[java-idp-plugin-oidc-rp] branch main updated: Add custom attribute extraction strategy to validation stage
Phil Smart
philip.smart at jisc.ac.uk
Mon Apr 24 11:15:56 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=2314caef90271b2d7ae5558fc5b9e312eac4f0b9
The following commit(s) were added to refs/heads/main by this push:
new 2314cae Add custom attribute extraction strategy to validation stage
2314cae is described below
commit 2314caef90271b2d7ae5558fc5b9e312eac4f0b9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Apr 24 12:15:47 2023 +0100
Add custom attribute extraction strategy to validation stage
---
.../oidc/rp/context/OIDCPeerEntityContext.java | 3 --
.../oidc/rp/impl/ValidateOIDCAuthentication.java | 49 ++++++++++++++++++----
.../oidc-relying-party-authn-beans.xml | 3 +-
3 files changed, 42 insertions(+), 13 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/OIDCPeerEntityContext.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/OIDCPeerEntityContext.java
index 97bb68b..6bceed8 100644
--- a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/OIDCPeerEntityContext.java
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/context/OIDCPeerEntityContext.java
@@ -24,9 +24,6 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.context;
* This context will often contain subcontexts, whose data is construed to be scoped to that peer entity.
* </p>
*/
-//TODO this is just a marker interface?
public final class OIDCPeerEntityContext extends AbstractOIDCEntityContext {
-
-
}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
index 4d0dc6f..92f0052 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
@@ -19,6 +19,7 @@ package net.shibboleth.idp.plugin.authn.oidc.rp.impl;
import java.security.Principal;
import java.text.ParseException;
+import java.util.ArrayList;
import java.util.Collection;
import java.util.Date;
import java.util.List;
@@ -137,6 +138,9 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
/** Incoming context translation function for converting OIDC ACRs into Principals. */
@Nullable private Function<Collection<String>, Collection<Principal>> amrTranslator;
+ /** Pluggable strategy function for generalized extraction of data. */
+ @Nullable private Function<ProfileRequestContext,Collection<IdPAttribute>> attributeExtractionStrategy;
+
/** Constructor.*/
public ValidateOIDCAuthentication() {
setMetricName(DEFAULT_METRIC_NAME);
@@ -194,6 +198,20 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
}
+ /**
+ * Sets the strategy function to invoke for generalized extraction of data into
+ * {@link IdPAttribute} objects for inclusion in the
+ * {@link net.shibboleth.idp.authn.AuthenticationResult}.
+ *
+ * @param strategy extraction strategy
+ */
+ public void setAttributeExtractionStrategy(
+ @Nullable final Function<ProfileRequestContext,Collection<IdPAttribute>> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ attributeExtractionStrategy = strategy;
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -288,7 +306,25 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
if (transcoderRegistry != null) {
processAttributes(profileRequestContext);
}
- //TODO use an attributeExtractionStrategy if registry not supplied, or in addition?
+
+ if (attributeExtractionStrategy != null) {
+ log.debug("{} Applying custom extraction strategy function", getLogPrefix());
+ if (attributeContext == null) {
+ attributeContext = profileRequestContext
+ .getSubcontext(RelyingPartyContext.class)
+ .getSubcontext(AttributeContext.class, true);
+ }
+ final Collection<IdPAttribute> attributes = new ArrayList<>(attributeContext.getIdPAttributes().values());
+ final Collection<IdPAttribute> newAttributes = attributeExtractionStrategy.apply(profileRequestContext);
+ if (newAttributes != null) {
+ if (log.isDebugEnabled()) {
+ log.debug("{} Extracted attributes with custom strategy: {}", getLogPrefix(),
+ newAttributes.stream().map(IdPAttribute::getId).collect(Collectors.toUnmodifiableList()));
+ }
+ attributes.addAll(newAttributes);
+ attributeContext.setIdPAttributes(attributes);
+ }
+ }
log.info("{} OIDC authentication succeeded for '{}'", getLogPrefix(),
endUserContext.getUnprocessedIdTokenClaims().getSubject());
@@ -382,12 +418,10 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
*/
@Nonnull private ProxyAuthenticationPrincipal buildProxyPrincipal() {
- // TODO: Is this useful in the OIDC context?
+ // TODO: Is this useful in the OIDC context. There is no proxy audience I know of in the OIDC or OAuth spec
+ // like there is in saml?
final ProxyAuthenticationPrincipal proxied = new ProxyAuthenticationPrincipal();
- proxied.getAuthorities().add(endUserContext.getUnprocessedIdTokenClaims().getIssuer());
-
- // TODO: There is no proxy audience I know of in the OIDC or OAuth spec like there is in saml?
-
+ proxied.getAuthorities().add(endUserContext.getUnprocessedIdTokenClaims().getIssuer());
return proxied;
}
@@ -489,11 +523,10 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
.setPrefilteredIdPAttributes(attributeContext.getUnfilteredIdPAttributes().values())
.setMetadataResolver(metadataResolver)
.setRequesterMetadataContextLookupStrategy(null)
- // FIXME OIDC? depends if this is now for upstream?
+ // TODO OIDC? depends if this is now for upstream?
.setIssuerMetadataContextLookupStrategy(
new SAMLMetadataContextLookupFunction().compose(
new RecursiveTypedParentContextLookup<>(ProfileRequestContext.class)))
- // OIDC ^
.setProxiedRequesterContextLookupStrategy(null)
.setAttributeIssuerID(getResponderLookupStrategy().apply(profileRequestContext))
.setAttributeRecipientID(getRequesterLookupStrategy().apply(profileRequestContext));
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index eea844a..e5a0810 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -373,7 +373,6 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.InitializeOAuth2ClientAuthenticationContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
-
<bean id="ExchangeCodeForAccessToken" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ExchangeCodeForAccessToken"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
@@ -388,7 +387,6 @@
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup" />
- <!-- could these be singletons? -->
<bean id="shibboleth.authn.oidc.rp.DefaultTokenResponseDecoder" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.decoding.impl.DefaultAccessTokenResponseDecoder"
p:objectMapper="#{getObject('shibboleth.authn.oidc.rp.JSONObjectMapper') ?: getObject('shibboleth.authn.oidc.rp.DefaultJSONObjectMapper')}" />
@@ -829,6 +827,7 @@
p:addDefaultPrincipals="#{getObject('idp.authn.oidc.rp.supportedPrincipals.addDefaultPrincipals') ?: %{idp.authn.oidc.rp.addDefaultPrincipals:false}}"
p:responderLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple"
p:requesterLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple"
+ p:attributeExtractionStrategy="#{getObject('shibboleth.authn.oidc.rp.attributeExtractionStrategy')}"
p:attributeFilter-ref="shibboleth.AttributeFilterService"
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list