URISyntaxException {
-
- action.setRedirectUriCreationStrategy((http, prc) -> null);
-
- action.initialize();
+ @Test(expectedExceptions = MessageHandlerException.class)
+ public void testNullURI() throws Exception {
- final Event event = action.execute(src);
+ handler.setRedirectUriCreationStrategy((http, prc) -> null);
- assertEquals(event.getId(), OidcEventIds.INVALID_REDIRECT_URI);
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaimsTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandlerTest.java
similarity index 67%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaimsTest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandlerTest.java
index 3f26247..77be96a 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddRequestedClaimsTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddRequestedClaimsHandlerTest.java
@@ -15,35 +15,29 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.context.navigate.ParentContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.springframework.webflow.execution.Event;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
import com.nimbusds.openid.connect.sdk.assurance.claims.VerifiedClaimsSetRequest;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-/** Tests for the AddRequestedClaims action.*/
-public class AddRequestedClaimsTest extends AbstractOIDCTest {
+/** Tests for the AddRequestedClaimsHandler action.*/
+public class AddRequestedClaimsHandlerTest extends AbstractOIDCTest {
/** The action to test.*/
- private AddRequestedClaims action;
+ private AddRequestedClaimsHandler handler;
/** The RPC.*/
private RelyingPartyContext rpc;
@@ -55,35 +49,28 @@ public class AddRequestedClaimsTest extends AbstractOIDCTest {
@BeforeMethod
public void setup() throws Exception {
super.setup();
- action = new AddRequestedClaims();
+ handler = new AddRequestedClaimsHandler();
rpc = prc.getSubcontext(RelyingPartyContext.class, true);
oidcAuthzConfig = new OIDCAuthorizationConfiguration();
final RelyingPartyConfiguration rpConfig = new RelyingPartyConfiguration();
rpc.setProfileConfig(oidcAuthzConfig);
rpc.setConfiguration(rpConfig);
-
- action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
- new ChildContextLookup<>(AuthenticationContext.class)
- .compose(new WebflowRequestContextProfileRequestContextLookup())));
-
- action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
}
@Test
- public void testAddRequestedClaims() throws ComponentInitializationException {
+ public void testAddRequestedClaims() throws Exception {
- action.setRequestedClaimsHook(prc -> {
+ handler.setRequestedClaimsHook(prc -> {
final OIDCClaimsRequest claims = new OIDCClaimsRequest()
.withIDTokenClaimsRequest(new VerifiedClaimsSetRequest().add("given_name"))
.withUserInfoClaimsRequest(new VerifiedClaimsSetRequest().add("family_name"));
return claims;
});
- action.initialize();
+ handler.initialize();
- final Event event = action.execute(src);
- assertNull(event);
+ handler.invoke(prc.getOutboundMessageContext());
assertNotNull(prc.getOutboundMessageContext().getMessage());
assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
.getMessage()).getRequestedClaims());
@@ -94,12 +81,11 @@ public class AddRequestedClaimsTest extends AbstractOIDCTest {
}
@Test
- public void testNoRequestedClaims() throws ComponentInitializationException {
+ public void testNoRequestedClaims() throws Exception {
- action.initialize();
+ handler.initialize();
- final Event event = action.execute(src);
- assertNull(event);
+ handler.invoke(prc.getOutboundMessageContext());
assertNotNull(prc.getOutboundMessageContext().getMessage());
assertNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext()
.getMessage()).getRequestedClaims());
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndModeTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java
similarity index 59%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndModeTest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java
index ca93722..1ecdce6 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddResponseTypeAndModeTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddResponseTypeAndModeHandlerTest.java
@@ -1,30 +1,25 @@
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.context.navigate.ParentContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.springframework.webflow.execution.Event;
+import org.opensaml.messaging.handler.MessageHandlerException;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.oauth2.sdk.ResponseMode;
import com.nimbusds.oauth2.sdk.ResponseType;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-/** Tests for the PopulateResponseTypeAndMode action.*/
-public class AddResponseTypeAndModeTest extends AbstractOIDCTest {
+/** Tests for the {@link AddResponseTypeAndModeHandler} action.*/
+public class AddResponseTypeAndModeHandlerTest extends AbstractOIDCTest {
- private AddResponseTypeAndMode action;
+ private AddResponseTypeAndModeHandler handler;
private RelyingPartyContext rpc;
@@ -35,30 +30,22 @@ public class AddResponseTypeAndModeTest extends AbstractOIDCTest {
@BeforeMethod
public void setup() throws Exception {
super.setup();
- action = new AddResponseTypeAndMode();
+ handler = new AddResponseTypeAndModeHandler();
rpc = prc.getSubcontext(RelyingPartyContext.class, true);
oidcAuthzConfig = new OIDCAuthorizationConfiguration();
final RelyingPartyConfiguration rpConfig = new RelyingPartyConfiguration();
rpc.setProfileConfig(oidcAuthzConfig);
rpc.setConfiguration(rpConfig);
-
-
- action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
- new ChildContextLookup<>(AuthenticationContext.class)
- .compose(new WebflowRequestContextProfileRequestContextLookup())));
-
- action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
}
@Test
- public void testResponseModeOverride() throws ComponentInitializationException {
+ public void testResponseModeOverride() throws Exception {
oidcAuthzConfig.setResponseType(ResponseType.CODE.toString());
oidcAuthzConfig.setResponseMode(ResponseMode.FORM_POST.toString());
- action.initialize();
+ handler.initialize();
- final Event event = action.execute(src);
- assertNull(event);
+ handler.invoke(prc.getOutboundMessageContext());
assertNotNull(prc.getOutboundMessageContext().getMessage());
assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseMode());
assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseType());
@@ -69,13 +56,12 @@ public class AddResponseTypeAndModeTest extends AbstractOIDCTest {
}
@Test
- public void testResponseModeDefault() throws ComponentInitializationException {
+ public void testResponseModeDefault() throws Exception {
oidcAuthzConfig.setResponseType(ResponseType.CODE.toString());
- action.initialize();
+ handler.initialize();
- final Event event = action.execute(src);
- assertNull(event);
+ handler.invoke(prc.getOutboundMessageContext());
assertNotNull((prc.getOutboundMessageContext().getMessage()));
assertNotNull(((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseMode());
@@ -86,15 +72,13 @@ public class AddResponseTypeAndModeTest extends AbstractOIDCTest {
((OIDCAuthenticationRequest)prc.getOutboundMessageContext().getMessage()).getResponseType());
}
- @Test
- public void testUnknownResponseType() throws ComponentInitializationException {
+ @Test(expectedExceptions = MessageHandlerException.class)
+ public void testUnknownResponseType() throws Exception {
oidcAuthzConfig.setResponseType("unknown");
- action.initialize();
+ handler.initialize();
- final Event event = action.execute(src);
- assertNotNull(event);
- assertEquals("InvalidRelyingPartyConfiguration", event.getId());
+ handler.invoke(prc.getOutboundMessageContext());
}
}
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddScopesTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandlerTest.java
similarity index 64%
rename from idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddScopesTest.java
rename to idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandlerTest.java
index 309d5f7..559d489 100644
--- a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AddScopesTest.java
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddScopesHandlerTest.java
@@ -15,32 +15,26 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertTrue;
-import java.net.URISyntaxException;
import java.util.Set;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.context.navigate.ParentContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/** Tests for {@link AddScopes}.*/
-public class AddScopesTest extends AbstractOIDCTest {
+public class AddScopesHandlerTest extends AbstractOIDCTest {
/** The action to test.*/
- private AddScopes action;
+ private AddScopesHandler handler;
/** The RPC.*/
private RelyingPartyContext rpc;
@@ -52,7 +46,7 @@ public class AddScopesTest extends AbstractOIDCTest {
@BeforeMethod
public void setup() throws Exception {
super.setup();
- action = new AddScopes();
+ handler = new AddScopesHandler();
rpc = prc.getSubcontext(RelyingPartyContext.class, true);
oidcAuthzConfig = new OIDCAuthorizationConfiguration();
@@ -60,19 +54,13 @@ public class AddScopesTest extends AbstractOIDCTest {
rpc.setProfileConfig(oidcAuthzConfig);
rpc.setConfiguration(rpConfig);
- action.setProfileContextLookupStrategy(new ChildContextLookup<>(ProfileRequestContext.class).compose(
- new ChildContextLookup<>(AuthenticationContext.class)
- .compose(new WebflowRequestContextProfileRequestContextLookup())));
-
- action.setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
-
}
@Test
- public void testSuccessWithDefaultScope() throws ComponentInitializationException, URISyntaxException {
+ public void testSuccessWithDefaultScope() throws Exception {
- action.initialize();
- action.execute(src);
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
// Always one more scope as openid is default
assertEquals(authnRequest.getScope().size(), 1);
@@ -80,12 +68,12 @@ public class AddScopesTest extends AbstractOIDCTest {
}
@Test
- public void testSuccess_AddScopes() throws ComponentInitializationException, URISyntaxException {
+ public void testSuccess_AddScopes() throws Exception {
oidcAuthzConfig.setScopes(Set.of("profile","email"));
- action.initialize();
- action.execute(src);
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
// Always one more scope as openid is default
assertEquals(authnRequest.getScope().size(), 3);
@@ -96,12 +84,12 @@ public class AddScopesTest extends AbstractOIDCTest {
}
@Test
- public void testSuccess_NullScopes() throws ComponentInitializationException, URISyntaxException {
+ public void testSuccess_NullScopes() throws Exception {
oidcAuthzConfig.setScopes(null);
- action.initialize();
- action.execute(src);
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
// Always one more scope as openid is default
assertEquals(authnRequest.getScope().size(), 1);
diff --git a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-providermetadata-resolvers.xml b/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-providermetadata-resolvers.xml
index 558c3de..8226eaa 100644
--- a/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-providermetadata-resolvers.xml
+++ b/idp-oidc-rp-impl/src/test/resources/conf/authn/oidc-providermetadata-resolvers.xml
@@ -12,7 +12,7 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <util:list id="shibboleth.oidc.rp.ProviderMetadataResolvers">
+ <util:list id="shibboleth.authn.oidc.rp.ProviderMetadataResolvers">
<ref bean="ExampleHTTPResolver" />
</util:list>
diff --git a/idp-oidc-rp-impl/src/test/resources/logback-test.xml b/idp-oidc-rp-impl/src/test/resources/logback-test.xml
index 8efbe68..5b14fa1 100644
--- a/idp-oidc-rp-impl/src/test/resources/logback-test.xml
+++ b/idp-oidc-rp-impl/src/test/resources/logback-test.xml
@@ -8,6 +8,7 @@
<logger name="org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer" level="DEBUG"/>
<logger name="org.opensaml.xmlsec.algorithm" level="DEBUG"/>
<logger name="net.shibboleth.idp.profile.audit.impl" level="TRACE"/>
+ <logger name="org.springframework.beans.factory.xml" level="TRACE"/>
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
<encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list