[java-oidc-common] branch dev/JCOMOIDC-66 updated: Seperate client authentication interface into RP and OP specific
Phil Smart
philip.smart at jisc.ac.uk
Wed Apr 19 13:31:59 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-66
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=1c6b9effd919f712e98bb0b77de927c43f3a4985
The following commit(s) were added to refs/heads/dev/JCOMOIDC-66 by this push:
new 1c6b9ef Seperate client authentication interface into RP and OP specific
1c6b9ef is described below
commit 1c6b9effd919f712e98bb0b77de927c43f3a4985
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Apr 19 14:31:56 2023 +0100
Seperate client authentication interface into RP and OP specific
---
.../impl/BaseJWTSignatureSecurityHandler.java | 7 ++--
.../config/OIDCSSORelyingPartyConfiguration.java | 4 +--
...ntAuthenticableClientProfileConfiguration.java} | 37 ++++----------------
...th2ClientAuthenticableProfileConfiguration.java | 40 +---------------------
.../impl/PopulateJWTDecryptionParameters.java | 10 +++---
.../impl/PopulateJWTEncryptionParameters.java | 8 ++---
...pulateJWTSignatureSigningParametersHandler.java | 7 ++--
...th2ClientAuthenticableProfileConfiguration.java | 6 ++--
8 files changed, 31 insertions(+), 88 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
index ed637a6..b6e452a 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
@@ -39,6 +39,7 @@ import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
@@ -92,8 +93,8 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
/** Strategy used to look up the {@link SecurityParametersContext}. */
@Nonnull private Function<MessageContext,SecurityParametersContext> securityParametersContextLookupStrategy;
- /** Applicable stashed profile configuration. */
- @Nullable private OAuth2ClientAuthenticableProfileConfiguration profileConfiguration;
+ /** Applicable stashed profile configuration appropriate for OAuth clients. */
+ @Nullable private OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration;
/** The provider metadata found from the lookup strategy.*/
@Nullable protected OIDCProviderMetadata providerMetadata;
@@ -185,7 +186,7 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
final RelyingPartyContext rpCtx = adapt(relyingPartyContextLookupStrategy).apply(messageContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
rpCtx.getProfileConfig() instanceof OAuth2ClientAuthenticableProfileConfiguration) {
- profileConfiguration = (OAuth2ClientAuthenticableProfileConfiguration) rpCtx.getProfileConfig();
+ profileConfiguration = (OAuth2ClientAuthenticableClientProfileConfiguration) rpCtx.getProfileConfig();
}
return true;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
index 588760e..baf974c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
@@ -18,7 +18,7 @@
package net.shibboleth.oidc.profile.config;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration;
/**
@@ -26,6 +26,6 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileCon
*/
public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionProfileConfiguration,
OverriddenIssuerProfileConfiguration, OIDCFlowAwareProfileConfiguration,
- OAuth2ClientAuthenticableProfileConfiguration {
+ OAuth2ClientAuthenticableClientProfileConfiguration, OIDCSSOProfileConfiguration {
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
similarity index 64%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
index 62e7c63..c7178a4 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
@@ -17,46 +17,23 @@
package net.shibboleth.oidc.profile.oauth2.config;
-import java.util.Set;
-
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-/** OAuth 2.0 profile configurations that support OAuth-defined client authentication methods.*/
-public interface OAuth2ClientAuthenticableProfileConfiguration
+/**
+ * OAuth 2.0 profile configurations that support OAuth-defined client authentication methods.
+ *
+ * <p>This is specific to the role of the OAuth 2.0 client.</p>
+ */
+public interface OAuth2ClientAuthenticableClientProfileConfiguration
extends AuthenticationProfileConfiguration, OAuth2ProfileConfiguration {
- /**
- * Get the {@link ClaimsValidator} to apply to JWT-based client authentication.
- *
- * @param profileRequestContext current profile request context
- *
- * @return the validator to use
- *
- * @since 3.1.0
- */
- @Nullable ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the enabled token endpoint authentication methods.
- *
- * @param profileRequestContext profile request context
- *
- * @return enabled token endpoint authentication methods
- */
- @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getTokenEndpointAuthMethods(
- @Nullable final ProfileRequestContext profileRequestContext);
-
/**
* Get the token endpoint authentication method to use with an OpenID Provider.
*
@@ -92,6 +69,6 @@ public interface OAuth2ClientAuthenticableProfileConfiguration
*
* @since 2.2.0
*/
- @Nonnull @NotEmpty String getClientId(@Nullable final ProfileRequestContext profileRequestContext);
+ @Nullable @NotEmpty String getClientId(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
index 62e7c63..c9fbe0a 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
@@ -26,9 +26,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
@@ -56,42 +54,6 @@ public interface OAuth2ClientAuthenticableProfileConfiguration
*/
@Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getTokenEndpointAuthMethods(
@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the token endpoint authentication method to use with an OpenID Provider.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the token endpoint authentication method to use.
- *
- * @since 2.2.0
- */
- @Nonnull String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the client credential for the given context. Typically a client_secret
- * associated with the current client_id.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client credential
- *
- * @since 2.2.0
- *
- */
- @Nullable ClientSecretCredential getClientCredential(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the client_id appropriate for the given context. Typically that associated
- * with the chosen OpenID Connect Provider.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client_id
- *
- * @since 2.2.0
- */
- @Nonnull @NotEmpty String getClientId(@Nullable final ProfileRequestContext profileRequestContext);
+
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
index 6c08ddf..4afdf87 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
@@ -34,7 +34,7 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.DecryptionConfiguration;
import net.shibboleth.oidc.security.jose.DecryptionParameters;
@@ -234,12 +234,12 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
log.debug("{} No OIDC client information available", getLogPrefix());
}
- // Build a client secret credential criteria. Extract the decryption credential from the RP config.
+ // Build a client secret credential criteria. Extract the decryption credential from the RP config if any.
final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- final OIDCAuthorizationConfiguration profileConfiguration =
- (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
+ rpCtx.getProfileConfig() instanceof OAuth2ClientAuthenticableClientProfileConfiguration) {
+ final OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration =
+ (OAuth2ClientAuthenticableClientProfileConfiguration) rpCtx.getProfileConfig();
if (profileConfiguration != null) {
final ClientSecretCredential credential =
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java
index 7659769..b396654 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java
@@ -41,8 +41,8 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.config.logic.EncryptionOptionalPredicate;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.EncryptionConfiguration;
import net.shibboleth.oidc.security.jose.EncryptionParameters;
@@ -346,9 +346,9 @@ public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
final RelyingPartyContext rpCtx =
relyingPartyContextLookupStrategy.apply(profileRequestContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- final OIDCAuthorizationConfiguration profileConfiguration =
- (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
+ rpCtx.getProfileConfig() instanceof OAuth2ClientAuthenticableClientProfileConfiguration) {
+ final OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration =
+ (OAuth2ClientAuthenticableClientProfileConfiguration) rpCtx.getProfileConfig();
if (profileConfiguration != null) {
final ClientSecretCredential credential =
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java
index 2f7c575..a2fec6f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java
@@ -39,15 +39,16 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
+import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
-import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -317,8 +318,8 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
relyingPartyContextLookupStrategy.apply(messageContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- final OIDCAuthorizationConfiguration profileConfiguration =
- (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
+ final OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration =
+ (OAuth2ClientAuthenticableClientProfileConfiguration) rpCtx.getProfileConfig();
if (profileConfiguration != null) {
final ClientSecretCredential credential = profileConfiguration.getClientCredential(
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index 2f51f22..1d245af 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -36,6 +36,7 @@ import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
@@ -51,7 +52,8 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Base class for OAuth profile configurations that support OAuth-defined client authentication methods.
*/
public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
- extends AbstractConditionalProfileConfiguration implements OAuth2ClientAuthenticableProfileConfiguration {
+ extends AbstractConditionalProfileConfiguration implements OAuth2ClientAuthenticableProfileConfiguration,
+ OAuth2ClientAuthenticableClientProfileConfiguration {
/** Enabled token endpoint authentication methods. */
@Nonnull private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy;
@@ -436,7 +438,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
}
@Override
- public String getClientId(@Nullable final ProfileRequestContext profileRequestContext) {
+ @Nullable public String getClientId(@Nullable final ProfileRequestContext profileRequestContext) {
return clientIdLookupStrategy.apply(profileRequestContext);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list