[java-oidc-common] branch main updated: JOIDC-149 - Configurability of ID Token issuance via Refresh Tokens

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=edddd35d4fea707be0f3d7f3da47f8ff924c8780

The following commit(s) were added to refs/heads/main by this push:
     new edddd35  JOIDC-149 - Configurability of ID Token issuance via Refresh Tokens
edddd35 is described below

commit edddd35d4fea707be0f3d7f3da47f8ff924c8780
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Apr 21 12:18:09 2023 +0300

    JOIDC-149 - Configurability of ID Token issuance via Refresh Tokens
    
    https://shibboleth.atlassian.net/browse/JOIDC-149
    
    New configuration parameter (ssueIdTokenViaRefreshToken) for the token profile configuration
---
 .../IssueIdTokenViaRefreshTokenPredicate.java      | 50 ++++++++++++++++++++++
 .../oauth2/config/OAuth2TokenConfiguration.java    | 12 ++++++
 .../impl/DefaultOAuth2TokenConfiguration.java      | 34 +++++++++++++++
 3 files changed, 96 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IssueIdTokenViaRefreshTokenPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IssueIdTokenViaRefreshTokenPredicate.java
new file mode 100644
index 0000000..2daf563
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/IssueIdTokenViaRefreshTokenPredicate.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OAuth2TokenConfiguration#isIssueIdTokenViaRefreshToken(ProfileRequestContext)}.
+ * 
+ * @since 2.2.0
+ */
+public class IssueIdTokenViaRefreshTokenPredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    @Override
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc instanceof OAuth2TokenConfiguration) {
+                return ((OAuth2TokenConfiguration) pc).isIssueIdTokenViaRefreshToken(input);
+            }
+        }
+        return false;
+    }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
index 728ad1f..9697a87 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
@@ -77,4 +77,16 @@ public interface OAuth2TokenConfiguration extends OIDCSSOProviderConfiguration {
     @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
         getRefreshTokenClaimsSetManipulationStrategy(@Nullable final ProfileRequestContext profileRequestContext);
 
+
+    /**
+     * Get whether the id_token is issued when refresh token grant is used.
+     * 
+     * @param profileRequestContext profile request context
+     * 
+     * @return whether id_token is issued when refresh token grant is used
+     * 
+     * @since 2.2.0
+     */
+   boolean isIssueIdTokenViaRefreshToken(@Nullable final ProfileRequestContext profileRequestContext);
+
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
index 294c98e..09b4bc9 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
@@ -59,6 +59,9 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
     /** Whether always revoke the refresh_token after it's used. */
     @Nonnull private Predicate<ProfileRequestContext> enforceRefreshTokenRotationPredicate;
 
+    /** Whether issue id_token when refresh_token is used. */
+    @Nonnull private Predicate<ProfileRequestContext> issueIdTokenViaRefreshTokenPredicate;
+
     /**
      * Constructor.
      */
@@ -69,6 +72,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
                 Set.of(GrantType.AUTHORIZATION_CODE.toString(), GrantType.REFRESH_TOKEN.toString()));
         refreshTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
         enforceRefreshTokenRotationPredicate = Predicates.alwaysFalse();
+        issueIdTokenViaRefreshTokenPredicate = Predicates.alwaysTrue();
     }
 
     /**
@@ -180,4 +184,34 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
          enforceRefreshTokenRotationPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
      }
 
+     /** {@inheritDoc} */
+     @Override
+     @Nonnull
+     public boolean isIssueIdTokenViaRefreshToken(
+             @Nullable final ProfileRequestContext profileRequestContext) {
+         return issueIdTokenViaRefreshTokenPredicate.test(profileRequestContext);
+     }
+
+     /**
+      * Set whether the id_token is issued when refresh token grant is used.
+      * 
+      * @param flag flag to set
+      * 
+      * @since 2.2.0
+      */
+      public void setIssueIdTokenViaRefreshToken(final boolean flag) {
+          issueIdTokenViaRefreshTokenPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+      }
+
+     /**
+      * Set condition for whether the id_token is issued when refresh token grant is used.
+      * 
+      * @param condition condition to set
+      * 
+      * @since 2.2.0
+      */
+      public void setIssueIdTokenViaRefreshTokenPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+          issueIdTokenViaRefreshTokenPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+      }
+
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.