[java-oidc-common] branch main updated: Move OIDC peer entity context to commons and pass issuerID to credential resolvers
Phil Smart
philip.smart at jisc.ac.uk
Fri Apr 28 09:06:43 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=93e0dfdbc571a51a61b043d0755f36c961386fad
The following commit(s) were added to refs/heads/main by this push:
new 93e0dfd Move OIDC peer entity context to commons and pass issuerID to credential resolvers
93e0dfd is described below
commit 93e0dfdbc571a51a61b043d0755f36c961386fad
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Apr 28 10:06:41 2023 +0100
Move OIDC peer entity context to commons and pass issuerID to credential
resolvers
---
.../impl/BaseJWTSignatureSecurityHandler.java | 28 ++++++++++-
.../impl/JWTMessageSignatureSecurityHandler.java | 14 ++++--
.../context/AbstractOIDCEntityContext.java | 57 ++++++++++++++++++++++
.../messaging/context/OIDCPeerEntityContext.java | 29 +++++++++++
4 files changed, 122 insertions(+), 6 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
index 2ce9cb3..4d41b07 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
@@ -34,11 +34,15 @@ import org.opensaml.security.trust.TrustEngine;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import com.google.common.base.Strings;
import com.nimbusds.jwt.SignedJWT;
+import com.nimbusds.oauth2.sdk.id.Issuer;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.metadata.criterion.IssuerIDCriterion;
+import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
@@ -96,6 +100,9 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
/** Applicable stashed profile configuration appropriate for OAuth clients. */
@Nullable private OAuth2ClientAuthenticableClientProfileConfiguration profileConfiguration;
+ /** The context representing the OIDC peer entity. */
+ @Nullable private OIDCPeerEntityContext peerContext;
+
/** The provider metadata found from the lookup strategy.*/
@Nullable protected OIDCProviderMetadata providerMetadata;
@@ -163,6 +170,15 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
}
+ /**
+ * Get the {@link OIDCPeerEntityContext} associated with the message.
+ *
+ * @return the peer context
+ */
+ @Nullable protected OIDCPeerEntityContext getOIDCPeerEntityContext() {
+ return peerContext;
+ }
+
@Override
@Nullable protected TrustEngine<SignedJWT> resolveTrustEngine(final MessageContext messageContext) {
final SecurityParametersContext secParams =
@@ -182,6 +198,11 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
providerMetadata = providerMetadataLookupStrategy.apply(messageContext);
clientInformation = clientInformationLookupStrategy.apply(messageContext);
+ peerContext = messageContext.getSubcontext(OIDCPeerEntityContext.class);
+ if (peerContext == null) {
+ throw new MessageHandlerException("OIDCPeerEntityContext was missing or unpopulated");
+ }
+
final RelyingPartyContext rpCtx = adapt(relyingPartyContextLookupStrategy).apply(messageContext);
if (rpCtx != null && rpCtx.getConfiguration() != null &&
rpCtx.getProfileConfig() instanceof OAuth2ClientAuthenticableProfileConfiguration) {
@@ -192,11 +213,16 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
}
@Override
- protected CriteriaSet buildCriteriaSet(final String entityID, final MessageContext messageContext)
+ protected CriteriaSet buildCriteriaSet(@Nullable final String entityID, @Nonnull final MessageContext messageContext)
throws MessageHandlerException {
final CriteriaSet criteriaSet = new CriteriaSet();
+ if (!Strings.isNullOrEmpty(entityID)) {
+ // Is the peer identifier in this context
+ criteriaSet.add(new IssuerIDCriterion(new Issuer(entityID)) );
+ }
+
if (providerMetadata != null) {
criteriaSet.add(new ProviderMetadataCriterion(providerMetadata));
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java
index c179c8f..36983c4 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java
@@ -34,6 +34,7 @@ import com.nimbusds.jose.JWSObject.State;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
+import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -119,14 +120,17 @@ public class JWTMessageSignatureSecurityHandler extends BaseJWTSignatureSecurity
log.debug("{} The JWS object was already verified! validating again", getLogPrefix());
}
- //TODO entityID could be issuerID?
- if (evaluate(signedJwt, null, messageContext)) {
- log.debug("{} Validation of JWS token signature succeeded",
- getLogPrefix());
+ final OIDCPeerEntityContext peerContext = getOIDCPeerEntityContext();
+ // Add peer identifier in case it is needed by credential resolvers
+ final String issuerId = peerContext != null ? peerContext.getIdentifier() : null;
+
+ if (evaluate(signedJwt, issuerId, messageContext)) {
+ log.debug("{} Validation of JWS token signature succeeded for peer '{}'",
+ getLogPrefix(), issuerId);
} else {
log.debug(
"{} Validation of JWS token signature failed for context issuer '{}'",
- getLogPrefix(), claimsSet.getIssuer());
+ getLogPrefix(), issuerId);
throw new MessageHandlerException("Validation of JWS failed");
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/messaging/context/AbstractOIDCEntityContext.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/messaging/context/AbstractOIDCEntityContext.java
new file mode 100644
index 0000000..3fa8285
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/messaging/context/AbstractOIDCEntityContext.java
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.messaging.context;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.BaseContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+
+/**
+ * Abstract base class for subcontexts that carry information about a OIDC entity. This context will often
+ * contain subcontexts, whose data is construed to be scoped to that entity.
+ */
+public class AbstractOIDCEntityContext extends BaseContext {
+
+ /** The identifier of the OIDC peer entity e.g. issuerId or ClientId. */
+ @Nullable @NotEmpty private String identifer;
+
+ /**
+ * Gets the identifier of the OIDC entity.
+ *
+ * @return identifier of the OIDC entity, may be null
+ */
+ @Nullable @NotEmpty public String getIdentifier() {
+ return identifer;
+ }
+
+ /**
+ * Sets the identifier of the OIDC entity e.g. issuerId or ClientId.
+ *
+ * @param id the new identifier
+ *
+ * @return this
+ */
+ public AbstractOIDCEntityContext setIdentifier(@Nullable final String id) {
+ identifer = StringSupport.trimOrNull(id);
+ return this;
+ }
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/messaging/context/OIDCPeerEntityContext.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/messaging/context/OIDCPeerEntityContext.java
new file mode 100644
index 0000000..4c5e817
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/messaging/context/OIDCPeerEntityContext.java
@@ -0,0 +1,29 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.messaging.context;
+
+/**
+ * Lightweight subcontext that carries information about a OIDC peer entity.
+ *
+ * <p>
+ * This context will often contain subcontexts, whose data is construed to be scoped to that peer entity.
+ * </p>
+ */
+public final class OIDCPeerEntityContext extends AbstractOIDCEntityContext {
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list