[java-oidc-common] 01/02: JCOMOIDC-66 - Review ProfileConfiguration interfaces and concrete classes
Phil Smart
philip.smart at jisc.ac.uk
Wed Apr 19 13:58:36 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-66
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=92136fc3ab4f34e0753814e8dd2d6a5249b5a40b
commit 92136fc3ab4f34e0753814e8dd2d6a5249b5a40b
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Apr 19 14:54:17 2023 +0100
JCOMOIDC-66 - Review ProfileConfiguration interfaces and concrete
classes
- Move concrete classes to impl
- Replace concrete classes with interfaces
- Update internal functions to use the new interfaces if required
- Add is TLS server validation sufficient to RP profile config
https://shibboleth.atlassian.net/browse/JCOMOIDC-66
---
oidc-common-crypto-api/pom.xml | 6 +-
oidc-common-crypto-impl/pom.xml | 8 +-
.../impl/BasicJOSEObjectCredentialResolver.java | 1 +
.../impl/BaseJWTSignatureSecurityHandler.java | 11 +-
.../oidc/security/impl/AbstractHandlerTest.java | 32 +-
.../OIDCAuthenticationProfileConfiguration.java | 98 +++
...enticationRelyingPartyProfileConfiguration.java | 119 +++
.../config/OIDCAuthorizationConfiguration.java | 895 +--------------------
.../OIDCDynamicRegistrationConfiguration.java | 164 +---
...java => OIDCFlowAwareProfileConfiguration.java} | 26 +-
.../OIDCIDTokenProducingProfileConfiguration.java | 88 ++
.../profile/config/OIDCProfileConfiguration.java | 12 +-
.../OIDCProviderInformationConfiguration.java | 66 +-
.../config/OIDCPublishKeySetConfiguration.java | 30 +-
.../OIDCSSOProfileConfiguration.java} | 51 +-
.../config/OIDCSSOProviderConfiguration.java | 35 +
....java => OIDCSSORelyingPartyConfiguration.java} | 15 +-
.../profile/config/OIDCUserInfoConfiguration.java | 143 +---
.../config/logic/AllowPKCEPlainPredicate.java | 10 +-
.../AuthorizationCodeFlowEnabledPredicate.java | 9 +-
.../config/logic/EncodeConsentPredicate.java | 1 +
.../logic/EncryptRequestObjectPredicate.java | 6 +-
.../config/logic/EncryptionOptionalPredicate.java | 16 +-
.../EnforceRefreshTokenRotationPredicate.java | 1 +
.../profile/config/logic/ForcePKCEPredicate.java | 9 +-
.../config/logic/HybridFlowEnabledPredicate.java | 10 +-
.../config/logic/ImplicitFlowEnabledPredicate.java | 9 +-
...udeIssuerInAuthenticationResponsePredicate.java | 1 +
.../logic/RefreshTokensEnabledPredicate.java | 9 +-
.../config/logic/SignRequestObjectPredicate.java | 6 +-
...laimsSetManipulationStrategyLookupFunction.java | 11 +-
.../AccessTokenLifetimeLookupFunction.java | 12 +-
.../navigate/AccessTokenTypeLookupFunction.java | 12 +-
.../AcrClaimAlwaysEssentialLookupFunction.java | 5 +-
.../AlwaysIncludedAttributesLookupFunction.java | 9 +-
.../AudienceRestrictionsLookupFunction.java | 14 +-
...laimsSetManipulationStrategyLookupFunction.java | 11 +-
.../navigate/AuthzCodeLifetimeLookupFunction.java | 9 +-
.../navigate/ClaimsValidatorLookupFunction.java | 9 +-
...ClientInformationStringValueLookupFunction.java | 4 +-
.../DeniedUserInfoAttributesLookupFunction.java | 1 +
.../navigate/EncodedAttributesLookupFunction.java | 1 +
.../config/navigate/GrantTypesLookupFunction.java | 2 +
.../navigate/IDTokenLifetimeLookupFunction.java | 9 +-
.../IDTokenManipulationStrategyLookupFunction.java | 9 +-
.../IssuedClaimsValidatorLookupFunction.java | 9 +-
...laimsSetManipulationStrategyLookupFunction.java | 1 +
.../RefreshTokenLifetimeLookupFunction.java | 9 +-
.../RegistrationMetadataPolicyLookupFunction.java | 3 +-
.../RegistrationValidityPeriodLookupFunction.java | 1 +
.../navigate/RevocationLifetimeLookupFunction.java | 4 +-
.../navigate/RevocationMethodLookupFunction.java | 2 +
.../SecretExpirationPeriodLookupFunction.java | 1 +
.../TokenEndpointAuthMethodLookupFunction.java | 9 +-
.../oidc/profile/encoding/OIDCMessageEncoder.java | 4 +-
...h2AccessTokenProducingProfileConfiguration.java | 72 ++
...orizationCodeProducingProfileConfiguration.java | 62 ++
.../OAuth2AuthorizationProfileConfiguration.java | 93 +++
...entAuthenticableClientProfileConfiguration.java | 74 ++
...th2ClientAuthenticableProfileConfiguration.java | 59 ++
.../OAuth2FlowAwareProfileConfiguration.java | 58 ++
.../oauth2/config/OAuth2ProfileConfiguration.java | 10 +-
...RefreshTokenProducingProfileConfiguration.java} | 45 +-
.../config/OAuth2TokenAudienceConfiguration.java | 209 +----
.../oauth2/config/OAuth2TokenConfiguration.java | 167 +---
...OAuth2TokenEncryptionProfileConfiguration.java} | 23 +-
.../OAuth2TokenIntrospectionConfiguration.java | 25 +-
.../config/OAuth2TokenRevocationConfiguration.java | 117 +--
...OAuth2TokenValidatingProfileConfiguration.java} | 41 +-
oidc-common-profile-impl/pom.xml | 5 -
.../config/impl}/AbstractOIDCSSOConfiguration.java | 171 +---
.../DefaultOIDCAuthorizationConfiguration.java | 332 +++-----
...efaultOIDCDynamicRegistrationConfiguration.java | 51 +-
...efaultOIDCProviderInformationConfiguration.java | 21 +-
.../DefaultOIDCPublishKeySetConfiguration.java | 13 +-
.../impl/DefaultOIDCUserInfoConfiguration.java | 44 +-
.../encoding/impl/HTTPPostAuthnRequestEncoder.java | 6 +-
.../impl/HTTPRedirectAuthnRequestEncoder.java | 6 +-
...AuthenticationRequestMessageEncoderFactory.java | 4 +-
.../impl/PopulateJWTDecryptionParameters.java | 10 +-
.../impl/PopulateJWTEncryptionParameters.java | 8 +-
...pulateJWTSignatureSigningParametersHandler.java | 7 +-
...th2ClientAuthenticableProfileConfiguration.java | 52 +-
...bstractOAuth2FlowAwareProfileConfiguration.java | 41 +-
...AbstractOAuth2TokenValidatingConfiguration.java | 7 +-
.../DefaultOAuth2TokenAudienceConfiguration.java | 76 +-
.../impl/DefaultOAuth2TokenConfiguration.java | 46 +-
...faultOAuth2TokenIntrospectionConfiguration.java | 18 +-
.../DefaultOAuth2TokenRevocationConfiguration.java | 51 +-
.../impl}/OIDCCoreProtocolConfigurationTest.java | 11 +-
...enticationRequestMessageEncoderFactoryTest.java | 30 +-
.../OAuth2TokenRevocationConfigurationTest.java | 13 +-
92 files changed, 1452 insertions(+), 2674 deletions(-)
diff --git a/oidc-common-crypto-api/pom.xml b/oidc-common-crypto-api/pom.xml
index 5f04f97..899ad52 100644
--- a/oidc-common-crypto-api/pom.xml
+++ b/oidc-common-crypto-api/pom.xml
@@ -34,7 +34,11 @@
<artifactId>oauth2-oidc-sdk</artifactId>
<scope>compile</scope>
</dependency>
-
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-profile-spring</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
diff --git a/oidc-common-crypto-impl/pom.xml b/oidc-common-crypto-impl/pom.xml
index 354cb26..7a4ea09 100644
--- a/oidc-common-crypto-impl/pom.xml
+++ b/oidc-common-crypto-impl/pom.xml
@@ -18,13 +18,7 @@
<automatic.module.name>net.shibboleth.oidc.crypto.impl</automatic.module.name>
</properties>
- <dependencies>
- <!-- Do we need this? should not!! -->
- <!-- <dependency>
- <groupId>${opensaml.groupId}</groupId>
- <artifactId>opensaml-xmlsec-impl</artifactId>
- <scope>provided</scope>
- </dependency> -->
+ <dependencies>
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
index 11d8385..a61c3dc 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
@@ -262,6 +262,7 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
final UsageCriterion usageTypeCriterion = criteriaSet.get(UsageCriterion.class);
if (usageTypeCriterion == null) {
log.trace("No usage type criterion supplied, unable to derive client_secret credential");
+ return null;
}
final UsageType usageType = usageTypeCriterion.getUsage();
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
index bba35f0..b6e452a 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
@@ -39,7 +39,8 @@ import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
@@ -92,8 +93,8 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
/** Strategy used to look up the {@link SecurityParametersContext}. */
@Nonnull private Function<MessageContext,SecurityParametersContext> securityParametersContextLookupStrategy;
- /** Applicable stashed profile configuration. */
- @Nullable private OIDCAuthorizationConfiguration profileConfiguration;
+ /** Applicable stashed profile configuration appropriate for OAuth clients. */
+ @Nullable private OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration;
/** The provider metadata found from the lookup strategy.*/
@Nullable protected OIDCProviderMetadata providerMetadata;
@@ -184,8 +185,8 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
final RelyingPartyContext rpCtx = adapt(relyingPartyContextLookupStrategy).apply(messageContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- profileConfiguration = (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
+ rpCtx.getProfileConfig() instanceof OAuth2ClientAuthenticableProfileConfiguration) {
+ profileConfiguration = (OAuth2ClientAuthenticableClientProfileConfiguration) rpCtx.getProfileConfig();
}
return true;
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java
index 78264ee..3b65127 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java
@@ -17,31 +17,16 @@
package net.shibboleth.oidc.security.impl;
-import java.util.Set;
-
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.springframework.webflow.execution.RequestContext;
import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.security.impl.support.TestCredentialHelper;
/** Abstract class for tests that require context setup appropriate for message handlers.*/
public abstract class AbstractHandlerTest {
-
- /** A redirect_uri override.*/
- private static final String REDIRECT_URI_OVERRIDE = "https://localhost/callback";
-
- /** The client_id.*/
- private static final String CLIENT_ID = "demo_rp";
-
- /** The client_secret.*/
- private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
/** The root profile request context to use.*/
protected ProfileRequestContext rootPrc;
@@ -54,9 +39,6 @@ public abstract class AbstractHandlerTest {
/** The authentication context (above the nested prc).*/
protected AuthenticationContext ac;
-
- /** The RP config.*/
- protected OIDCAuthorizationConfiguration partyConfig;
/**
* Setup the various contexts.
@@ -78,19 +60,7 @@ public abstract class AbstractHandlerTest {
final MessageContext outMsgCtx = new MessageContext();
prc.setOutboundMessageContext(outMsgCtx);
-
- final RelyingPartyContext partyContext = new RelyingPartyContext();
- partyConfig = new OIDCAuthorizationConfiguration();
- partyContext.setProfileConfig(partyConfig);
- partyConfig.setClientCredential(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET));
- partyConfig.setTokenEndpointAuthMethods(Set.of("client_secret_basic"));
- partyConfig.setClientId(CLIENT_ID);
- partyConfig.setRedirectUriOverride(REDIRECT_URI_OVERRIDE);
- final RelyingPartyConfiguration rPartyConfig = new RelyingPartyConfiguration();
- rPartyConfig.setResponderId("http://idp.example.com/");
- partyContext.setConfiguration(rPartyConfig);
- prc.addSubcontext(partyContext);
-
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
new file mode 100644
index 0000000..787241f
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import java.security.Principal;
+import java.time.Duration;
+import java.util.Collection;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/** Generic configuration for an OIDC 1.0 authentication request.*/
+public interface OIDCAuthenticationProfileConfiguration extends OAuth2AuthorizationProfileConfiguration {
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
+
+ /**
+ * Should OpenID specific authentication request parameters should be passed in a single, self contained, JWT?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return whether authentication request parameters should be passed in a single, self contained, JWT
+ */
+ boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the function used to translate AMRs in the id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
+ *
+ * @param prc current profile request context
+ *
+ * @return translation function
+ *
+ * @since 2.2.0
+ */
+ @Nullable Function<Collection<String>,Collection<Principal>>
+ getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc);
+
+ /**
+ * Get the function used to translate ACRs in the id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
+ *
+ * @param prc current profile request context
+ *
+ * @return translation function
+ *
+ * @since 2.2.0
+ */
+ @Nullable Function<Collection<String>,Collection<Principal>>
+ getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc);
+
+ /**
+ * Get the login_hint to use.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the login_hint to use
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NotEmpty String getLoginHint(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the max authentication age.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return max authentication age
+ *
+ * @since 2.2.0
+ */
+ @Nullable
+ public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
new file mode 100644
index 0000000..764fc08
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Configuration of an OIDC 1.0 authentication request.
+ *
+ * <p>This is specific to the role of the RelyingParty (RP).</p>
+ */
+public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDCAuthenticationProfileConfiguration,
+ OIDCSSORelyingPartyConfiguration {
+
+ /**
+ * Get the HTTP request method for the UserInfo request. Both GET and POST are supported.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the UserInfo HTTP request method
+ *
+ * @since 2.2.0
+ */
+ @Nullable HttpRequestMethod getUserInfoHttpRequestMethod(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to make a request to the UserInfo Endpoint
+ *
+ * @since 2.2.0
+ */
+ boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Should the RequestObject (if configured) be signed?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return true iff the RequestObject should be signed, false otherwise.
+ *
+ * @since 2.2.0
+ */
+ boolean isSignRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Should the RequestObject (if configured) be encrypted?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return true iff the RequestObject should be encrypted, false otherwise.
+ *
+ * @since 2.2.0
+ */
+ boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Gets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's auth_time from the id_token, rather than the current time.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to proxy across the inbound auth_time
+ *
+ * @since 2.2.0
+ */
+ boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the redirect_uri override if set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the redirect_uri override
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NotEmpty String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Is TLS server validation of the token endpoint sufficient to verify an id_token without checking the id_token
+ * signature.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return true if TLS server validation is required to verify the id_token. False if the token signature should
+ * be validated.
+ *
+ * @since 2.2.0
+ */
+ boolean isTlsServerValidationSufficient(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 8bed866..a8c7e94 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -17,172 +17,33 @@
package net.shibboleth.oidc.profile.config;
-import java.security.Principal;
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Map;
import java.util.Set;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
-
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationCodeProducingProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-/**
- * Profile configuration for the OpenID Connect authorization endpoint.
- *
- * <p>It is also usable as a Token endpoint configuration if no non-OIDC use cases are needed.</p>
+/**
+ * Configuration of an OIDC 1.0 authentication request.
+ *
+ * <p>This is specific to the role of the OpenID Provider (OP).</p>
*/
-public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
- implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
-
+//TODO: Change name of this interface in v3?
+public interface OIDCAuthorizationConfiguration extends OIDCAuthenticationProfileConfiguration,
+ OAuth2AuthorizationCodeProducingProfileConfiguration, AuthenticationProfileConfiguration,
+ OverriddenIssuerProfileConfiguration, OIDCSSOProviderConfiguration {
+
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
-
- /** Whether all acr claim requests should be treated as Essential. */
- @Nonnull private Predicate<ProfileRequestContext> acrRequestAlwaysEssentialPredicate;
-
- /** Whether to encode consent in authorization code and access/refresh tokens. */
- @Nonnull private Predicate<ProfileRequestContext> encodeConsentInTokensPredicate;
-
- /** Lookup function to supply lifetime of authz code. */
- @Nonnull private Function<ProfileRequestContext,Duration> authorizeCodeLifetimeLookupStrategy;
-
- /** Lookup function to supply attribute IDs to embed in authorization code or access token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> encodedAttributesLookupStrategy;
-
- /** Whether to encode authentication request parameters inside a JWT request object .*/
- @Nonnull private Predicate<ProfileRequestContext> useRequestObjectPredicate;
-
- /** Predicate used to determine if the generated request object should be signed. Default returns true. */
- @Nonnull private Predicate<ProfileRequestContext> signRequestObjectPredicate;
-
- /** Predicate used to determine if the generated request object should be encrypted. Default returns false. */
- @Nonnull private Predicate<ProfileRequestContext> encryptRequestObjectPredicate;
-
- /** Lookup function to supply attribute IDs to omit from UserInfo token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
-
- /** Whether to include iss parameter in the authentication response. */
- @Nonnull private Predicate<ProfileRequestContext> includeIssuerInResponsePredicate;
-
- /** Enumeration of the HTTP methods used in OIDC authentication requests.*/
- public enum OIDCHttpRequestMethod {
- /**
- * HTTP GET.
- */
- GET,
- /**
- * HTTP POST.
- */
- POST
- }
-
- /** Whether to make a UserInfo Endpoint request for End-User claims.*/
- @Nonnull private Predicate<ProfileRequestContext> retrieveUserInfoEndpointClaims;
-
- /** An override to specify a specific redirect_uri to use over the normally computed one.*/
- @Nonnull private Function<ProfileRequestContext, String> redirectUriOverrideLookupStrategy;
-
- /** Lookup function to retrieve the response_type.*/
- @Nonnull private Function<ProfileRequestContext, String> responseTypeLookupStrategy;
-
- /** Lookup function to retrieve the scopes requested during authentication.*/
- @Nonnull private Function<ProfileRequestContext, Set<String>> scopesLookupStrategy;
-
- /** Lookup function to supply the strategy function for translating OIDC ACR claims. */
- @Nonnull private Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>>
- acrTranslationStrategyLookupStrategy;
-
- /** Lookup function to supply the strategy function for translating OIDC ACR claims. */
- @Nonnull private Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>>
- amrTranslationStrategyLookupStrategy;
-
- /** Whether authentication results should carry the proxied auth_time in the id_token. */
- @Nonnull private Predicate<ProfileRequestContext> proxiedAuthnInstantPredicate;
-
- /**
- * Which HTTP method should be used to issue OIDC authentication requests.
- * Supported values are POST and GET. The default is GET.
- */
- @Nonnull private Function<ProfileRequestContext,String> httpRequestMethodLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating authorization code claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- authorizationCodeClaimsSetManipulationStrategyLookupStrategy;
- /** Lookup function to determine the max_age of an authentication request. */
- @Nonnull private Function<ProfileRequestContext,Duration> maxAuthenticationAgeLookupStrategy;
-
- /** Lookup function to determine the login_hint of an authentication request.*/
- @Nonnull private Function<ProfileRequestContext, String> loginHintLookupStrategy;
-
- /**
- * Which HTTP method should be used to issue the UserInfo requests.
- * Supported values are POST and GET. The default is GET.
- */
- @Nonnull private Function<ProfileRequestContext,String> userInfoHttpRequestMethodLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCAuthorizationConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCAuthorizationConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
-
- redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
- responseTypeLookupStrategy = FunctionSupport.constant("code");
- scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
- signRequestObjectPredicate = Predicates.alwaysTrue();
- encryptRequestObjectPredicate = Predicates.alwaysFalse();
- retrieveUserInfoEndpointClaims = Predicates.alwaysTrue();
- proxiedAuthnInstantPredicate = Predicates.alwaysTrue();
- acrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
- amrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
- acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
- encodeConsentInTokensPredicate = Predicates.alwaysFalse();
- useRequestObjectPredicate = Predicates.alwaysFalse();
-
- authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
-
- encodedAttributesLookupStrategy = FunctionSupport.constant(null);
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET.toString());
-
- includeIssuerInResponsePredicate = Predicates.alwaysFalse();
-
- authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- maxAuthenticationAgeLookupStrategy = FunctionSupport.constant(null);
- loginHintLookupStrategy = FunctionSupport.constant(null);
- userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET.toString());
- }
-
/**
* Get whether all acr claim requests should be treated as Essential.
*
@@ -190,59 +51,8 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @return whether all acr claim requests should be treated as Essential
*/
- public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
- return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether all acr claim requests should be treated as Essential.
- *
- * @param flag flag to set
- */
- public void setAcrRequestAlwaysEssential(final boolean flag) {
- acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether all acr claim requests should be treated as Essential.
- *
- * @param condition condition to set
- */
- public void setAcrRequestAlwaysEssentialPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Should authentication request parameters should be passed in a single, self contained, JWT?
- *
- * @param profileRequestContext the profile request context
- *
- * @return whether authentication request parameters should be passed in a single, self contained, JWT
- */
- public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
- return useRequestObjectPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether the authentication request parameters should be passed in a single, self contained, JWT.
- *
- * @param flag flag to set
- */
- public void setUseRequestObject(final boolean flag) {
- useRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether the authentication request parameters should be passed in a single,
- * self contained, JWT.
- *
- * @param condition condition to set
- */
- public void setUseRequestObjectPredicate(
- @Nonnull final Predicate<ProfileRequestContext> condition) {
- useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
- }
-
+ boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext);
+
/**
* Get whether to encode consent in authorization code and access/refresh tokens.
*
@@ -250,298 +60,8 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @return whether to encode consent in authorization code and access/refresh tokens
*/
- public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
- return encodeConsentInTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param flag flag to set
- */
- public void setEncodeConsentInTokens(final boolean flag) {
- encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param condition condition to set
- */
- public void setEncodeConsentInTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to make a request to the UserInfo Endpoint
- *
- * @since 2.2.0
- */
- public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
- return retrieveUserInfoEndpointClaims.test(profileRequestContext);
- }
-
- /**
- * Set whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param flag flag to set
- *
- * @since 2.2.0
- */
- public void setRetrieveUserInfoEndpointClaims(final boolean flag) {
- retrieveUserInfoEndpointClaims = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param condition condition to set
- *
- * @since 2.2.0
- */
- public void setRetrieveUserInfoEndpointClaims(@Nonnull final Predicate<ProfileRequestContext> condition){
- retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Should the RequestObject (if configured) be signed?
- *
- * @param profileRequestContext the profile request context
- *
- * @return true iff the RequestObject should be signed, false otherwise.
- *
- * @since 2.2.0
- */
- public boolean isSignRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
- return signRequestObjectPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether the RequestObject should be signed.
- *
- * @param flag flag to set
- *
- * @since 2.2.0
- */
- public void setSignRequestObject(final boolean flag) {
- signRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set the predicate to determine if the RequestObject should be signed.
- *
- * @param condition the condition
- *
- * @since 2.2.0
- */
- public void setSignRequestObjectPredicate(final Predicate<ProfileRequestContext> condition) {
- signRequestObjectPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Should the RequestObject (if configured) be encrypted?
- *
- * @param profileRequestContext the profile request context
- *
- * @return true iff the RequestObject should be encrypted, false otherwise.
- *
- * @since 2.2.0
- */
- public boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
- return encryptRequestObjectPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether the RequestObject should be encrypted.
- *
- * @param flag flag to set
- *
- * @since 2.2.0
- */
- public void setEncryptRequestObject(final boolean flag) {
- encryptRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set the predicate to determine if the RequestObject should be encrypted.
- *
- * @param condition the condition
- *
- * @since 2.2.0
- */
- public void setEncryptRequestObjectPredicate(final Predicate<ProfileRequestContext> condition) {
- encryptRequestObjectPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Set the redirect_uri lookup strategy used to locate an overridden redirect.
- *
- * @param strategy the strategy to use.
- *
- * @since 2.2.0
- */
- public void setRedirectUriOverrideLookupStrategy(@Nonnull final
- Function<ProfileRequestContext, String> strategy) {
- redirectUriOverrideLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy can not be null");
- }
-
- /**
- * Set the override redirect_uri.
- *
- * @param uri the redirect_uri
- *
- * @since 2.2.0
- */
- public void setRedirectUriOverride(@Nullable final String uri) {
- if (uri != null) {
- redirectUriOverrideLookupStrategy = FunctionSupport.constant(uri);
- } else {
- redirectUriOverrideLookupStrategy= FunctionSupport.constant(null);
- }
- }
-
- /**
- * Get the redirect_uri override if set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the redirect_uri override
- *
- * @since 2.2.0
- */
- public String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext) {
- return redirectUriOverrideLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Get authz code lifetime.
- *
- * <p>Defaults to 5 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return authz code lifetime
- */
- @Positive @Nonnull
- public Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = authorizeCodeLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Authorization code lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of authz code.
- *
- * @param lifetime lifetime of authz code
- */
- public void setAuthorizeCodeLifetime(@Positive @Nonnull final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Authorization code lifetime must be greater than 0");
-
- authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the authz code lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setAuthorizeCodeLifetimeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- authorizeCodeLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Set a lookup strategy to determine the HTTP request method for an authentication request.
- *
- * @param strategy the strategy to set.
- */
- public void setHttpRequestMethodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, String> strategy) {
- httpRequestMethodLookupStrategy =
- Constraint.isNotNull(strategy, "HTTP request method strategy can not be null");
- }
-
- /**
- * Set the HTTP request method for an authentication request.
- *
- * @param method the HTTP method to set, either POST or GET.
- */
- public void setHttpRequestMethod(@Nonnull @NotEmpty final OIDCHttpRequestMethod method){
- httpRequestMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
- }
-
- /**
- * Get the HTTP request method for an authentication request.
- *
- * @param profileRequestContext profile request context
- *
- * @return the HTTP request method
- */
- public OIDCHttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext) {
- final String method = httpRequestMethodLookupStrategy.apply(profileRequestContext);
- if (method != null) {
- try {
- return OIDCHttpRequestMethod.valueOf(method);
- } catch (final IllegalArgumentException e) {
- throw new ConstraintViolationException("Unexpected HTTP method value: '" + method + "': "
- + e.getMessage());
- }
- }
- return null;
- }
-
- /**
- * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
- * and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to encode
- */
- @Nonnull @NonnullElements @NotLive public Set<String> getEncodedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = encodedAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be encoded in encrypted form into the authorization code
- * and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param attributes the attribute IDs to encode
- */
- public void setEncodedAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- encodedAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- encodedAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the attribute IDs which should be encoded in encrypted form into the
- * authorization code and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param strategy lookup strategy
- */
- public void setEncodedAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- encodedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
+ boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext);
+
/**
* Get the set of attribute IDs which should be omitted from the UserInfo token.
*
@@ -552,43 +72,8 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @return the attribute IDs to omit from UserInfo token
*/
- @Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = deniedUserInfoAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param attributes the attribute IDs to omit from UserInfo token
- */
- public void setDeniedUserInfoAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * @param strategy lookup strategy
- */
- public void setDeniedUserInfoAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
+ @Nonnull @NonnullElements @NotLive Set<String> getDeniedUserInfoAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext);
/**
* Get whether to include iss parameter in the authentication response.
@@ -598,356 +83,20 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
* @return whether to include iss parameter in the authentication response
*
* @since 2.1.0
- */
- public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext) {
- return includeIssuerInResponsePredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to include iss parameter in the authentication response.
- *
- * @param flag flag to set
- *
- * @since 2.1.0
- */
- public void setIncludeIssuerInResponse(final boolean flag) {
- includeIssuerInResponsePredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether to include iss parameter in the authentication response.
- *
- * @param condition condition to set
- *
- * @since 2.1.0
- */
- public void setIncludeIssuerInResponsePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- includeIssuerInResponsePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /**
- * Set the lookup strategy to determine the response_type for authentication requests.
- *
- * @param strategy the strategy to use
- *
- * @since 2.2.0
- */
- public void setResponseTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
- responseTypeLookupStrategy = Constraint.isNotNull(strategy, "ResponseType lookup strategy can not be null");
- }
-
- /**
- * Set the response_type to use for authentication requests.
- *
- * @param responseType the response_type to use
- *
- * @since 2.2.0
- */
- public void setResponseType(@Nullable final String responseType) {
- responseTypeLookupStrategy = FunctionSupport.constant(responseType);
- }
-
- /**
- * Get the response_type to use for authentication requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the response_type
- *
- * @since 2.2.0
- */
- public String getResponseType(@Nullable final ProfileRequestContext profileRequestContext) {
- return responseTypeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Get the bi-function for manipulating authorization code claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating authorization code claims set
- *
- * @since 2.1.0
- */
- @Nonnull
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getAuthorizationCodeClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return authorizationCodeClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-function for manipulating authorization code claims set.
- *
- * @param strategy bi-function for manipulating authorization code claims set
- *
- * @since 2.1.0
- */
- public void setAuthorizationCodeClaimsSetManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-function for manipulating authorization code claims set.
- *
- * @param strategy lookup strategy
- *
- * @since 2.1.0
- */
- public void setAuthorizationCodeClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- authorizationCodeClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /**
- * Set the lookup strategy to determine the scopes to use for authentication requests.
- *
- * @param strategy the strategy to use
- *
- * @since 2.2.0
- */
- public void setScopesLookupStrategy(@Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
- scopesLookupStrategy = Constraint.isNotNull(strategy, "Scopes lookup strategy can not be null");
- }
-
- /**
- * Set the scopes to use for authentication requests.
- *
- * @param scopes the scopes
*
- * @since 2.2.0
*/
- public void setScopes(@Nullable @NonnullElements final Set<String> scopes) {
- if (scopes == null || scopes.isEmpty()) {
- scopesLookupStrategy = FunctionSupport.constant(null);
- } else {
- scopesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(scopes)));
- }
- }
-
- /**
- * Get the scopes to use in authentication requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the scopes
- *
- * @since 2.2.0
- */
- @Nullable public Set<String> getScopes(@Nullable final ProfileRequestContext profileRequestContext) {
- return scopesLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the lookup function to locate the Authentication Methods References strategy used to translate
- * between an inbound proxied OIDC AMR into an appropriate set of custom {@link Principal} objects
- * to populate the subject.
- *
- * @param strategy translation function
- *
- * @since 2.2.0
- */
- public void setAuthenticationMethodsReferencesTranslationStrategyLookupStrategy(@Nonnull
- final Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>> strategy){
- amrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get the function used to translate AMRs in the inbound id_token into an appropriate set of
- * custom {@link Principal} objects to populate into the subject.
- *
- * @param prc current profile request context
- *
- * @return translation function
- *
- * @since 2.2.0
- */
- @Nullable public Function<Collection<String>,Collection<Principal>>
- getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc){
- return amrTranslationStrategyLookupStrategy.apply(prc);
- }
-
- /**
- * Set the lookup function to locate the Authentication Context Class Reference strategy used to translate
- * between an inbound proxied OIDC ACR into an appropriate set of custom {@link Principal} objects to
- * populate the subject.
- *
- * @param strategy translation function
- *
- * @since 2.2.0
- */
- public void setAuthenticationContextClassReferenceTranslationStrategyLookupStrategy(@Nullable
- final Function<ProfileRequestContext,Function<Collection<String>, Collection<Principal>>> strategy){
- acrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get the function used to translate ACRs in the inbound id_token into an appropriate set of
- * custom {@link Principal} objects to populate into the subject.
- *
- * @param prc current profile request context
- *
- * @return translation function
- *
- * @since 2.2.0
- */
- @Nullable public Function<Collection<String>,Collection<Principal>>
- getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc){
- return acrTranslationStrategyLookupStrategy.apply(prc);
- }
-
- /**
- * Gets whether authentication results produced by use of this profile should carry the proxied
- * assertion's auth_time from the id_token, rather than the current time.
- *
- * <p>Defaults to true.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return whether to proxy across the inbound auth_time
- *
- * @since 2.2.0
- */
- public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext) {
- return proxiedAuthnInstantPredicate.test(profileRequestContext);
- }
-
- /**
- * Sets whether authentication results produced by use of this profile should carry the proxied
- * assertion's auth_time from the id_token, rather than the current time.
- *
- * @param flag flag to set
- *
- * @since 2.2.0
- *
- */
- public void setProxiedAuthnInstant(final boolean flag) {
- proxiedAuthnInstantPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
+ boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get the max authentication age.
+ * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
+ * and/or access/refresh tokens to enable recovery on the back-channel.
*
* @param profileRequestContext profile request context
*
- * @return max authentication age
- *
- * @since 2.2.0
- */
- @Nullable
- public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext) {
- return maxAuthenticationAgeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the max authentication age.
- *
- * @param age the max authentication age
- *
- * @since 2.2.0
+ * @return the attribute IDs to encode
*/
- public void setMaxAuthenticationAge(@Positive @Nonnull final Duration age) {
- Constraint.isTrue(age != null && !age.isZero() && !age.isNegative(),
- "Max age must be greater than 0");
+ @Nonnull @NonnullElements @NotLive Set<String> getEncodedAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext);
- maxAuthenticationAgeLookupStrategy = FunctionSupport.constant(age);
- }
-
- /**
- * Set a lookup strategy for the max authentication age.
- *
- * @param strategy lookup strategy
- *
- * @since 2.2.0
- */
- public void setMaxAuthenticationAgeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- maxAuthenticationAgeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
- /**
- * Set the lookup strategy for setting the login_hint.
- *
- * @param strategy lookup strategy
- *
- * @since 2.2.0
- */
- public void setLoginHintLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
- loginHintLookupStrategy = Constraint.isNotNull(loginHintLookupStrategy, "Login Hint strategy can not be null");
- }
-
- /**
- * Set a fixed login_hint. Will apply to all requests.
- *
- * @param fixedLoginHint the login_hint
- *
- * @since 2.2.0
- */
- public void setLoginHint(final String fixedLoginHint) {
- Constraint.isNotEmpty(fixedLoginHint, "Fixed login hint can not be null or empty");
- loginHintLookupStrategy = FunctionSupport.constant(fixedLoginHint);
- }
-
- /**
- * Get the login_hint to use.
- *
- * @param profileRequestContext profile request context
- *
- * @return the login_hint to use
- */
- @Nullable public String getLoginHint(@Nullable final ProfileRequestContext profileRequestContext) {
- return loginHintLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set a lookup strategy to determine the HTTP request method for an UserInfo request.
- *
- * @param strategy the strategy to set.
- *
- * @since 2.2.0
- */
- public void setUserInfoHttpRequestMethodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, String> strategy) {
- userInfoHttpRequestMethodLookupStrategy =
- Constraint.isNotNull(strategy, "HTTP request method strategy can not be null");
- }
-
- /**
- * Set the HTTP request method for an UserInfo request.
- *
- * @param method the HTTP method to set, either POST or GET.
- *
- * @since 2.2.0
- */
- public void setUserInfoHttpRequestMethod(@Nonnull @NotEmpty final OIDCHttpRequestMethod method){
- userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
- }
-
- /**
- * Get the HTTP request method for an UserInfo request.
- *
- * @param profileRequestContext profile request context
- *
- * @return the HTTP request method
- *
- * @since 2.2.0
- */
- @Nullable public OIDCHttpRequestMethod getUserInfoHttpRequestMethod(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final String method = userInfoHttpRequestMethodLookupStrategy.apply(profileRequestContext);
- if (method != null) {
- try {
- return OIDCHttpRequestMethod.valueOf(method);
- } catch (final IllegalArgumentException e) {
- throw new ConstraintViolationException("Unexpected HTTP method value: '" + method + "': "
- + e.getMessage());
- }
- }
- return null;
- }
-
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
index ca81434..764b94e 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
@@ -19,88 +19,27 @@ package net.shibboleth.oidc.profile.config;
import java.time.Duration;
import java.util.Map;
-import java.util.function.Function;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * Profile configuration for the OpenID Connect dynamic client registration.
+ * Configuration of OpenID Connect Dynamic Client Registration 1.0.
*/
-public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
- implements OverriddenIssuerProfileConfiguration {
+public interface OIDCDynamicRegistrationConfiguration extends OverriddenIssuerProfileConfiguration,
+ OIDCFlowAwareProfileConfiguration, OAuth2ClientAuthenticableProfileConfiguration {
/** OIDC base protocol URI. */
public static final String PROTOCOL_URI = "https://openid.net/specs/openid-connect-registration-1_0.html";
/** ID for this profile configuration. */
public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/registration";
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Lookup function to supply registration validity period. */
- @Nonnull private Function<ProfileRequestContext,Duration> registrationValidityPeriodLookupStrategy;
-
- /** Lookup function to supply client secret expiration period. */
- @Nullable private Function<ProfileRequestContext,Duration> secretExpirationPeriodLookupStrategy;
-
- /** Lookup function to the default metadata policy. */
- @Nullable private Function<ProfileRequestContext,Map<String,MetadataPolicy>> metadataPolicyLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCDynamicRegistrationConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCDynamicRegistrationConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- setRegistrationValidityPeriod(Duration.ofHours(24));
- setSecretExpirationPeriod(Duration.ofDays(365));
- metadataPolicyLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
/**
* Get dynamic registration validity period.
@@ -112,39 +51,8 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
* @return dynamic registration validity period
*/
@Nullable @NonNegative
- public Duration getRegistrationValidityPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
-
- final Duration period = registrationValidityPeriodLookupStrategy.apply(profileRequestContext);
-
- Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
- return period;
- }
-
- /**
- * Sets the registration validity period.
- *
- * <p>A 0 is interpreted as an unlimited period.</p>
- *
- * @param period registration validity period
- */
- public void setRegistrationValidityPeriod(@Nullable @NonNegative final Duration period) {
- Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
-
- registrationValidityPeriodLookupStrategy = FunctionSupport.constant(period);
- }
-
- /**
- * Set a lookup strategy for the registration validity period.
- *
- * <p>A null or 0 is interpreted as an unlimited period.</p>
- *
- * @param strategy lookup strategy
- */
- public void setRegistrationValidityPeriodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- registrationValidityPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
+ Duration getRegistrationValidityPeriod(@Nullable final ProfileRequestContext profileRequestContext);
+
/**
* Get client secret expiration period.
*
@@ -155,38 +63,8 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
* @return client secret expiration period
*/
@Nullable @NonNegative
- public Duration getSecretExpirationPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration period = secretExpirationPeriodLookupStrategy.apply(profileRequestContext);
-
- Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
- return period;
- }
-
- /**
- * Sets the client secret expiration period.
- *
- * <p>A 0 is interpreted as an unlimited period.</p>
- *
- * @param period registration validity period
- */
- public void setSecretExpirationPeriod(@Nullable @NonNegative final Duration period) {
- Constraint.isFalse(period != null && period.isNegative(), "Validity period cannot be negative");
-
- secretExpirationPeriodLookupStrategy = FunctionSupport.constant(period);
- }
-
- /**
- * Set a lookup strategy for the client secret expiration period.
- *
- * <p>A null or 0 is interpreted as an unlimited period.</p>
- *
- * @param strategy lookup strategy
- */
- public void setSecretExpirationPeriodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- secretExpirationPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
+ Duration getSecretExpirationPeriod(@Nullable final ProfileRequestContext profileRequestContext);
+
/**
* Get the metadata policy.
*
@@ -195,27 +73,5 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
* @return metadata policy
*/
@Nullable
- public Map<String,MetadataPolicy> getMetadataPolicy(@Nullable final ProfileRequestContext profileRequestContext) {
- return metadataPolicyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Sets the metadata policy.
- *
- * @param policy metadata policy
- */
- public void setMetadataPolicy(@Nonnull final Map<String,MetadataPolicy> policy) {
- metadataPolicyLookupStrategy = FunctionSupport.constant(policy);
- }
-
- /**
- * Set a lookup strategy for the metadata policy.
- *
- * @param strategy lookup strategy
- */
- public void setMetadataPolicyLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Map<String,MetadataPolicy>> strategy) {
- metadataPolicyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
+ Map<String,MetadataPolicy> getMetadataPolicy(@Nullable final ProfileRequestContext profileRequestContext);
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCFlowAwareProfileConfiguration.java
similarity index 50%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCFlowAwareProfileConfiguration.java
index 1a68e6d..9b7b2ed 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCFlowAwareProfileConfiguration.java
@@ -17,14 +17,26 @@
package net.shibboleth.oidc.profile.config;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ProfileConfiguration;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
/**
- * Marker interface for OIDC-specific profile configurations.
- *
- * <p>Such profiles may be OAuth-defined but if they include features specific to OIDC should
- * implement this interface as well.</p>
+ * Interface for profile configurations that understand OIDC specific authentication flows in addition to the OAuth 2.0
+ * flows described by {@link OAuth2FlowAwareProfileConfiguration}.
*/
-public interface OIDCProfileConfiguration extends OAuth2ProfileConfiguration {
+public interface OIDCFlowAwareProfileConfiguration extends OIDCProfileConfiguration,
+ OAuth2FlowAwareProfileConfiguration {
+
+ /**
+ * Get whether the implicit flow is supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether implicit flow is supported by this profile
+ */
+ boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
new file mode 100644
index 0000000..e7b410f
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import java.time.Duration;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+
+/**
+ * Configuration common to ID Token producing profiles.
+ */
+public interface OIDCIDTokenProducingProfileConfiguration extends OIDCProfileConfiguration {
+
+ /**
+ * Get ID token lifetime.
+ *
+ * <p>Defaults to 1 hour.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return ID token lifetime
+ */
+ @Positive @Nonnull Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the bi-function for manipulating id_token claims.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating id_token claims
+ *
+ * @since 2.1.0
+ */
+ @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get the set of attribute IDs which should be included in the ID token regardless of response_type.
+ *
+ * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
+ * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
+ * attributes to be added to the ID token regardless of flow.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the attribute IDs to include in all cases
+ */
+ @Nonnull @NonnullElements @NotLive Set<String> getAlwaysIncludedAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
+ * which the token may be shared.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the additional audiences
+ */
+ @Nonnull @NonnullElements @NotLive Set<String> getAdditionalAudiencesForIdToken(
+ @Nullable final ProfileRequestContext profileRequestContext);
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
index 1a68e6d..d70dcdc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
@@ -19,12 +19,8 @@ package net.shibboleth.oidc.profile.config;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ProfileConfiguration;
-/**
- * Marker interface for OIDC-specific profile configurations.
- *
- * <p>Such profiles may be OAuth-defined but if they include features specific to OIDC should
- * implement this interface as well.</p>
- */
-public interface OIDCProfileConfiguration extends OAuth2ProfileConfiguration {
+/** Common interface for OpenID Connect 1.0 Profile Configurations.*/
+public interface OIDCProfileConfiguration extends OAuth2ProfileConfiguration {
+
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
index 00eb158..25074c7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
@@ -17,72 +17,18 @@
package net.shibboleth.oidc.profile.config;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-/**
- * Profile configuration for the OpenID Connect Provider Configuration.
+/**
+ * Profile configuration for an OpenID Connect Provider Configuration.
*/
-public class OIDCProviderInformationConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration {
-
+public interface OIDCProviderInformationConfiguration extends OverriddenIssuerProfileConfiguration,
+ OIDCProfileConfiguration {
+
/** OIDC base protocol URI. Section 4 is relevant. */
public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-discovery-1_0.html";
/** ID for this profile configuration. */
public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/configuration";
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCProviderInformationConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCProviderInformationConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
index e7d0ba2..f531763 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
@@ -17,16 +17,10 @@
package net.shibboleth.oidc.profile.config;
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-
-/**
- * Profile configuration for publishing OP key set.
+/**
+ * Configuration of an OpenID published key set document.
*/
-public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration{
+public interface OIDCPublishKeySetConfiguration extends OIDCProfileConfiguration {
/** OIDC base protocol URI. Section 3 jwks_uri is the relevant. */
public static final String PROTOCOL_URI =
@@ -35,20 +29,4 @@ public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileCo
/** ID for this profile configuration. */
public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/keyset";
- /**
- * Constructor.
- */
- public OIDCPublishKeySetConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCPublishKeySetConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
-
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
similarity index 53%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
index 8824315..f736abc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
@@ -15,38 +15,39 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
-
+package net.shibboleth.oidc.profile.config;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-
-/**
- * Profile configuration for the OAuth2 Token Introspection.
- */
-public class OAuth2TokenIntrospectionConfiguration extends AbstractOAuth2TokenValidatingConfiguration {
+import org.opensaml.profile.context.ProfileRequestContext;
- /** OAuth2 Token Revocation URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
+/** Profile configuration generic to all OIDC SSO profiles.*/
+public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
- /**
- * Constructor.
- */
- public OAuth2TokenIntrospectionConfiguration() {
- this(PROFILE_ID);
- }
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
/**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
+ * Get whether client is required to use PKCE.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is required to use PKCE
*/
- public OAuth2TokenIntrospectionConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
+ boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether client is allowed to use PKCE code challenge method plain.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is allowed to use PKCE code challenge method plain
+ */
+ boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext);
+
+
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProviderConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProviderConfiguration.java
new file mode 100644
index 0000000..9b58ff6
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProviderConfiguration.java
@@ -0,0 +1,35 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration;
+
+/**
+ * Profile configuration for an OIDC SSO Provider.
+ */
+public interface OIDCSSOProviderConfiguration extends OAuth2TokenEncryptionProfileConfiguration,
+ OIDCIDTokenProducingProfileConfiguration, OAuth2AccessTokenProducingProfileConfiguration,
+ OAuth2RefreshTokenProducingProfileConfiguration, OIDCSSOProfileConfiguration,
+ AttributeResolvingProfileConfiguration, OIDCFlowAwareProfileConfiguration,
+ OAuth2ClientAuthenticableProfileConfiguration {
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
similarity index 59%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
index 1a68e6d..baf974c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
@@ -17,14 +17,15 @@
package net.shibboleth.oidc.profile.config;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ProfileConfiguration;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration;
/**
- * Marker interface for OIDC-specific profile configurations.
- *
- * <p>Such profiles may be OAuth-defined but if they include features specific to OIDC should
- * implement this interface as well.</p>
+ * Profile configuration for an OIDC SSO Client or Relying Party.
*/
-public interface OIDCProfileConfiguration extends OAuth2ProfileConfiguration {
+public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionProfileConfiguration,
+ OverriddenIssuerProfileConfiguration, OIDCFlowAwareProfileConfiguration,
+ OAuth2ClientAuthenticableClientProfileConfiguration, OIDCSSOProfileConfiguration {
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
index 284ab67..9372ca2 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
@@ -17,121 +17,31 @@
package net.shibboleth.oidc.profile.config;
-import java.util.Collection;
-import java.util.Collections;
import java.util.Set;
-import java.util.function.Function;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
-
import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2TokenValidatingConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenValidatingProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Profile configuration for the OpenID Connect core protocol userinfo endpoint.
+ * Configuration for an OpenID Connect core protocol UserInfo endpoint.
*/
-public class OIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConfiguration
- implements AttributeResolvingProfileConfiguration {
-
+public interface OIDCUserInfoConfiguration extends AttributeResolvingProfileConfiguration,
+ OAuth2TokenEncryptionProfileConfiguration, OAuth2TokenValidatingProfileConfiguration {
+
/** OIDC base protocol URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/userinfo";
-
- /** Whether attributes should be resolved in the course of the profile. */
- @Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
-
- /** Whether encryption is optional in the face of no key, etc. */
- @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
-
- /** Lookup function to supply attribute IDs to omit from UserInfo token. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
-
- /**
- * Constructor.
- */
- public OIDCUserInfoConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OIDCUserInfoConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
-
- resolveAttributesPredicate = Predicates.alwaysTrue();
- encryptionOptionalPredicate = Predicates.alwaysTrue();
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
- return resolveAttributesPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether attributes should be resolved during the profile.
- *
- * @param flag flag to set
- */
- public void setResolveAttributes(final boolean flag) {
- resolveAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether attributes should be resolved during the profile.
- *
- * @param condition condition to set
- */
- public void setResolveAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
- }
-
- /**
- * Get whether encryption is optional in the face of a missing key, etc.
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff encryption is optional
- */
- public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
- return encryptionOptionalPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether encryption is optional in the face of a missing key, etc.
- *
- * @param flag flag to set
- */
- public void setEncryptionOptional(final boolean flag) {
- encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether encryption is optional in the face of a missing key, etc.
- *
- * @param condition condition to set
- */
- public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
- }
/**
* Get the set of attribute IDs which should be omitted from the UserInfo token.
@@ -143,42 +53,7 @@ public class OIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConf
*
* @return the attribute IDs to omit from UserInfo token
*/
- @Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> attributes = deniedUserInfoAttributesLookupStrategy.apply(profileRequestContext);
- if (attributes != null) {
- return Set.copyOf(attributes);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param attributes the attribute IDs to omit from UserInfo token
- */
- public void setDeniedUserInfoAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
-
- if (attributes == null || attributes.isEmpty()) {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- } else {
- deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(attributes)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * @param strategy lookup strategy
- */
- public void setDeniedUserInfoAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
+ @Nonnull @NonnullElements @NotLive Set<String> getDeniedUserInfoAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext);
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java
index 72b0ec9..99933d0 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AllowPKCEPlainPredicate.java
@@ -24,21 +24,23 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
+
/**
* A predicate implementation that forwards to
- * {@link AbstractOIDCSSOConfiguration#isAllowPKCEPlain(ProfileRequestContext)}.
+ * {@link OIDCSSOProfileConfiguration#isAllowPKCEPlain(ProfileRequestContext)}.
*/
public class AllowPKCEPlainPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).isAllowPKCEPlain(input);
+ if (pc instanceof OIDCSSOProfileConfiguration) {
+ return ((OIDCSSOProfileConfiguration) pc).isAllowPKCEPlain(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java
index f071231..878117c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java
@@ -24,21 +24,22 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
/**
* A predicate implementation that forwards to {@link
- * AbstractOAuth2FlowAwareProfileConfiguration#isAuthorizationCodeFlowEnabled(ProfileRequestContext)}.
+ * OAuth2FlowAwareProfileConfiguration#isAuthorizationCodeFlowEnabled(ProfileRequestContext)}.
*/
public class AuthorizationCodeFlowEnabledPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
- return ((AbstractOAuth2FlowAwareProfileConfiguration) pc).isAuthorizationCodeFlowEnabled(input);
+ if (pc instanceof OAuth2FlowAwareProfileConfiguration) {
+ return ((OAuth2FlowAwareProfileConfiguration) pc).isAuthorizationCodeFlowEnabled(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncodeConsentPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncodeConsentPredicate.java
index 07805ca..cf2faf1 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncodeConsentPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncodeConsentPredicate.java
@@ -33,6 +33,7 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
public class EncodeConsentPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptRequestObjectPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptRequestObjectPredicate.java
index a105b17..a722e1c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptRequestObjectPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptRequestObjectPredicate.java
@@ -24,7 +24,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration;
/** A predicate that determines if the RequestObject JWT should be encrypted based on the profile configuration.*/
public class EncryptRequestObjectPredicate extends AbstractRelyingPartyPredicate {
@@ -35,8 +35,8 @@ public class EncryptRequestObjectPredicate extends AbstractRelyingPartyPredicate
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration) pc).isEncryptRequestObject(input);
+ if (pc instanceof OIDCAuthenticationRelyingPartyProfileConfiguration) {
+ return ((OIDCAuthenticationRelyingPartyProfileConfiguration) pc).isEncryptRequestObject(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
index 9059830..fa44779 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EncryptionOptionalPredicate.java
@@ -24,28 +24,22 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration;
/**
* A predicate implementation that forwards to
- * {@link AbstractOIDCSSOConfiguration#isEncryptionOptional(ProfileRequestContext)} or
- * {@link OIDCUserInfoConfiguration#isEncryptionOptional(ProfileRequestContext)}.
+ * {@link OAuth2TokenEncryptionProfileConfiguration#isEncryptionOptional(ProfileRequestContext)}.
*/
public class EncryptionOptionalPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).isEncryptionOptional(input);
- } else if (pc instanceof OIDCUserInfoConfiguration) {
- return ((OIDCUserInfoConfiguration) pc).isEncryptionOptional(input);
- } else if (pc instanceof OAuth2TokenAudienceConfiguration) {
- return ((OAuth2TokenAudienceConfiguration) pc).isEncryptionOptional(input);
+ if (pc instanceof OAuth2TokenEncryptionProfileConfiguration) {
+ return ((OAuth2TokenEncryptionProfileConfiguration) pc).isEncryptionOptional(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EnforceRefreshTokenRotationPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EnforceRefreshTokenRotationPredicate.java
index d0d51b7..8144af5 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EnforceRefreshTokenRotationPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/EnforceRefreshTokenRotationPredicate.java
@@ -33,6 +33,7 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration;
public class EnforceRefreshTokenRotationPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java
index 2122f34..0f1a1ed 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ForcePKCEPredicate.java
@@ -24,20 +24,21 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
/**
- * A predicate implementation that forwards to {@link AbstractOIDCSSOConfiguration#isForcePKCE(ProfileRequestContext)}.
+ * A predicate implementation that forwards to {@link OIDCSSOProfileConfiguration#isForcePKCE(ProfileRequestContext)}.
*/
public class ForcePKCEPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).isForcePKCE(input);
+ if (pc instanceof OIDCSSOProfileConfiguration) {
+ return ((OIDCSSOProfileConfiguration) pc).isForcePKCE(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/HybridFlowEnabledPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/HybridFlowEnabledPredicate.java
index 5e9b3d4..1ef3e54 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/HybridFlowEnabledPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/HybridFlowEnabledPredicate.java
@@ -24,21 +24,23 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCFlowAwareProfileConfiguration;
+
/**
* A predicate implementation that forwards to
- * {@link AbstractOAuth2FlowAwareProfileConfiguration#isHybridFlowEnabled(ProfileRequestContext)}.
+ * {@link OIDCFlowAwareProfileConfiguration#isHybridFlowEnabled(ProfileRequestContext)}.
*/
public class HybridFlowEnabledPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
- return ((AbstractOAuth2FlowAwareProfileConfiguration) pc).isHybridFlowEnabled(input);
+ if (pc instanceof OIDCFlowAwareProfileConfiguration) {
+ return ((OIDCFlowAwareProfileConfiguration) pc).isHybridFlowEnabled(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ImplicitFlowEnabledPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ImplicitFlowEnabledPredicate.java
index b6c0771..a173f88 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ImplicitFlowEnabledPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ImplicitFlowEnabledPredicate.java
@@ -24,21 +24,22 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
/**
* A predicate implementation that forwards to
- * {@link AbstractOAuth2FlowAwareProfileConfiguration#isImplicitFlowEnabled(ProfileRequestContext)}.
+ * {@link OAuth2FlowAwareProfileConfiguration#isImplicitFlowEnabled(ProfileRequestContext)}.
*/
public class ImplicitFlowEnabledPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
- return ((AbstractOAuth2FlowAwareProfileConfiguration) pc).isImplicitFlowEnabled(input);
+ if (pc instanceof OAuth2FlowAwareProfileConfiguration) {
+ return ((OAuth2FlowAwareProfileConfiguration) pc).isImplicitFlowEnabled(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IncludeIssuerInAuthenticationResponsePredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IncludeIssuerInAuthenticationResponsePredicate.java
index 50b6a63..760799f 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IncludeIssuerInAuthenticationResponsePredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IncludeIssuerInAuthenticationResponsePredicate.java
@@ -35,6 +35,7 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
public class IncludeIssuerInAuthenticationResponsePredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RefreshTokensEnabledPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RefreshTokensEnabledPredicate.java
index 759475c..6f24a1d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RefreshTokensEnabledPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RefreshTokensEnabledPredicate.java
@@ -24,21 +24,22 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
/**
* A predicate implementation that forwards to
- * {@link AbstractOAuth2FlowAwareProfileConfiguration#isRefreshTokensEnabled(ProfileRequestContext)}.
+ * {@link OAuth2FlowAwareProfileConfiguration#isRefreshTokensEnabled(ProfileRequestContext)}.
*/
public class RefreshTokensEnabledPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
- return ((AbstractOAuth2FlowAwareProfileConfiguration) pc).isRefreshTokensEnabled(input);
+ if (pc instanceof OAuth2FlowAwareProfileConfiguration) {
+ return ((OAuth2FlowAwareProfileConfiguration) pc).isRefreshTokensEnabled(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/SignRequestObjectPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/SignRequestObjectPredicate.java
index 659d320..f81f3b6 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/SignRequestObjectPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/SignRequestObjectPredicate.java
@@ -24,7 +24,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration;
/** A predicate that determines if the RequestObject JWT should be signed based on the profile configuration.*/
public class SignRequestObjectPredicate extends AbstractRelyingPartyPredicate {
@@ -35,8 +35,8 @@ public class SignRequestObjectPredicate extends AbstractRelyingPartyPredicate {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration) pc).isSignRequestObject(input);
+ if (pc instanceof OIDCAuthenticationRelyingPartyProfileConfiguration) {
+ return ((OIDCAuthenticationRelyingPartyProfileConfiguration) pc).isSignRequestObject(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenClaimsSetManipulationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenClaimsSetManipulationStrategyLookupFunction.java
index a95a743..75d3315 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenClaimsSetManipulationStrategyLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenClaimsSetManipulationStrategyLookupFunction.java
@@ -27,11 +27,12 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration;
/**
* A function that returns
- * {@link AbstractOIDCSSOConfiguration#getAccessTokenClaimsSetManipulationStrategy(ProfileRequestContext)}
+ * {@link OAuth2AccessTokenProducingProfileConfiguration#getAccessTokenClaimsSetManipulationStrategy
+ * (ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -43,13 +44,15 @@ public class AccessTokenClaimsSetManipulationStrategyLookupFunction extends
AbstractRelyingPartyLookupFunction<BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> {
/** {@inheritDoc} */
+ @Override
@Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> apply(
@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).getAccessTokenClaimsSetManipulationStrategy(input);
+ if (pc instanceof OAuth2AccessTokenProducingProfileConfiguration) {
+ return ((OAuth2AccessTokenProducingProfileConfiguration) pc)
+ .getAccessTokenClaimsSetManipulationStrategy(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java
index afcbd32..bdface3 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenLifetimeLookupFunction.java
@@ -26,12 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration;
/**
* A function that returns
- * {@link OAuth2TokenAudienceConfiguration#getAccessTokenLifetime(ProfileRequestContext)}
+ * {@link OAuth2AccessTokenProducingProfileConfiguration#getAccessTokenLifetime(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -40,14 +39,13 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguratio
public class AccessTokenLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
+ @Override
@Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).getAccessTokenLifetime(input);
- } else if (pc instanceof OAuth2TokenAudienceConfiguration) {
- return ((OAuth2TokenAudienceConfiguration) pc).getAccessTokenLifetime(input);
+ if (pc instanceof OAuth2AccessTokenProducingProfileConfiguration) {
+ return ((OAuth2AccessTokenProducingProfileConfiguration) pc).getAccessTokenLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenTypeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenTypeLookupFunction.java
index 41a91ac..a23253e 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenTypeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AccessTokenTypeLookupFunction.java
@@ -24,12 +24,12 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration;
+
/**
* A function that returns
- * {@link OAuth2TokenAudienceConfiguration#getAccessTokenType(ProfileRequestContext)}
+ * {@link OAuth2AccessTokenProducingProfileConfiguration#getAccessTokenType(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -43,10 +43,8 @@ public class AccessTokenTypeLookupFunction extends AbstractRelyingPartyLookupFun
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OAuth2TokenAudienceConfiguration) {
- return ((OAuth2TokenAudienceConfiguration) pc).getAccessTokenType(input);
- } else if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).getAccessTokenType(input);
+ if (pc instanceof OAuth2AccessTokenProducingProfileConfiguration) {
+ return ((OAuth2AccessTokenProducingProfileConfiguration) pc).getAccessTokenType(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java
index 2dcb003..017a854 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AcrClaimAlwaysEssentialLookupFunction.java
@@ -27,7 +27,8 @@ import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
/**
- * A predicate that returns {@link OIDCAuthorizationConfiguration#isAcrRequestAlwaysEssential(ProfileRequestContext)}
+ * A predicate that returns
+ * {@link OIDCAuthorizationConfiguration#isAcrRequestAlwaysEssential(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function, by default a child
* of the {@link ProfileRequestContext}.
*
@@ -38,7 +39,7 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
public class AcrClaimAlwaysEssentialLookupFunction extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
- @Nullable
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AlwaysIncludedAttributesLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AlwaysIncludedAttributesLookupFunction.java
index a6bc26b..d6531dc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AlwaysIncludedAttributesLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AlwaysIncludedAttributesLookupFunction.java
@@ -26,11 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCIDTokenProducingProfileConfiguration;
/**
* A function that obtains
- * {@link AbstractOIDCSSOConfiguration#getAlwaysIncludedAttributes(ProfileRequestContext)}
+ * {@link OIDCIDTokenProducingProfileConfiguration#getAlwaysIncludedAttributes(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -40,12 +40,13 @@ public class AlwaysIncludedAttributesLookupFunction
extends AbstractRelyingPartyLookupFunction<Set<String>> {
/** {@inheritDoc} */
+ @Override
@Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration)pc).getAlwaysIncludedAttributes(input);
+ if (pc instanceof OIDCIDTokenProducingProfileConfiguration) {
+ return ((OIDCIDTokenProducingProfileConfiguration)pc).getAlwaysIncludedAttributes(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AudienceRestrictionsLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AudienceRestrictionsLookupFunction.java
index 1fb97a7..cbdbbaf 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AudienceRestrictionsLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AudienceRestrictionsLookupFunction.java
@@ -24,13 +24,13 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableCollection.Builder;
+import com.google.common.collect.ImmutableList;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCIDTokenProducingProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
@@ -38,7 +38,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
/**
* A function that returns the effective audience restrictions to include in ID tokens, based on combining a relying
* party's entityID with the result of
- * {@link AbstractOIDCSSOConfiguration#getAdditionalAudiencesForIdToken(ProfileRequestContext)}, if such
+ * {@link OIDCIDTokenProducingProfileConfiguration#getAdditionalAudiencesForIdToken(ProfileRequestContext)}, if such
* a profile is available from a {@link RelyingPartyContext} obtained via a lookup function, by default a child of the
* {@link ProfileRequestContext}.
*
@@ -49,19 +49,21 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
public class AudienceRestrictionsLookupFunction extends AbstractRelyingPartyLookupFunction<Collection<String>> {
/** {@inheritDoc} */
+ @Override
@Nullable @NonnullElements @NotLive @Unmodifiable public Collection<String> apply(
@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final String id = rpc.getRelyingPartyId();
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration
- && !((AbstractOIDCSSOConfiguration) pc).getAdditionalAudiencesForIdToken(input).isEmpty()) {
+ if (pc instanceof OIDCIDTokenProducingProfileConfiguration
+ && !((OIDCIDTokenProducingProfileConfiguration) pc).getAdditionalAudiencesForIdToken(input)
+ .isEmpty()) {
final Builder<String> builder = ImmutableList.builder();
if (id != null) {
builder.add(rpc.getRelyingPartyId());
}
- builder.addAll(((AbstractOIDCSSOConfiguration) pc).getAdditionalAudiencesForIdToken(input));
+ builder.addAll(((OIDCIDTokenProducingProfileConfiguration) pc).getAdditionalAudiencesForIdToken(input));
return builder.build();
} else if (id != null) {
return Collections.singletonList(rpc.getRelyingPartyId());
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthorizationCodeClaimsSetManipulationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthorizationCodeClaimsSetManipulationStrategyLookupFunction.java
index 3f7272e..98d5165 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthorizationCodeClaimsSetManipulationStrategyLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthorizationCodeClaimsSetManipulationStrategyLookupFunction.java
@@ -27,11 +27,12 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationCodeProducingProfileConfiguration;
/**
* A function that returns
- * {@link OIDCAuthorizationConfiguration#getAuthorizationCodeClaimsSetManipulationStrategy(ProfileRequestContext)}
+ * {@link OAuth2AuthorizationCodeProducingProfileConfiguration#getAuthorizationCodeClaimsSetManipulationStrategy
+ * (ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -43,13 +44,15 @@ public class AuthorizationCodeClaimsSetManipulationStrategyLookupFunction exten
AbstractRelyingPartyLookupFunction<BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> {
/** {@inheritDoc} */
+ @Override
@Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> apply(
@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration) pc).getAuthorizationCodeClaimsSetManipulationStrategy(input);
+ if (pc instanceof OAuth2AuthorizationCodeProducingProfileConfiguration) {
+ return ((OAuth2AuthorizationCodeProducingProfileConfiguration) pc)
+ .getAuthorizationCodeClaimsSetManipulationStrategy(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthzCodeLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthzCodeLifetimeLookupFunction.java
index a934440..6c9a411 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthzCodeLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/AuthzCodeLifetimeLookupFunction.java
@@ -26,11 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationCodeProducingProfileConfiguration;
/**
* A function that returns
- * {@link OIDCAuthorizationConfiguration#getAuthorizeCodeLifetime(ProfileRequestContext)}
+ * {@link OAuth2AuthorizationCodeProducingProfileConfiguration#getAuthorizeCodeLifetime(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -39,12 +39,13 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
public class AuthzCodeLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
+ @Override
@Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDCAuthorizationConfiguration) {
- return ((OIDCAuthorizationConfiguration) pc).getAuthorizeCodeLifetime(input);
+ if (pc instanceof OAuth2AuthorizationCodeProducingProfileConfiguration) {
+ return ((OAuth2AuthorizationCodeProducingProfileConfiguration) pc).getAuthorizeCodeLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClaimsValidatorLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClaimsValidatorLookupFunction.java
index 2c58a50..358b3bd 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClaimsValidatorLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClaimsValidatorLookupFunction.java
@@ -25,11 +25,11 @@ import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2ClientAuthenticableProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
/**
* A function that obtains
- * {@link AbstractOAuth2ClientAuthenticableProfileConfiguration#getClaimsValidator(ProfileRequestContext)}
+ * {@link OAuth2ClientAuthenticableProfileConfiguration#getClaimsValidator(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -40,12 +40,13 @@ import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2ClientAuthenticab
public class ClaimsValidatorLookupFunction extends AbstractRelyingPartyLookupFunction<ClaimsValidator> {
/** {@inheritDoc} */
+ @Override
@Nullable public ClaimsValidator apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOAuth2ClientAuthenticableProfileConfiguration) {
- return ((AbstractOAuth2ClientAuthenticableProfileConfiguration) pc).getClaimsValidator(input);
+ if (pc instanceof OAuth2ClientAuthenticableProfileConfiguration) {
+ return ((OAuth2ClientAuthenticableProfileConfiguration) pc).getClaimsValidator(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClientInformationStringValueLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClientInformationStringValueLookupFunction.java
index 334f0e6..a530389 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClientInformationStringValueLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClientInformationStringValueLookupFunction.java
@@ -31,8 +31,8 @@ import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- * Fetches the value for the configured key as {@link String}. May be {@code null} if the value is not found or the given
- * {@link OIDCClientInformation} or its metadata is null.
+ * Fetches the value for the configured key as {@link String}. May be {@code null} if the value is not found or the
+ * given {@link OIDCClientInformation} or its metadata is null.
*/
public class ClientInformationStringValueLookupFunction implements Function<OIDCClientInformation, String> {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/DeniedUserInfoAttributesLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/DeniedUserInfoAttributesLookupFunction.java
index 0f1bf25..f665127 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/DeniedUserInfoAttributesLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/DeniedUserInfoAttributesLookupFunction.java
@@ -42,6 +42,7 @@ public class DeniedUserInfoAttributesLookupFunction
extends AbstractRelyingPartyLookupFunction<Set<String>> {
/** {@inheritDoc} */
+ @Override
@Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/EncodedAttributesLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/EncodedAttributesLookupFunction.java
index 47e71eb..b6bd03d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/EncodedAttributesLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/EncodedAttributesLookupFunction.java
@@ -40,6 +40,7 @@ public class EncodedAttributesLookupFunction
extends AbstractRelyingPartyLookupFunction<Set<String>> {
/** {@inheritDoc} */
+ @Override
@Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/GrantTypesLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/GrantTypesLookupFunction.java
index 72f8c9d..2c175cc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/GrantTypesLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/GrantTypesLookupFunction.java
@@ -32,6 +32,7 @@ import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFun
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration;
+
/**
* A function that obtains
* {@link OAuth2TokenConfiguration#getGrantTypes(ProfileRequestContext)}
@@ -44,6 +45,7 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration;
public class GrantTypesLookupFunction extends AbstractRelyingPartyLookupFunction<Set<GrantType>> {
/** {@inheritDoc} */
+ @Override
@Nullable public Set<GrantType> apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenLifetimeLookupFunction.java
index c676659..195c7ce 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenLifetimeLookupFunction.java
@@ -26,11 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCIDTokenProducingProfileConfiguration;
/**
* A function that returns
- * {@link AbstractOIDCSSOConfiguration#getIDTokenLifetime(ProfileRequestContext)}
+ * {@link OIDCIDTokenProducingProfileConfiguration#getIDTokenLifetime(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -39,12 +39,13 @@ import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
public class IDTokenLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
+ @Override
@Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).getIDTokenLifetime(input);
+ if (pc instanceof OIDCIDTokenProducingProfileConfiguration) {
+ return ((OIDCIDTokenProducingProfileConfiguration) pc).getIDTokenLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenManipulationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenManipulationStrategyLookupFunction.java
index d79b54c..6b4225a 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenManipulationStrategyLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IDTokenManipulationStrategyLookupFunction.java
@@ -27,11 +27,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCIDTokenProducingProfileConfiguration;
/**
* A function that returns
- * {@link AbstractOIDCSSOConfiguration#getIDTokenManipulationStrategy(ProfileRequestContext)}
+ * {@link OIDCIDTokenProducingProfileConfiguration#getIDTokenManipulationStrategy(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -41,13 +41,14 @@ public class IDTokenManipulationStrategyLookupFunction extends
AbstractRelyingPartyLookupFunction<BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> {
/** {@inheritDoc} */
+ @Override
@Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> apply(
@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).getIDTokenManipulationStrategy(input);
+ if (pc instanceof OIDCIDTokenProducingProfileConfiguration) {
+ return ((OIDCIDTokenProducingProfileConfiguration) pc).getIDTokenManipulationStrategy(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IssuedClaimsValidatorLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IssuedClaimsValidatorLookupFunction.java
index f2b4041..bce349c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IssuedClaimsValidatorLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/IssuedClaimsValidatorLookupFunction.java
@@ -25,11 +25,11 @@ import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2TokenValidatingConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenValidatingProfileConfiguration;
/**
* A function that obtains
- * {@link AbstractOAuth2TokenValidatingConfiguration#getIssuedClaimsValidator(ProfileRequestContext)}
+ * {@link OAuth2TokenValidatingProfileConfiguration#getIssuedClaimsValidator(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -40,12 +40,13 @@ import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2TokenValidatingCo
public class IssuedClaimsValidatorLookupFunction extends AbstractRelyingPartyLookupFunction<ClaimsValidator> {
/** {@inheritDoc} */
+ @Override
@Nullable public ClaimsValidator apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOAuth2TokenValidatingConfiguration) {
- return ((AbstractOAuth2TokenValidatingConfiguration) pc).getIssuedClaimsValidator(input);
+ if (pc instanceof OAuth2TokenValidatingProfileConfiguration) {
+ return ((OAuth2TokenValidatingProfileConfiguration) pc).getIssuedClaimsValidator(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenClaimsSetManipulationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenClaimsSetManipulationStrategyLookupFunction.java
index 1bdf1f6..2fb9ca7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenClaimsSetManipulationStrategyLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenClaimsSetManipulationStrategyLookupFunction.java
@@ -43,6 +43,7 @@ public class RefreshTokenClaimsSetManipulationStrategyLookupFunction extends
AbstractRelyingPartyLookupFunction<BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> {
/** {@inheritDoc} */
+ @Override
@Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> apply(
@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
index 84c4b42..64ab92c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RefreshTokenLifetimeLookupFunction.java
@@ -26,11 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProfileConfiguration;
/**
* A function that returns
- * {@link AbstractOIDCSSOConfiguration#getRefreshTokenLifetime(ProfileRequestContext)}
+ * {@link OAuth2RefreshTokenProducingProfileConfiguration#getRefreshTokenLifetime(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}.
*
@@ -39,12 +39,13 @@ import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
public class RefreshTokenLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
+ @Override
@Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).getRefreshTokenLifetime(input);
+ if (pc instanceof OAuth2RefreshTokenProducingProfileConfiguration) {
+ return ((OAuth2RefreshTokenProducingProfileConfiguration) pc).getRefreshTokenLifetime(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationMetadataPolicyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationMetadataPolicyLookupFunction.java
index 6ccd9cc..314fc86 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationMetadataPolicyLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationMetadataPolicyLookupFunction.java
@@ -41,11 +41,12 @@ public class RegistrationMetadataPolicyLookupFunction
extends AbstractRelyingPartyLookupFunction<Map<String,MetadataPolicy>> {
/** {@inheritDoc} */
+ @Override
@Nullable public Map<String,MetadataPolicy> apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof OIDCDynamicRegistrationConfiguration) {
+ if (pc instanceof OIDCDynamicRegistrationConfiguration) {
return ((OIDCDynamicRegistrationConfiguration) pc).getMetadataPolicy(input);
}
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationValidityPeriodLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationValidityPeriodLookupFunction.java
index 544fb57..63011be 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationValidityPeriodLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RegistrationValidityPeriodLookupFunction.java
@@ -39,6 +39,7 @@ import net.shibboleth.oidc.profile.config.OIDCDynamicRegistrationConfiguration;
public class RegistrationValidityPeriodLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
+ @Override
@Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationLifetimeLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationLifetimeLookupFunction.java
index b648d3e..bb9d678 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationLifetimeLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationLifetimeLookupFunction.java
@@ -53,11 +53,13 @@ public class RevocationLifetimeLookupFunction extends AbstractRelyingPartyLookup
}
/** {@inheritDoc} */
+ @Override
@Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = activeProfileOnly ? rpc.getProfileConfig() :
- rpc.getConfiguration().getProfileConfiguration(input, OAuth2TokenRevocationConfiguration.PROFILE_ID);
+ rpc.getConfiguration()
+ .getProfileConfiguration(input, OAuth2TokenRevocationConfiguration.PROFILE_ID);
if (pc instanceof OAuth2TokenRevocationConfiguration) {
return ((OAuth2TokenRevocationConfiguration) pc).getRevocationLifetime(input);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationMethodLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationMethodLookupFunction.java
index dd6baa2..355af53 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationMethodLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RevocationMethodLookupFunction.java
@@ -27,6 +27,7 @@ import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFun
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration.OAuth2TokenRevocationMethod;
+
/**
* A function that returns
* {@link OAuth2TokenRevocationConfiguration#getRevocationMethod(ProfileRequestContext)}
@@ -40,6 +41,7 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfigurat
public class RevocationMethodLookupFunction extends AbstractRelyingPartyLookupFunction<OAuth2TokenRevocationMethod> {
/** {@inheritDoc} */
+ @Override
@Nullable public OAuth2TokenRevocationMethod apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/SecretExpirationPeriodLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/SecretExpirationPeriodLookupFunction.java
index da1d390..fbe17b0 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/SecretExpirationPeriodLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/SecretExpirationPeriodLookupFunction.java
@@ -39,6 +39,7 @@ import net.shibboleth.oidc.profile.config.OIDCDynamicRegistrationConfiguration;
public class SecretExpirationPeriodLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
/** {@inheritDoc} */
+ @Override
@Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java
index 0e9bfb1..0750b20 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java
@@ -29,11 +29,11 @@ import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2ClientAuthenticableProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
/**
* A function that obtains
- * {@link AbstractOAuth2ClientAuthenticableProfileConfiguration#getTokenEndpointAuthMethods(ProfileRequestContext)}
+ * {@link OAuth2ClientAuthenticableProfileConfiguration#getTokenEndpointAuthMethods(ProfileRequestContext)}
* if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
* by default a child of the {@link ProfileRequestContext}. That result is then transformed into a list
* of {@link ClientAuthenticationMethod}s.
@@ -44,13 +44,14 @@ public class TokenEndpointAuthMethodLookupFunction
extends AbstractRelyingPartyLookupFunction<Set<ClientAuthenticationMethod>> {
/** {@inheritDoc} */
+ @Override
@Nullable public Set<ClientAuthenticationMethod> apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOAuth2ClientAuthenticableProfileConfiguration) {
+ if (pc instanceof OAuth2ClientAuthenticableProfileConfiguration) {
final Set<String> methods =
- ((AbstractOAuth2ClientAuthenticableProfileConfiguration)pc).getTokenEndpointAuthMethods(input);
+ ((OAuth2ClientAuthenticableProfileConfiguration)pc).getTokenEndpointAuthMethods(input);
if (methods != null) {
return methods
.stream()
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/OIDCMessageEncoder.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/OIDCMessageEncoder.java
index 298b7e0..ff28db7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/OIDCMessageEncoder.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/OIDCMessageEncoder.java
@@ -21,7 +21,7 @@ import java.util.function.Predicate;
import org.opensaml.messaging.encoder.MessageEncoder;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration.HttpRequestMethod;
/**
* An OIDC message encoder interface which requires implementations to test if the request
@@ -29,6 +29,6 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHtt
*
* @since 2.2.0
*/
-public interface OIDCMessageEncoder extends Predicate<OIDCHttpRequestMethod>, MessageEncoder {
+public interface OIDCMessageEncoder extends Predicate<HttpRequestMethod>, MessageEncoder {
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
new file mode 100644
index 0000000..79218b3
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.time.Duration;
+import java.util.Map;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+
+/**
+ * Configuration common to OAuth 2.0 access token producing profiles.
+ */
+public interface OAuth2AccessTokenProducingProfileConfiguration extends OAuth2ProfileConfiguration {
+
+ /**
+ * Get access token type.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return access token type, or null for unspecified/opaque
+ *
+ * @since 2.1.0
+ */
+ @Nullable @NotEmpty String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get access token lifetime.
+ *
+ * <p>Defaults to 10 minutes.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return access token lifetime
+ */
+ @Positive @Nonnull Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the bi-function for manipulating access token claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating access token claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java
new file mode 100644
index 0000000..cec5ea6
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.time.Duration;
+import java.util.Map;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+
+/**
+ * Configuration common to authorizaton code producing profiles.
+ */
+public interface OAuth2AuthorizationCodeProducingProfileConfiguration extends OAuth2ProfileConfiguration {
+
+
+ /**
+ * Get authz code lifetime.
+ *
+ * <p>Defaults to 5 minutes.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return authz code lifetime
+ */
+ @Positive @Nonnull
+ Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the bi-function for manipulating authorization code claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
new file mode 100644
index 0000000..b991354
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
@@ -0,0 +1,93 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.util.Set;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+
+/**
+ * Configuration for a generic OAuth 2.0 authorization request.
+ */
+public interface OAuth2AuthorizationProfileConfiguration {
+
+ /** Enumeration of the HTTP methods used in various OAuth requests.*/
+ public enum HttpRequestMethod {
+ /**
+ * HTTP GET.
+ */
+ GET,
+ /**
+ * HTTP POST.
+ */
+ POST
+ }
+
+ /**
+ * Get the scopes to use in authentication requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the scopes
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NonnullElements @Unmodifiable @NotLive Set<String> getScopes(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the HTTP request method for an authentication request.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the HTTP request method
+ */
+ @Nullable HttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get the response_mode to use for authorization requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_mode
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NotEmpty String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the response_type to use for authorization requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_type
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NotEmpty String getResponseType(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
new file mode 100644
index 0000000..c7178a4
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
+import net.shibboleth.oidc.security.credential.ClientSecretCredential;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * OAuth 2.0 profile configurations that support OAuth-defined client authentication methods.
+ *
+ * <p>This is specific to the role of the OAuth 2.0 client.</p>
+ */
+public interface OAuth2ClientAuthenticableClientProfileConfiguration
+ extends AuthenticationProfileConfiguration, OAuth2ProfileConfiguration {
+
+ /**
+ * Get the token endpoint authentication method to use with an OpenID Provider.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the token endpoint authentication method to use.
+ *
+ * @since 2.2.0
+ */
+ @Nonnull String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the client credential for the given context. Typically a client_secret
+ * associated with the current client_id.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the client credential
+ *
+ * @since 2.2.0
+ *
+ */
+ @Nullable ClientSecretCredential getClientCredential(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the client_id appropriate for the given context. Typically that associated
+ * with the chosen OpenID Connect Provider.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the client_id
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NotEmpty String getClientId(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
new file mode 100644
index 0000000..c9fbe0a
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.util.Set;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+
+/** OAuth 2.0 profile configurations that support OAuth-defined client authentication methods.*/
+public interface OAuth2ClientAuthenticableProfileConfiguration
+ extends AuthenticationProfileConfiguration, OAuth2ProfileConfiguration {
+
+ /**
+ * Get the {@link ClaimsValidator} to apply to JWT-based client authentication.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the validator to use
+ *
+ * @since 3.1.0
+ */
+ @Nullable ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the enabled token endpoint authentication methods.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return enabled token endpoint authentication methods
+ */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getTokenEndpointAuthMethods(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2FlowAwareProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2FlowAwareProfileConfiguration.java
new file mode 100644
index 0000000..c5a85de
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2FlowAwareProfileConfiguration.java
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * Interface for profile configurations that understand OAuth 2.0 authorization grants corresponding to OIDC
+ * authentication flows.
+ */
+public interface OAuth2FlowAwareProfileConfiguration extends OAuth2ProfileConfiguration {
+
+ /**
+ * Get whether authorization code flow is supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether authorization code flow is supported by this profile
+ */
+ boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get whether hybrid flow is supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether hybrid flow is supported by this profile
+ */
+ boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether refresh tokens are supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether refresh tokens are supported by this profile
+ */
+ boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
index 8ed01c0..7a59c8e 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
@@ -17,11 +17,9 @@
package net.shibboleth.oidc.profile.oauth2.config;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.config.ConditionalProfileConfiguration;
-/**
- * Marker interface for OAuth 2 profile configurations.
- */
-public interface OAuth2ProfileConfiguration extends ProfileConfiguration {
+/** Common interface for OAuth 2.0 Profile Configurations.*/
+public interface OAuth2ProfileConfiguration extends ConditionalProfileConfiguration {
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
similarity index 54%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
index 8824315..bc3714f 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
@@ -17,36 +17,33 @@
package net.shibboleth.oidc.profile.oauth2.config;
+import java.time.Duration;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import org.opensaml.profile.context.ProfileRequestContext;
-/**
- * Profile configuration for the OAuth2 Token Introspection.
- */
-public class OAuth2TokenIntrospectionConfiguration extends AbstractOAuth2TokenValidatingConfiguration {
-
- /** OAuth2 Token Revocation URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
-
- /**
- * Constructor.
- */
- public OAuth2TokenIntrospectionConfiguration() {
- this(PROFILE_ID);
- }
+/**
+ * Configuration common to OAuth 2.0 refresh token producing profiles.
+ */
+public interface OAuth2RefreshTokenProducingProfileConfiguration extends OAuth2ProfileConfiguration {
/**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
+ * Get refresh token lifetime.
+ *
+ * <p>Defaults to 2 hours.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return refresh token lifetime
*/
- public OAuth2TokenIntrospectionConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
+ @Nonnull @Positive Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ //TODO: can move the getRefreshTokenClaimsSetManipulationStrategy from the OAuth2TokenProfileConfiguration in 3.0.0
+ // to keep consistent with other token producers
-}
\ No newline at end of file
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
index 6d0a9bf..0cc0f36 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
@@ -17,35 +17,21 @@
package net.shibboleth.oidc.profile.oauth2.config;
-import java.time.Duration;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.google.common.base.Predicates;
-import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Interface for OAuth 2 token "audience" profile configuration.
+ * Profile interface for OAuth 2 token "audience" profile configuration.
*
- * <p>This applies to behavior controlling the characteristics of tokens issued
+ * <p>This applies to behaviour controlling the characteristics of tokens issued
* to the parties intended to process them, as distinct from the clients that use them.</p>
*/
-public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfileConfiguration
- implements OAuth2ProfileConfiguration, OverriddenIssuerProfileConfiguration,
- AttributeResolvingProfileConfiguration {
+public interface OAuth2TokenAudienceConfiguration extends OAuth2TokenEncryptionProfileConfiguration,
+ OverriddenIssuerProfileConfiguration, OAuth2AccessTokenProducingProfileConfiguration,
+ AttributeResolvingProfileConfiguration {
/** OAuth2 Token Revocation URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc6749";
@@ -53,188 +39,5 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
/** ID for this profile configuration. */
@Nonnull @NotEmpty
public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token/audience";
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Whether attributes should be resolved in the course of the profile. */
- @Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
-
- /** Whether encryption is optional in the face of no key, etc. */
- @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
-
- /** Lookup functioon to supply access token type. */
- @Nonnull private Function<ProfileRequestContext,String> accessTokenTypeLookupStrategy;
-
- /** Lookup function to supply access token lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
-
- /** Constructor. */
- public OAuth2TokenAudienceConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OAuth2TokenAudienceConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
-
- issuerLookupStrategy = FunctionSupport.constant(null);
-
- resolveAttributesPredicate = Predicates.alwaysTrue();
- encryptionOptionalPredicate = Predicates.alwaysFalse();
-
- accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
- return resolveAttributesPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether attributes should be resolved during the profile.
- *
- * @param flag flag to set
- */
- public void setResolveAttributes(final boolean flag) {
- resolveAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether attributes should be resolved during the profile.
- *
- * @param condition condition to set
- */
- public void setResolveAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
- }
-
- /**
- * Get whether encryption is optional in the face of a missing key, etc.
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff encryption is optional
- */
- public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
- return encryptionOptionalPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether encryption is optional in the face of a missing key, etc.
- *
- * @param flag flag to set
- */
- public void setEncryptionOptional(final boolean flag) {
- encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set a condition to determine whether encryption is optional in the face of a missing key, etc.
- *
- * @param condition condition to set
- */
- public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
- }
-
- /**
- * Get access token type.
- *
- * @param profileRequestContext profile request context
- *
- * @return access token type, or null for unspecified/opaque
- */
- @Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
- return accessTokenTypeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set access token type.
- *
- * @param type token type, or null for unspecified/opaque
- */
- public void setAccessTokenType(@Nullable @NotEmpty final String type) {
- accessTokenTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
- }
-
- /**
- * Set lookup strategy for access token type.
- *
- * @param strategy lookup strategy
- */
- public void setAccessTokenTypeLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- accessTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get access token lifetime.
- *
- * <p>Defaults to 10 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return access token lifetime
- */
- @Positive @Nonnull
- public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Access token lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of an access token.
- *
- * @param lifetime lifetime of an access token in milliseconds
- */
- public void setAccessTokenLifetime(@Positive @Nonnull final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Access token lifetime must be greater than 0");
-
- accessTokenLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the access token lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setAccessTokenLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
index 2f75eb7..728ad1f 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
@@ -17,71 +17,29 @@
package net.shibboleth.oidc.profile.oauth2.config;
-import java.util.Collection;
-import java.util.Collections;
import java.util.Map;
import java.util.Set;
import java.util.function.BiFunction;
-import java.util.function.Function;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
-import com.nimbusds.oauth2.sdk.GrantType;
-
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCSSOProviderConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * OIDC-aware OAuth 2 token endpoint profile configuration.
+ * OIDC-aware OAuth 2.0 token endpoint profile configuration.
*/
-public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
+public interface OAuth2TokenConfiguration extends OIDCSSOProviderConfiguration {
/** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token";
-
- /** Enabled grant types. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> grantTypesLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating refresh token claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- refreshTokenClaimsSetManipulationStrategyLookupStrategy;
-
- /** Whether always revoke the refresh_token after it's used. */
- @Nonnull private Predicate<ProfileRequestContext> enforceRefreshTokenRotationPredicate;
-
- /**
- * Constructor.
- */
- public OAuth2TokenConfiguration() {
- this(PROFILE_ID);
-
- grantTypesLookupStrategy = FunctionSupport.constant(
- Set.of(GrantType.AUTHORIZATION_CODE.toString(), GrantType.REFRESH_TOKEN.toString()));
- refreshTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- enforceRefreshTokenRotationPredicate = Predicates.alwaysFalse();
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId unique profile identifier
- */
- public OAuth2TokenConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
-
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token";
+
/**
* Get the enabled grant types.
*
@@ -89,84 +47,11 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
*
* @return enabled grant types
*/
- @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getGrantTypes(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Collection<String> types = grantTypesLookupStrategy.apply(profileRequestContext);
- if (types != null) {
- return Set.copyOf(types);
- }
- return Collections.emptySet();
- }
-
- /**
- * Set the enabled grant types.
- *
- * @param types types to enable
- */
- public void setGrantTypes(@Nonnull @NonnullElements final Collection<String> types) {
- Constraint.isNotNull(types, "Collection of types cannot be null");
-
- if (types != null) {
- grantTypesLookupStrategy =
- FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(types)));
- } else {
- grantTypesLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the enabled grant types.
- *
- * @param strategy lookup strategy
- */
- public void setGrantTypesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- grantTypesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Get the bi-function for manipulating refresh token claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating refresh token claims set
- *
- * @since 2.1.0
- */
- @Nonnull
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getRefreshTokenClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return refreshTokenClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-function for manipulating refresh token claims set.
- *
- * @param strategy bi-function for manipulating refresh token claims set
- *
- * @since 2.1.0
- */
- public void setRefreshTokenClaimsSetManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- refreshTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-function for manipulating refresh token claims set.
- *
- * @param strategy lookup strategy
- *
- * @since 2.1.0
- */
- public void setRefreshTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- refreshTokenClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
+ @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getGrantTypes(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+
+
/**
* Get whether always revoke the refresh_token after it's used.
*
@@ -176,32 +61,20 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
*
* @since 2.1.0
*/
- @Nonnull
- public boolean isEnforceRefreshTokenRotation(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return enforceRefreshTokenRotationPredicate.test(profileRequestContext);
- }
-
+ boolean isEnforceRefreshTokenRotation(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
/**
- * Set whether always revoke the refresh_token after it's used.
- *
- * @param flag flag to set
+ * Get the bi-function for manipulating refresh token claims set.
*
- * @since 2.1.0
- */
- public void setEnforceRefreshTokenRotation(final boolean flag) {
- enforceRefreshTokenRotationPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
- }
-
- /**
- * Set condition for whether always revoke the refresh_token after it's used.
+ * @param profileRequestContext profile request context
*
- * @param condition condition to set
+ * @return the bi-function for manipulating refresh token claims set
*
* @since 2.1.0
*/
- public void setEnforceRefreshTokenRotationPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- enforceRefreshTokenRotationPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
+ // TODO: move to OAuth2RefreshTokenProducingProfileConfiguration in 3.0.0
+ @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getRefreshTokenClaimsSetManipulationStrategy(@Nullable final ProfileRequestContext profileRequestContext);
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenEncryptionProfileConfiguration.java
similarity index 57%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenEncryptionProfileConfiguration.java
index 8ed01c0..e2330a5 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenEncryptionProfileConfiguration.java
@@ -17,11 +17,24 @@
package net.shibboleth.oidc.profile.oauth2.config;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.config.OIDCProfileConfiguration;
/**
- * Marker interface for OAuth 2 profile configurations.
+ * Profile configuration for token endpoints that deal with encryption.
*/
-public interface OAuth2ProfileConfiguration extends ProfileConfiguration {
-
-}
\ No newline at end of file
+public interface OAuth2TokenEncryptionProfileConfiguration extends OIDCProfileConfiguration {
+
+ /**
+ * Get whether encryption is optional in the face of a missing key, etc.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff encryption is optional
+ */
+ boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
index 8824315..eeb0c1d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
@@ -17,36 +17,19 @@
package net.shibboleth.oidc.profile.oauth2.config;
-
import javax.annotation.Nonnull;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
- * Profile configuration for the OAuth2 Token Introspection.
+ * Profile configuration for OAuth2 Token Introspection.
*/
-public class OAuth2TokenIntrospectionConfiguration extends AbstractOAuth2TokenValidatingConfiguration {
+public interface OAuth2TokenIntrospectionConfiguration extends OAuth2TokenValidatingProfileConfiguration,
+ OAuth2ProfileConfiguration {
/** OAuth2 Token Revocation URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
-
- /**
- * Constructor.
- */
- public OAuth2TokenIntrospectionConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OAuth2TokenIntrospectionConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
-
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
index a6c51b0..3c994e4 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
@@ -15,10 +15,10 @@
* limitations under the License.
*/
+
package net.shibboleth.oidc.profile.oauth2.config;
import java.time.Duration;
-import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -27,21 +27,18 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * Profile configuration for the OAuth2 Token Revocation.
+ * Configuration for the OAuth 2.0 Token Revocation profile.
*/
-public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValidatingConfiguration {
-
+public interface OAuth2TokenRevocationConfiguration extends OAuth2TokenValidatingProfileConfiguration {
+
/** OAuth2 Token Revocation URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7009";
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/revocation";
-
+
/** Enumeration of the OAuth2 token revocation methods. */
public enum OAuth2TokenRevocationMethod {
/**
@@ -53,57 +50,7 @@ public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValid
*/
TOKEN
}
-
- /**
- * Which revocation method should be used when revoking a token.
- * Supported values are CHAIN and TOKEN. The default is CHAIN.
- */
- @Nonnull private Function<ProfileRequestContext,String> revocationMethodLookupStrategy;
-
- /** Lookup function to supply revocation lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> revocationLifetimeLookupStrategy;
-
- /**
- * Constructor.
- */
- public OAuth2TokenRevocationConfiguration() {
- this(PROFILE_ID);
- revocationMethodLookupStrategy = FunctionSupport.constant(OAuth2TokenRevocationMethod.CHAIN.toString());
- revocationLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(6));
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OAuth2TokenRevocationConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
-
- /**
- * Set strategy for looking up which revocation method should be used when revoking a token.
- *
- * @param strategy What to set.
- *
- * @since 2.1.0
- */
- public void setRevocationMethodLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,String> strategy) {
- revocationMethodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**
- * Set which revocation method should be used when revoking a token.
- *
- * @param method What to set.
- *
- * @since 2.1.0
- */
- public void setRevocationMethod(@Nonnull @NotEmpty final OAuth2TokenRevocationMethod method) {
- revocationMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
- }
-
+
/**
* Get the revocation method used when revoking a token.
*
@@ -112,32 +59,8 @@ public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValid
*
* @since 2.1.0
*/
- public OAuth2TokenRevocationMethod getRevocationMethod(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final String method = revocationMethodLookupStrategy.apply(profileRequestContext);
- if (method != null) {
- try {
- return OAuth2TokenRevocationMethod.valueOf(method);
- } catch (final IllegalArgumentException e) {
- throw new ConstraintViolationException("Unexpected revocation method value: '" + method + "': "
- + e.getMessage());
- }
- }
- return null;
- }
-
- /**
- * Set a lookup strategy for the revocation lifetime.
- *
- * @param strategy What to set.
- *
- * @since 2.1.0
- */
- public void setRevocationLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- revocationLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
+ OAuth2TokenRevocationMethod getRevocationMethod(@Nullable final ProfileRequestContext profileRequestContext);
+
/**
* Get revocation lifetime.
*
@@ -150,26 +73,6 @@ public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValid
* @since 2.1.0
*/
@Positive @Nonnull
- public Duration getRevocationLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = revocationLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Revocation lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of revocation.
- *
- * @param lifetime What to set.
- *
- * @since 2.1.0
- */
- public void setRevocationLifetime(@Positive @Nonnull final Duration lifetime) {
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Revocation lifetime must be greater than 0");
-
- revocationLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
+ Duration getRevocationLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/test/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfigurationTest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java
similarity index 51%
copy from oidc-common-profile-api/src/test/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfigurationTest.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java
index 9b5fed0..4cd1ba0 100644
--- a/oidc-common-profile-api/src/test/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfigurationTest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java
@@ -15,30 +15,29 @@
* limitations under the License.
*/
+
package net.shibboleth.oidc.profile.oauth2.config;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
-import org.testng.Assert;
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
/**
- * Tests for {@link OAuth2TokenRevocationConfiguration}, tests only constructors.
+ * Profile configuration for OIDC-aware OAuth 2.0 token endpoints.
*/
-public class OAuth2TokenRevocationConfigurationTest {
-
- private OAuth2TokenRevocationConfiguration conf;
-
- @BeforeMethod
- protected void setUp() throws Exception {
- conf = new OAuth2TokenRevocationConfiguration();
- }
-
- @Test
- public void test() {
- Assert.assertEquals(OAuth2TokenRevocationConfiguration.PROFILE_ID, conf.getId());
- conf = new OAuth2TokenRevocationConfiguration("somethingelse");
- Assert.assertEquals("somethingelse", conf.getId());
- }
-
-}
\ No newline at end of file
+public interface OAuth2TokenValidatingProfileConfiguration extends OAuth2ClientAuthenticableProfileConfiguration,
+ OverriddenIssuerProfileConfiguration, OAuth2ProfileConfiguration {
+
+ /**
+ * Get the {@link ClaimsValidator} to apply to issued JWT-based tokens being validated by this profile.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the validator to use
+ */
+ @Nullable ClaimsValidator getIssuedClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-impl/pom.xml b/oidc-common-profile-impl/pom.xml
index d591eeb..21a43a4 100644
--- a/oidc-common-profile-impl/pom.xml
+++ b/oidc-common-profile-impl/pom.xml
@@ -22,11 +22,6 @@
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-profile-api</artifactId>
</dependency>
- <!-- TODO remove impl module. Needed for the CredentialConversionUtil class - maybe move that to API?-->
- <dependency>
- <groupId>net.shibboleth.oidc</groupId>
- <artifactId>oidc-common-crypto-impl</artifactId>
- </dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-crypto-api</artifactId>
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
similarity index 79%
rename from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
rename to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 93615f8..61829f0 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.config;
+package net.shibboleth.oidc.profile.config.impl;
import java.time.Duration;
import java.util.Collection;
@@ -33,10 +33,9 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
-import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
-import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCSSOProviderConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCSSORelyingPartyConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2FlowAwareProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
@@ -49,11 +48,12 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.
*/
public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
- implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration,
- AttributeResolvingProfileConfiguration {
-
+ implements OIDCSSORelyingPartyConfiguration, OIDCSSOProviderConfiguration {
+
+ //TODO move to interface?
/** OIDC base protocol URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
+ @Nonnull @NotEmpty
+ public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
@@ -73,7 +73,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** Lookup function to supply ID token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
- /** Lookup functioon to supply access token type. */
+ /** Lookup function to supply access token type. */
@Nonnull private Function<ProfileRequestContext,String> accessTokenTypeLookupStrategy;
/** Lookup function to supply access token lifetime. */
@@ -97,9 +97,6 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
@Nonnull
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
accessTokenClaimsSetManipulationStrategyLookupStrategy;
-
- /** Lookup function to override the default response_mode for a given response_type.*/
- @Nonnull private Function<ProfileRequestContext, String> responseModeLookupStrategy;
/**
* Creates a new configuration instance.
@@ -126,7 +123,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- responseModeLookupStrategy = FunctionSupport.constant(null);
+
}
/** {@inheritDoc} */
@@ -177,13 +174,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
}
- /**
- * Get whether encryption is optional in the face of a missing key, etc.
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff encryption is optional
- */
+ @Override
public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptionOptionalPredicate.test(profileRequestContext);
}
@@ -206,13 +197,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
}
- /**
- * Get whether client is required to use PKCE.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is required to use PKCE
- */
+ @Override
public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
return forcePKCEPredicate.test(profileRequestContext);
}
@@ -235,13 +220,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Get whether client is allowed to use PKCE code challenge method plain.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is allowed to use PKCE code challenge method plain
- */
+ @Override
public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
return allowPKCEPlainPredicate.test(profileRequestContext);
}
@@ -264,17 +243,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
-
- /**
- * Get ID token lifetime.
- *
- * <p>Defaults to 1 hour.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return ID token lifetime
- */
+ @Override
@Positive @Nonnull public Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = idTokenLifetimeLookupStrategy.apply(profileRequestContext);
@@ -304,17 +273,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
public void setIDTokenLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
idTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
-
- /**
- * Get access token type.
- *
- * @param profileRequestContext profile request context
- *
- * @return access token type, or null for unspecified/opaque
- *
- * @since 2.1.0
- */
- @Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
+
+ @Override
+ @Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
return accessTokenTypeLookupStrategy.apply(profileRequestContext);
}
@@ -340,15 +301,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get access token lifetime.
- *
- * <p>Defaults to 10 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return access token lifetime
- */
+ @Override
@Positive @Nonnull
public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
@@ -380,15 +333,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get refresh token lifetime.
- *
- * <p>Defaults to 2 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return refresh token lifetime
- */
+ @Override
@Nonnull @Positive
public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
@@ -420,14 +365,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
- * which the token may be shared.
- *
- * @param profileRequestContext profile request context
- *
- * @return the additional audiences
- */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -465,17 +403,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the set of attribute IDs which should be included in the ID token regardless of response_type.
- *
- * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
- * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
- * attributes to be added to the ID token regardless of flow.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to include in all cases
- */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getAlwaysIncludedAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -516,15 +444,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
alwaysIncludedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the bi-function for manipulating id_token claims.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating id_token claims
- *
- * @since 2.1.0
- */
+ @Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -556,15 +476,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
idTokenManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the bi-function for manipulating access token claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating access token claims set
- *
- * @since 2.1.0
- */
+ @Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
getAccessTokenClaimsSetManipulationStrategy(
@@ -597,40 +509,5 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
"Lookup strategy cannot be null");
}
-
- /**
- * Set the lookup strategy to determine the response_mode for authorization requests.
- *
- * @param strategy the strategy to use
- *
- * @since 2.2.0
- */
- public void setResponseModeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
- responseModeLookupStrategy = Constraint.isNotNull(strategy, "ResponseMode lookup strategy can not be null");
- }
-
- /**
- * Get the response_mode to use for authorization requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the response_mode
- *
- * @since 2.2.0
- */
- public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext) {
- return responseModeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the response_mode to use for authorization requests.
- *
- * @param responseMode the response_mode to use
- *
- * @since 2.2.0
- */
- public void setResponseMode(@Nonnull final String responseMode) {
- responseModeLookupStrategy = FunctionSupport.constant(responseMode);
- }
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
similarity index 81%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
copy to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 8bed866..2bf7013 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.config;
+package net.shibboleth.oidc.profile.config.impl;
import java.security.Principal;
import java.time.Duration;
@@ -34,8 +34,9 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
-import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
@@ -46,15 +47,13 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Profile configuration for the OpenID Connect authorization endpoint.
+ * Implementation of a profile configuration for the OpenID Connect authorization endpoint.
*
* <p>It is also usable as a Token endpoint configuration if no non-OIDC use cases are needed.</p>
*/
-public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
- implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
+public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
+ implements OIDCAuthenticationRelyingPartyProfileConfiguration,
+ OIDCAuthorizationConfiguration {
/** Whether all acr claim requests should be treated as Essential. */
@Nonnull private Predicate<ProfileRequestContext> acrRequestAlwaysEssentialPredicate;
@@ -83,18 +82,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
/** Whether to include iss parameter in the authentication response. */
@Nonnull private Predicate<ProfileRequestContext> includeIssuerInResponsePredicate;
- /** Enumeration of the HTTP methods used in OIDC authentication requests.*/
- public enum OIDCHttpRequestMethod {
- /**
- * HTTP GET.
- */
- GET,
- /**
- * HTTP POST.
- */
- POST
- }
-
/** Whether to make a UserInfo Endpoint request for End-User claims.*/
@Nonnull private Predicate<ProfileRequestContext> retrieveUserInfoEndpointClaims;
@@ -140,12 +127,21 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
* Supported values are POST and GET. The default is GET.
*/
@Nonnull private Function<ProfileRequestContext,String> userInfoHttpRequestMethodLookupStrategy;
+
+ /** Lookup function to override the default response_mode for a given response_type.*/
+ @Nonnull private Function<ProfileRequestContext, String> responseModeLookupStrategy;
+
+ /**
+ * Whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's
+ * signature should be validated (false). The default is false, the id_token signature should be validated.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> tlsServerValidationOnlyPredicate;
/**
* Constructor.
*/
- public OIDCAuthorizationConfiguration() {
- this(PROFILE_ID);
+ public DefaultOIDCAuthorizationConfiguration() {
+ this(OIDCSSOProfileConfiguration.PROFILE_ID);
}
/**
@@ -153,7 +149,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @param profileId Unique profile identifier.
*/
- public OIDCAuthorizationConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public DefaultOIDCAuthorizationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
@@ -168,28 +164,20 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
encodeConsentInTokensPredicate = Predicates.alwaysFalse();
useRequestObjectPredicate = Predicates.alwaysFalse();
-
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
-
encodedAttributesLookupStrategy = FunctionSupport.constant(null);
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET.toString());
-
+ httpRequestMethodLookupStrategy = FunctionSupport.constant(HttpRequestMethod.GET.toString());
includeIssuerInResponsePredicate = Predicates.alwaysFalse();
-
authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
maxAuthenticationAgeLookupStrategy = FunctionSupport.constant(null);
loginHintLookupStrategy = FunctionSupport.constant(null);
- userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET.toString());
+ userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(HttpRequestMethod.GET.toString());
+ responseModeLookupStrategy = FunctionSupport.constant(null);
+ tlsServerValidationOnlyPredicate = Predicates.alwaysFalse();
}
- /**
- * Get whether all acr claim requests should be treated as Essential.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether all acr claim requests should be treated as Essential
- */
+ @Override
public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
}
@@ -212,13 +200,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Should authentication request parameters should be passed in a single, self contained, JWT?
- *
- * @param profileRequestContext the profile request context
- *
- * @return whether authentication request parameters should be passed in a single, self contained, JWT
- */
+ @Override
public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
return useRequestObjectPredicate.test(profileRequestContext);
}
@@ -243,13 +225,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
}
- /**
- * Get whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to encode consent in authorization code and access/refresh tokens
- */
+ @Override
public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
return encodeConsentInTokensPredicate.test(profileRequestContext);
}
@@ -272,15 +248,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to make a request to the UserInfo Endpoint
- *
- * @since 2.2.0
- */
+ @Override
public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
return retrieveUserInfoEndpointClaims.test(profileRequestContext);
}
@@ -307,15 +275,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Should the RequestObject (if configured) be signed?
- *
- * @param profileRequestContext the profile request context
- *
- * @return true iff the RequestObject should be signed, false otherwise.
- *
- * @since 2.2.0
- */
+ @Override
public boolean isSignRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
return signRequestObjectPredicate.test(profileRequestContext);
}
@@ -342,15 +302,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
signRequestObjectPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Should the RequestObject (if configured) be encrypted?
- *
- * @param profileRequestContext the profile request context
- *
- * @return true iff the RequestObject should be encrypted, false otherwise.
- *
- * @since 2.2.0
- */
+ @Override
public boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptRequestObjectPredicate.test(profileRequestContext);
}
@@ -404,28 +356,12 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
}
}
- /**
- * Get the redirect_uri override if set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the redirect_uri override
- *
- * @since 2.2.0
- */
+ @Override
public String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext) {
return redirectUriOverrideLookupStrategy.apply(profileRequestContext);
}
- /**
- * Get authz code lifetime.
- *
- * <p>Defaults to 5 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return authz code lifetime
- */
+ @Override
@Positive @Nonnull
public Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = authorizeCodeLifetimeLookupStrategy.apply(profileRequestContext);
@@ -473,22 +409,16 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @param method the HTTP method to set, either POST or GET.
*/
- public void setHttpRequestMethod(@Nonnull @NotEmpty final OIDCHttpRequestMethod method){
+ public void setHttpRequestMethod(@Nonnull @NotEmpty final HttpRequestMethod method){
httpRequestMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
}
- /**
- * Get the HTTP request method for an authentication request.
- *
- * @param profileRequestContext profile request context
- *
- * @return the HTTP request method
- */
- public OIDCHttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext) {
+ @Override
+ public HttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext) {
final String method = httpRequestMethodLookupStrategy.apply(profileRequestContext);
if (method != null) {
try {
- return OIDCHttpRequestMethod.valueOf(method);
+ return HttpRequestMethod.valueOf(method);
} catch (final IllegalArgumentException e) {
throw new ConstraintViolationException("Unexpected HTTP method value: '" + method + "': "
+ e.getMessage());
@@ -497,14 +427,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
return null;
}
- /**
- * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
- * and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to encode
- */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getEncodedAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -542,16 +465,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
encodedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to omit from UserInfo token
- */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -590,15 +504,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get whether to include iss parameter in the authentication response.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to include iss parameter in the authentication response
- *
- * @since 2.1.0
- */
+ @Override
public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext) {
return includeIssuerInResponsePredicate.test(profileRequestContext);
}
@@ -647,28 +553,13 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
responseTypeLookupStrategy = FunctionSupport.constant(responseType);
}
- /**
- * Get the response_type to use for authentication requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the response_type
- *
- * @since 2.2.0
- */
+
+ @Override
public String getResponseType(@Nullable final ProfileRequestContext profileRequestContext) {
return responseTypeLookupStrategy.apply(profileRequestContext);
}
- /**
- * Get the bi-function for manipulating authorization code claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating authorization code claims set
- *
- * @since 2.1.0
- */
+ @Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
getAuthorizationCodeClaimsSetManipulationStrategy(
@@ -729,15 +620,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
}
}
- /**
- * Get the scopes to use in authentication requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the scopes
- *
- * @since 2.2.0
- */
+ @Override
@Nullable public Set<String> getScopes(@Nullable final ProfileRequestContext profileRequestContext) {
return scopesLookupStrategy.apply(profileRequestContext);
}
@@ -756,16 +639,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
amrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the function used to translate AMRs in the inbound id_token into an appropriate set of
- * custom {@link Principal} objects to populate into the subject.
- *
- * @param prc current profile request context
- *
- * @return translation function
- *
- * @since 2.2.0
- */
+ @Override
@Nullable public Function<Collection<String>,Collection<Principal>>
getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc){
return amrTranslationStrategyLookupStrategy.apply(prc);
@@ -785,33 +659,13 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
acrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the function used to translate ACRs in the inbound id_token into an appropriate set of
- * custom {@link Principal} objects to populate into the subject.
- *
- * @param prc current profile request context
- *
- * @return translation function
- *
- * @since 2.2.0
- */
+ @Override
@Nullable public Function<Collection<String>,Collection<Principal>>
getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc){
return acrTranslationStrategyLookupStrategy.apply(prc);
}
- /**
- * Gets whether authentication results produced by use of this profile should carry the proxied
- * assertion's auth_time from the id_token, rather than the current time.
- *
- * <p>Defaults to true.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return whether to proxy across the inbound auth_time
- *
- * @since 2.2.0
- */
+ @Override
public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext) {
return proxiedAuthnInstantPredicate.test(profileRequestContext);
}
@@ -829,15 +683,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
proxiedAuthnInstantPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
- /**
- * Get the max authentication age.
- *
- * @param profileRequestContext profile request context
- *
- * @return max authentication age
- *
- * @since 2.2.0
- */
+ @Override
@Nullable
public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext) {
return maxAuthenticationAgeLookupStrategy.apply(profileRequestContext);
@@ -875,7 +721,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
* @param strategy lookup strategy
*
* @since 2.2.0
- */
+ */
public void setLoginHintLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
loginHintLookupStrategy = Constraint.isNotNull(loginHintLookupStrategy, "Login Hint strategy can not be null");
}
@@ -892,13 +738,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
loginHintLookupStrategy = FunctionSupport.constant(fixedLoginHint);
}
- /**
- * Get the login_hint to use.
- *
- * @param profileRequestContext profile request context
- *
- * @return the login_hint to use
- */
+ @Override
@Nullable public String getLoginHint(@Nullable final ProfileRequestContext profileRequestContext) {
return loginHintLookupStrategy.apply(profileRequestContext);
}
@@ -923,25 +763,17 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @since 2.2.0
*/
- public void setUserInfoHttpRequestMethod(@Nonnull @NotEmpty final OIDCHttpRequestMethod method){
+ public void setUserInfoHttpRequestMethod(@Nonnull @NotEmpty final HttpRequestMethod method){
userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
}
- /**
- * Get the HTTP request method for an UserInfo request.
- *
- * @param profileRequestContext profile request context
- *
- * @return the HTTP request method
- *
- * @since 2.2.0
- */
- @Nullable public OIDCHttpRequestMethod getUserInfoHttpRequestMethod(
+ @Override
+ @Nullable public HttpRequestMethod getUserInfoHttpRequestMethod(
@Nullable final ProfileRequestContext profileRequestContext) {
final String method = userInfoHttpRequestMethodLookupStrategy.apply(profileRequestContext);
if (method != null) {
try {
- return OIDCHttpRequestMethod.valueOf(method);
+ return HttpRequestMethod.valueOf(method);
} catch (final IllegalArgumentException e) {
throw new ConstraintViolationException("Unexpected HTTP method value: '" + method + "': "
+ e.getMessage());
@@ -949,5 +781,63 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
}
return null;
}
+
+
+ /**
+ * Set the lookup strategy to determine the response_mode for authorization requests.
+ *
+ * @param strategy the strategy to use
+ *
+ * @since 2.2.0
+ */
+ public void setResponseModeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
+ responseModeLookupStrategy = Constraint.isNotNull(strategy, "ResponseMode lookup strategy can not be null");
+ }
+
+ /**
+ * Set the response_mode to use for authorization requests.
+ *
+ * @param responseMode the response_mode to use
+ *
+ * @since 2.2.0
+ */
+ public void setResponseMode(@Nonnull final String responseMode) {
+ responseModeLookupStrategy = FunctionSupport.constant(responseMode);
+ }
+
+ @Override
+ public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext) {
+ return responseModeLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's
+ * signature should be validated (false).
+ *
+ * @param flag flag to set
+ *
+ * @since 2.2.0
+ */
+ public void setTlsServerValidationSufficient(final boolean flag) {
+ tlsServerValidationOnlyPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set the predicate to determine whether TLS server validation alone is sufficient to verify the id_token (true),
+ * or whether the id_token's signature should be validated (false).
+ *
+ * @param condition condition to set
+ *
+ * @since 2.2.0
+ */
+ public void setTlsServerValidationSufficient(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ tlsServerValidationOnlyPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ @Override
+ public boolean isTlsServerValidationSufficient(final ProfileRequestContext profileRequestContext) {
+ return tlsServerValidationOnlyPredicate.test(profileRequestContext);
+ }
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
similarity index 81%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
copy to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
index ca81434..7fab902 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.config;
+package net.shibboleth.oidc.profile.config.impl;
import java.time.Duration;
import java.util.Map;
@@ -26,25 +26,19 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCDynamicRegistrationConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2FlowAwareProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * Profile configuration for the OpenID Connect dynamic client registration.
+ * Implemenation of a profile configuration for the OpenID Connect dynamic client registration.
*/
-public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
- implements OverriddenIssuerProfileConfiguration {
-
- /** OIDC base protocol URI. */
- public static final String PROTOCOL_URI = "https://openid.net/specs/openid-connect-registration-1_0.html";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/registration";
+public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
+ implements OIDCDynamicRegistrationConfiguration {
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
@@ -61,7 +55,7 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
/**
* Constructor.
*/
- public OIDCDynamicRegistrationConfiguration() {
+ public DefaultOIDCDynamicRegistrationConfiguration() {
this(PROFILE_ID);
}
@@ -70,12 +64,13 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
*
* @param profileId Unique profile identifier.
*/
- public OIDCDynamicRegistrationConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public DefaultOIDCDynamicRegistrationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
issuerLookupStrategy = FunctionSupport.constant(null);
setRegistrationValidityPeriod(Duration.ofHours(24));
setSecretExpirationPeriod(Duration.ofDays(365));
metadataPolicyLookupStrategy = FunctionSupport.constant(null);
+ registrationValidityPeriodLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -102,15 +97,7 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
}
- /**
- * Get dynamic registration validity period.
- *
- * <p>A 0 is interpreted as an unlimited period.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return dynamic registration validity period
- */
+ @Override
@Nullable @NonNegative
public Duration getRegistrationValidityPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -145,15 +132,7 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
registrationValidityPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get client secret expiration period.
- *
- * <p>A 0 is interpreted as an unlimited period.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return client secret expiration period
- */
+ @Override
@Nullable @NonNegative
public Duration getSecretExpirationPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration period = secretExpirationPeriodLookupStrategy.apply(profileRequestContext);
@@ -187,13 +166,7 @@ public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwar
secretExpirationPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the metadata policy.
- *
- * @param profileRequestContext profile request context
- *
- * @return metadata policy
- */
+ @Override
@Nullable
public Map<String,MetadataPolicy> getMetadataPolicy(@Nullable final ProfileRequestContext profileRequestContext) {
return metadataPolicyLookupStrategy.apply(profileRequestContext);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCProviderInformationConfiguration.java
similarity index 75%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
copy to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCProviderInformationConfiguration.java
index 00eb158..d379eed 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCProviderInformationConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.config;
+package net.shibboleth.oidc.profile.config.impl;
import java.util.function.Function;
@@ -25,22 +25,16 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * Profile configuration for the OpenID Connect Provider Configuration.
+ * Implementation of a profile configuration for the OpenID Connect Provider Configuration.
*/
-public class OIDCProviderInformationConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration {
-
- /** OIDC base protocol URI. Section 4 is relevant. */
- public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-discovery-1_0.html";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/configuration";
+public class DefaultOIDCProviderInformationConfiguration extends AbstractConditionalProfileConfiguration
+ implements OIDCProviderInformationConfiguration {
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
@@ -48,7 +42,7 @@ public class OIDCProviderInformationConfiguration extends AbstractConditionalPro
/**
* Constructor.
*/
- public OIDCProviderInformationConfiguration() {
+ public DefaultOIDCProviderInformationConfiguration() {
this(PROFILE_ID);
}
@@ -57,12 +51,13 @@ public class OIDCProviderInformationConfiguration extends AbstractConditionalPro
*
* @param profileId Unique profile identifier.
*/
- public OIDCProviderInformationConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public DefaultOIDCProviderInformationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
issuerLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
+ @Override
@Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
return issuerLookupStrategy.apply(profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCPublishKeySetConfiguration.java
similarity index 74%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
copy to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCPublishKeySetConfiguration.java
index e7d0ba2..3d5b7ff 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCPublishKeySetConfiguration.java
@@ -15,18 +15,19 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.config;
+package net.shibboleth.oidc.profile.config.impl;
import javax.annotation.Nonnull;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCPublishKeySetConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
- * Profile configuration for publishing OP key set.
+ * Implementation of a profile configuration for publishing OP key set.
*/
-public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration{
+public class DefaultOIDCPublishKeySetConfiguration extends AbstractConditionalProfileConfiguration
+ implements OIDCPublishKeySetConfiguration {
/** OIDC base protocol URI. Section 3 jwks_uri is the relevant. */
public static final String PROTOCOL_URI =
@@ -38,7 +39,7 @@ public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileCo
/**
* Constructor.
*/
- public OIDCPublishKeySetConfiguration() {
+ public DefaultOIDCPublishKeySetConfiguration() {
this(PROFILE_ID);
}
@@ -47,7 +48,7 @@ public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileCo
*
* @param profileId Unique profile identifier.
*/
- public OIDCPublishKeySetConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public DefaultOIDCPublishKeySetConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCUserInfoConfiguration.java
similarity index 79%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
copy to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCUserInfoConfiguration.java
index 284ab67..726da3b 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCUserInfoConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.config;
+package net.shibboleth.oidc.profile.config.impl;
import java.util.Collection;
import java.util.Collections;
@@ -30,8 +30,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
-import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2TokenValidatingConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2TokenValidatingConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
@@ -40,16 +40,11 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Profile configuration for the OpenID Connect core protocol userinfo endpoint.
+ * Implementation of a profile configuration for the OpenID Connect core protocol userinfo endpoint.
*/
-public class OIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConfiguration
- implements AttributeResolvingProfileConfiguration {
-
- /** OIDC base protocol URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/userinfo";
+//TODO deniedUserInfoAttributesLookupStrategy is also common to OIDCUserInfoProfileConfiguration
+public class DefaultOIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConfiguration
+ implements OIDCUserInfoConfiguration {
/** Whether attributes should be resolved in the course of the profile. */
@Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
@@ -63,8 +58,8 @@ public class OIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConf
/**
* Constructor.
*/
- public OIDCUserInfoConfiguration() {
- this(PROFILE_ID);
+ public DefaultOIDCUserInfoConfiguration() {
+ this(OIDCUserInfoConfiguration.PROFILE_ID);
}
/**
@@ -72,7 +67,7 @@ public class OIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConf
*
* @param profileId Unique profile identifier.
*/
- public OIDCUserInfoConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public DefaultOIDCUserInfoConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
resolveAttributesPredicate = Predicates.alwaysTrue();
@@ -104,13 +99,7 @@ public class OIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConf
resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
}
- /**
- * Get whether encryption is optional in the face of a missing key, etc.
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff encryption is optional
- */
+ @Override
public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptionOptionalPredicate.test(profileRequestContext);
}
@@ -133,16 +122,7 @@ public class OIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConf
encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
}
- /**
- * Get the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to omit from UserInfo token
- */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java
index b8595cd..1f49834 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java
@@ -34,8 +34,8 @@ import org.opensaml.messaging.encoder.MessageEncodingException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration.HttpRequestMethod;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.codec.HTMLEncoder;
import net.shibboleth.utilities.java.support.collection.Pair;
@@ -90,8 +90,8 @@ public class HTTPPostAuthnRequestEncoder extends AbstractOIDCMessageEncoder {
@Override
- public boolean test(@Nonnull final OIDCHttpRequestMethod requestMethod) {
- return requestMethod == OIDCHttpRequestMethod.POST;
+ public boolean test(@Nonnull final HttpRequestMethod requestMethod) {
+ return requestMethod == HttpRequestMethod.POST;
}
/**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java
index 6ce81ee..0406c82 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java
@@ -29,8 +29,8 @@ import org.opensaml.messaging.encoder.MessageEncodingException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration.HttpRequestMethod;
import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.net.URLBuilder;
@@ -45,8 +45,8 @@ public class HTTPRedirectAuthnRequestEncoder extends AbstractOIDCMessageEncoder
@Nonnull private final Logger log = LoggerFactory.getLogger(HTTPRedirectAuthnRequestEncoder.class);
@Override
- public boolean test(@Nonnull final OIDCHttpRequestMethod requestMethod) {
- return requestMethod == OIDCHttpRequestMethod.GET;
+ public boolean test(@Nonnull final HttpRequestMethod requestMethod) {
+ return requestMethod == HttpRequestMethod.GET;
}
@Override
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java
index c72a710..7826423 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java
@@ -33,8 +33,8 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
import net.shibboleth.oidc.profile.encoding.OIDCMessageEncoder;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration.HttpRequestMethod;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
@@ -86,7 +86,7 @@ public class AuthenticationRequestMessageEncoderFactory extends AbstractInitiali
return null;
}
- final OIDCHttpRequestMethod requestMethodFromConfig =
+ final HttpRequestMethod requestMethodFromConfig =
profileConfiguration.getHttpRequestMethod(profileRequestContext);
if (requestMethodFromConfig == null) {
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
index 6c08ddf..4afdf87 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
@@ -34,7 +34,7 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.DecryptionConfiguration;
import net.shibboleth.oidc.security.jose.DecryptionParameters;
@@ -234,12 +234,12 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
log.debug("{} No OIDC client information available", getLogPrefix());
}
- // Build a client secret credential criteria. Extract the decryption credential from the RP config.
+ // Build a client secret credential criteria. Extract the decryption credential from the RP config if any.
final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- final OIDCAuthorizationConfiguration profileConfiguration =
- (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
+ rpCtx.getProfileConfig() instanceof OAuth2ClientAuthenticableClientProfileConfiguration) {
+ final OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration =
+ (OAuth2ClientAuthenticableClientProfileConfiguration) rpCtx.getProfileConfig();
if (profileConfiguration != null) {
final ClientSecretCredential credential =
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java
index 7659769..b396654 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java
@@ -41,8 +41,8 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.config.logic.EncryptionOptionalPredicate;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.EncryptionConfiguration;
import net.shibboleth.oidc.security.jose.EncryptionParameters;
@@ -346,9 +346,9 @@ public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
final RelyingPartyContext rpCtx =
relyingPartyContextLookupStrategy.apply(profileRequestContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
- rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- final OIDCAuthorizationConfiguration profileConfiguration =
- (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
+ rpCtx.getProfileConfig() instanceof OAuth2ClientAuthenticableClientProfileConfiguration) {
+ final OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration =
+ (OAuth2ClientAuthenticableClientProfileConfiguration) rpCtx.getProfileConfig();
if (profileConfiguration != null) {
final ClientSecretCredential credential =
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java
index 2f7c575..a2fec6f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java
@@ -39,15 +39,16 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
+import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
-import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -317,8 +318,8 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
relyingPartyContextLookupStrategy.apply(messageContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- final OIDCAuthorizationConfiguration profileConfiguration =
- (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
+ final OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration =
+ (OAuth2ClientAuthenticableClientProfileConfiguration) rpCtx.getProfileConfig();
if (profileConfiguration != null) {
final ClientSecretCredential credential = profileConfiguration.getClientCredential(
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
similarity index 92%
rename from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
rename to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index d6d0f9f..1d245af 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
+package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.security.Principal;
import java.util.Collection;
@@ -33,10 +33,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
@@ -51,8 +52,8 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Base class for OAuth profile configurations that support OAuth-defined client authentication methods.
*/
public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
- extends AbstractConditionalProfileConfiguration implements OAuth2ProfileConfiguration,
- AuthenticationProfileConfiguration {
+ extends AbstractConditionalProfileConfiguration implements OAuth2ClientAuthenticableProfileConfiguration,
+ OAuth2ClientAuthenticableClientProfileConfiguration {
/** Enabled token endpoint authentication methods. */
@Nonnull private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy;
@@ -114,13 +115,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
}
- /**
- * Get the enabled token endpoint authentication methods.
- *
- * @param profileRequestContext profile request context
- *
- * @return enabled token endpoint authentication methods
- */
+ @Override
@Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getTokenEndpointAuthMethods(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -157,15 +152,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
tokenEndpointAuthMethodsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the token endpoint authentication method to use with an upstream OpenID Provider.
- *
- * @param profileRequestContext profile request context
- *
- * @return the token endpoint authentication method to use.
- *
- * @since 2.2.0
- */
+ @Override
@Nonnull public String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext) {
return tokenEndpointAuthMethodLookupStrategy.apply(profileRequestContext);
}
@@ -204,6 +191,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
*
* @since 3.1.0
*/
+ @Override
@Nullable public ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext) {
return claimsValidatorLookupStrategy.apply(profileRequestContext);
}
@@ -421,16 +409,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
clientCredentialLookupStrategy = FunctionSupport.constant(clientCredential);
}
- /**
- * Get the client credential for the given context. Typically a client_secret
- * associated with the current client_id.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client credential
- *
- * @since 2.2.0
- */
+ @Override
public ClientSecretCredential getClientCredential(
@Nullable final ProfileRequestContext profileRequestContext) {
return clientCredentialLookupStrategy.apply(profileRequestContext);
@@ -458,17 +437,8 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
clientIdLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(clientId));
}
- /**
- * Get the client_id appropriate for the given context. Typically that associated
- * with the chosen downstream OpenID Connect Provider.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client_id
- *
- * @since 2.2.0
- */
- public String getClientId(@Nullable final ProfileRequestContext profileRequestContext) {
+ @Override
+ @Nullable public String getClientId(@Nullable final ProfileRequestContext profileRequestContext) {
return clientIdLookupStrategy.apply(profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2FlowAwareProfileConfiguration.java
similarity index 86%
rename from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java
rename to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2FlowAwareProfileConfiguration.java
index 2fadc96..5fd3a00 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2FlowAwareProfileConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
+package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.util.function.Predicate;
@@ -26,14 +26,17 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
+import net.shibboleth.oidc.profile.config.OIDCFlowAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* Base class for OIDC protocol configuration, containing configuration bits shared by all flow aware OIDC protocol
* configurations.
*/
-public abstract class AbstractOAuth2FlowAwareProfileConfiguration
- extends AbstractOAuth2ClientAuthenticableProfileConfiguration {
+public abstract class AbstractOAuth2FlowAwareProfileConfiguration
+ extends AbstractOAuth2ClientAuthenticableProfileConfiguration implements OIDCFlowAwareProfileConfiguration,
+ OAuth2FlowAwareProfileConfiguration {
/** Predicate used to indicate whether authorization code flow is supported by this profile. Default true. */
@Nonnull private Predicate<ProfileRequestContext> authorizationCodeFlowPredicate;
@@ -60,13 +63,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
refreshTokensPredicate = Predicates.alwaysTrue();
}
- /**
- * Get whether authorization code flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether authorization code flow is supported by this profile
- */
+ @Override
public boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return authorizationCodeFlowPredicate.test(profileRequestContext);
}
@@ -90,13 +87,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
"Condition used to indicate whether authorization code flow is supported cannot be null");
}
- /**
- * Get whether implicit flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether implicit flow is supported by this profile
- */
+ @Override
public boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return hybridFlowPredicate.test(profileRequestContext);
}
@@ -120,13 +111,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
"Condition used to indicate whether implicit flow is supported cannot be null");
}
- /**
- * Get whether hybrid flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether hybrid flow is supported by this profile
- */
+ @Override
public boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return implicitFlowPredicate.test(profileRequestContext);
}
@@ -150,13 +135,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
"Condition used to indicate whether hybrid flow is supported cannot be null");
}
- /**
- * Get whether refresh tokens are supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether refresh tokens are supported by this profile
- */
+ @Override
public boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return refreshTokensPredicate.test(profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2TokenValidatingConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
similarity index 95%
rename from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2TokenValidatingConfiguration.java
rename to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
index e22c004..4a826fb 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2TokenValidatingConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
+package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.util.function.Function;
@@ -24,8 +24,8 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenValidatingProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
@@ -36,7 +36,7 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
* @since 2.0.0
*/
public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2ClientAuthenticableProfileConfiguration
- implements OverriddenIssuerProfileConfiguration {
+ implements OAuth2TokenValidatingProfileConfiguration {
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
@@ -87,6 +87,7 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
*
* @return the validator to use
*/
+ @Override
@Nullable public ClaimsValidator getIssuedClaimsValidator(
@Nullable final ProfileRequestContext profileRequestContext) {
return issuedClaimsValidatorLookupStrategy.apply(profileRequestContext);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
similarity index 76%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
copy to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
index 6d0a9bf..8062e17 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
@@ -15,9 +15,11 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
+package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.time.Duration;
+import java.util.Map;
+import java.util.function.BiFunction;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -29,8 +31,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
-import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -38,21 +39,11 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Interface for OAuth 2 token "audience" profile configuration.
- *
- * <p>This applies to behavior controlling the characteristics of tokens issued
- * to the parties intended to process them, as distinct from the clients that use them.</p>
+ * Implementation of an OAuth 2.0 token "audience" profile configuration.
*/
-public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfileConfiguration
- implements OAuth2ProfileConfiguration, OverriddenIssuerProfileConfiguration,
- AttributeResolvingProfileConfiguration {
+public class DefaultOAuth2TokenAudienceConfiguration extends AbstractConditionalProfileConfiguration
+ implements OAuth2TokenAudienceConfiguration {
- /** OAuth2 Token Revocation URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc6749";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token/audience";
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
@@ -68,18 +59,23 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
/** Lookup function to supply access token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
-
+
+ /** Lookup function to supply strategy bi-function for manipulating access token claims set. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ accessTokenClaimsSetManipulationStrategyLookupStrategy;
+
/** Constructor. */
- public OAuth2TokenAudienceConfiguration() {
+ public DefaultOAuth2TokenAudienceConfiguration() {
this(PROFILE_ID);
- }
+ }
/**
* Creates a new configuration instance.
*
* @param profileId Unique profile identifier.
*/
- public OAuth2TokenAudienceConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public DefaultOAuth2TokenAudienceConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
issuerLookupStrategy = FunctionSupport.constant(null);
@@ -89,6 +85,7 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
+ accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -146,6 +143,7 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
*
* @return true iff encryption is optional
*/
+ @Override
public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptionOptionalPredicate.test(profileRequestContext);
}
@@ -175,6 +173,7 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
*
* @return access token type, or null for unspecified/opaque
*/
+ @Override
@Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
return accessTokenTypeLookupStrategy.apply(profileRequestContext);
}
@@ -206,6 +205,7 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
*
* @return access token lifetime
*/
+ @Override
@Positive @Nonnull
public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
@@ -236,5 +236,41 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
@Nullable final Function<ProfileRequestContext,Duration> strategy) {
accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
+ // TODO: This was added in 2.2.0 to be compatible with the access token interface
+ @Override
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return accessTokenClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-function for manipulating access token claims set.
+ *
+ * @param strategy bi-function for manipulating access token claims set
+ *
+ * @since 2.2.0
+ */
+ public void setAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
+ accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-function for manipulating access token claims set.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 2.2.0
+ */
+ public void setAccessTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ strategy) {
+ accessTokenClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
similarity index 83%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
copy to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
index 2f75eb7..294c98e 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
+package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.util.Collection;
import java.util.Collections;
@@ -33,7 +33,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
import com.nimbusds.oauth2.sdk.GrantType;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.config.impl.AbstractOIDCSSOConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
@@ -43,12 +44,9 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * OIDC-aware OAuth 2 token endpoint profile configuration.
+ * Implementation of an OIDC-aware OAuth 2 token endpoint profile configuration.
*/
-public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token";
+public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration implements OAuth2TokenConfiguration {
/** Enabled grant types. */
@Nonnull private Function<ProfileRequestContext,Set<String>> grantTypesLookupStrategy;
@@ -64,8 +62,8 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
/**
* Constructor.
*/
- public OAuth2TokenConfiguration() {
- this(PROFILE_ID);
+ public DefaultOAuth2TokenConfiguration() {
+ this(OAuth2TokenConfiguration.PROFILE_ID);
grantTypesLookupStrategy = FunctionSupport.constant(
Set.of(GrantType.AUTHORIZATION_CODE.toString(), GrantType.REFRESH_TOKEN.toString()));
@@ -78,17 +76,11 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
*
* @param profileId unique profile identifier
*/
- public OAuth2TokenConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public DefaultOAuth2TokenConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
}
- /**
- * Get the enabled grant types.
- *
- * @param profileRequestContext profile request context
- *
- * @return enabled grant types
- */
+ @Override
@Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getGrantTypes(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -125,15 +117,7 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
grantTypesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the bi-function for manipulating refresh token claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating refresh token claims set
- *
- * @since 2.1.0
- */
+ @Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
getRefreshTokenClaimsSetManipulationStrategy(
@@ -167,15 +151,7 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration {
"Lookup strategy cannot be null");
}
- /**
- * Get whether always revoke the refresh_token after it's used.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether always revoke the refresh_token after it's used
- *
- * @since 2.1.0
- */
+ @Override
@Nonnull
public boolean isEnforceRefreshTokenRotation(
@Nullable final ProfileRequestContext profileRequestContext) {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenIntrospectionConfiguration.java
similarity index 63%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
copy to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenIntrospectionConfiguration.java
index 8824315..c722c88 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenIntrospectionConfiguration.java
@@ -15,28 +15,24 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
+package net.shibboleth.oidc.profile.oauth2.config.impl;
import javax.annotation.Nonnull;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenIntrospectionConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
- * Profile configuration for the OAuth2 Token Introspection.
+ * Implementation of a profile configuration for the OAuth2 Token Introspection.
*/
-public class OAuth2TokenIntrospectionConfiguration extends AbstractOAuth2TokenValidatingConfiguration {
-
- /** OAuth2 Token Revocation URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
+public class DefaultOAuth2TokenIntrospectionConfiguration extends AbstractOAuth2TokenValidatingConfiguration implements
+ OAuth2TokenIntrospectionConfiguration {
/**
* Constructor.
*/
- public OAuth2TokenIntrospectionConfiguration() {
+ public DefaultOAuth2TokenIntrospectionConfiguration() {
this(PROFILE_ID);
}
@@ -45,7 +41,7 @@ public class OAuth2TokenIntrospectionConfiguration extends AbstractOAuth2TokenVa
*
* @param profileId Unique profile identifier.
*/
- public OAuth2TokenIntrospectionConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public DefaultOAuth2TokenIntrospectionConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenRevocationConfiguration.java
similarity index 76%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
copy to oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenRevocationConfiguration.java
index a6c51b0..a7c7a16 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenRevocationConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
+package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.time.Duration;
import java.util.function.Function;
@@ -25,6 +25,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenRevocationConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -32,27 +33,10 @@ import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * Profile configuration for the OAuth2 Token Revocation.
+ * Implementation of a profile configuration for OAuth2 Token Revocation.
*/
-public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValidatingConfiguration {
-
- /** OAuth2 Token Revocation URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7009";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/revocation";
-
- /** Enumeration of the OAuth2 token revocation methods. */
- public enum OAuth2TokenRevocationMethod {
- /**
- * Revoke full chain of tokens (from authorization code (or initial access token) onwards).
- */
- CHAIN,
- /**
- * Revoke single access or refresh token.
- */
- TOKEN
- }
+public class DefaultOAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValidatingConfiguration implements
+ OAuth2TokenRevocationConfiguration {
/**
* Which revocation method should be used when revoking a token.
@@ -66,7 +50,7 @@ public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValid
/**
* Constructor.
*/
- public OAuth2TokenRevocationConfiguration() {
+ public DefaultOAuth2TokenRevocationConfiguration() {
this(PROFILE_ID);
revocationMethodLookupStrategy = FunctionSupport.constant(OAuth2TokenRevocationMethod.CHAIN.toString());
revocationLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(6));
@@ -77,7 +61,7 @@ public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValid
*
* @param profileId Unique profile identifier.
*/
- public OAuth2TokenRevocationConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public DefaultOAuth2TokenRevocationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
}
@@ -104,14 +88,7 @@ public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValid
revocationMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
}
- /**
- * Get the revocation method used when revoking a token.
- *
- * @param profileRequestContext profile request context.
- * @return The revocation method used when revoking a token.
- *
- * @since 2.1.0
- */
+ @Override
public OAuth2TokenRevocationMethod getRevocationMethod(
@Nullable final ProfileRequestContext profileRequestContext) {
final String method = revocationMethodLookupStrategy.apply(profileRequestContext);
@@ -138,17 +115,7 @@ public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValid
revocationLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get revocation lifetime.
- *
- * <p>Defaults to 6 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return revocation lifetime
- *
- * @since 2.1.0
- */
+ @Override
@Positive @Nonnull
public Duration getRevocationLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = revocationLifetimeLookupStrategy.apply(profileRequestContext);
diff --git a/oidc-common-profile-api/src/test/java/net/shibboleth/oidc/profile/config/OIDCCoreProtocolConfigurationTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java
similarity index 92%
rename from oidc-common-profile-api/src/test/java/net/shibboleth/oidc/profile/config/OIDCCoreProtocolConfigurationTest.java
rename to oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java
index 4ff72fd..457c969 100644
--- a/oidc-common-profile-api/src/test/java/net/shibboleth/oidc/profile/config/OIDCCoreProtocolConfigurationTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.config;
+package net.shibboleth.oidc.profile.config.impl;
import java.time.Duration;
import java.util.Collections;
@@ -26,25 +26,26 @@ import org.testng.annotations.Test;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
+import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
- * Unit tests for {@link OIDCAuthorizationConfiguration}.
+ * Unit tests for {@link DefaultOIDCAuthorizationConfiguration}.
*/
public class OIDCCoreProtocolConfigurationTest {
- private OIDCAuthorizationConfiguration config;
+ private DefaultOIDCAuthorizationConfiguration config;
@BeforeMethod
protected void setUp() throws Exception {
- config = new OIDCAuthorizationConfiguration();
+ config = new DefaultOIDCAuthorizationConfiguration();
config.setSecurityConfiguration(new SecurityConfiguration());
config.initialize();
}
@Test
public void testInitialState() throws ComponentInitializationException {
- Assert.assertEquals(config.getId(), OIDCAuthorizationConfiguration.PROFILE_ID);
+ Assert.assertEquals(config.getId(), OIDCSSOProfileConfiguration.PROFILE_ID);
Assert.assertTrue(config.getAuthenticationFlows(null).isEmpty());
Assert.assertTrue(config.getPostAuthenticationFlows(null).isEmpty());
Assert.assertTrue(config.getDefaultAuthenticationMethods(null).isEmpty());
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java
index 1f4937c..8e6e62f 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java
@@ -29,10 +29,10 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.annotations.Test;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
+import net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.encoding.OIDCMessageEncoder;
import net.shibboleth.oidc.profile.encoding.impl.AbstractOIDCMessageEncoder;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration.HttpRequestMethod;
/** Test of the AuthenticationRequestMessageEncoderFactory class.*/
public class AuthenticationRequestMessageEncoderFactoryTest {
@@ -55,8 +55,8 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final OIDCMessageEncoder mockPostEncoder = new AbstractOIDCMessageEncoder() {
@Override
- public boolean test(final OIDCHttpRequestMethod method) {
- if (method == OIDCHttpRequestMethod.POST) {
+ public boolean test(final HttpRequestMethod method) {
+ if (method == HttpRequestMethod.POST) {
return true;
}
return false;
@@ -71,8 +71,8 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final ProfileRequestContext prc = new ProfileRequestContext();
// mock a profile config to request form POST serialization
- final OIDCAuthorizationConfiguration config = new OIDCAuthorizationConfiguration();
- config.setHttpRequestMethodLookupStrategy(rc -> OIDCHttpRequestMethod.POST.toString());
+ final DefaultOIDCAuthorizationConfiguration config = new DefaultOIDCAuthorizationConfiguration();
+ config.setHttpRequestMethodLookupStrategy(rc -> HttpRequestMethod.POST.toString());
final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class, true);
rpCtx.setProfileConfig(config);
@@ -86,8 +86,8 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final OIDCMessageEncoder mockGetEncoder = new AbstractOIDCMessageEncoder() {
@Override
- public boolean test(final OIDCHttpRequestMethod method) {
- if (method == OIDCHttpRequestMethod.GET) {
+ public boolean test(final HttpRequestMethod method) {
+ if (method == HttpRequestMethod.GET) {
return true;
}
return false;
@@ -102,8 +102,8 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final ProfileRequestContext prc = new ProfileRequestContext();
// mock a profile config to request form POST serialization
- final OIDCAuthorizationConfiguration config = new OIDCAuthorizationConfiguration();
- config.setHttpRequestMethodLookupStrategy(rc -> OIDCHttpRequestMethod.GET.toString());
+ final DefaultOIDCAuthorizationConfiguration config = new DefaultOIDCAuthorizationConfiguration();
+ config.setHttpRequestMethodLookupStrategy(rc -> HttpRequestMethod.GET.toString());
final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class, true);
rpCtx.setProfileConfig(config);
@@ -118,8 +118,8 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final OIDCMessageEncoder mockGetEncoder = new AbstractOIDCMessageEncoder() {
@Override
- public boolean test(final OIDCHttpRequestMethod method) {
- if (method == OIDCHttpRequestMethod.GET) {
+ public boolean test(final HttpRequestMethod method) {
+ if (method == HttpRequestMethod.GET) {
return true;
}
return false;
@@ -134,8 +134,8 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final ProfileRequestContext prc = new ProfileRequestContext();
// mock a profile config to request form POST serialization
- final OIDCAuthorizationConfiguration config = new OIDCAuthorizationConfiguration();
- config.setHttpRequestMethodLookupStrategy(rc -> OIDCHttpRequestMethod.POST.toString());
+ final DefaultOIDCAuthorizationConfiguration config = new DefaultOIDCAuthorizationConfiguration();
+ config.setHttpRequestMethodLookupStrategy(rc -> HttpRequestMethod.POST.toString());
final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class, true);
rpCtx.setProfileConfig(config);
@@ -151,7 +151,7 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final ProfileRequestContext prc = new ProfileRequestContext();
// mock a profile config to request form POST serialization
- final OIDCAuthorizationConfiguration config = new OIDCAuthorizationConfiguration();
+ final DefaultOIDCAuthorizationConfiguration config = new DefaultOIDCAuthorizationConfiguration();
config.setHttpRequestMethodLookupStrategy(rc -> null);
final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class, true);
rpCtx.setProfileConfig(config);
diff --git a/oidc-common-profile-api/src/test/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfigurationTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfigurationTest.java
similarity index 72%
rename from oidc-common-profile-api/src/test/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfigurationTest.java
rename to oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfigurationTest.java
index 9b5fed0..b264627 100644
--- a/oidc-common-profile-api/src/test/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfigurationTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfigurationTest.java
@@ -15,29 +15,28 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
+package net.shibboleth.oidc.profile.oauth2.config.impl;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-
import org.testng.Assert;
/**
- * Tests for {@link OAuth2TokenRevocationConfiguration}, tests only constructors.
+ * Tests for {@link DefaultOAuth2TokenRevocationConfiguration}, tests only constructors.
*/
public class OAuth2TokenRevocationConfigurationTest {
- private OAuth2TokenRevocationConfiguration conf;
+ private DefaultOAuth2TokenRevocationConfiguration conf;
@BeforeMethod
protected void setUp() throws Exception {
- conf = new OAuth2TokenRevocationConfiguration();
+ conf = new DefaultOAuth2TokenRevocationConfiguration();
}
@Test
public void test() {
- Assert.assertEquals(OAuth2TokenRevocationConfiguration.PROFILE_ID, conf.getId());
- conf = new OAuth2TokenRevocationConfiguration("somethingelse");
+ Assert.assertEquals(DefaultOAuth2TokenRevocationConfiguration.PROFILE_ID, conf.getId());
+ conf = new DefaultOAuth2TokenRevocationConfiguration("somethingelse");
Assert.assertEquals("somethingelse", conf.getId());
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list