[java-oidc-common] branch main updated: Renamed the signature algorithm handler and reduced the dependency tree.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=513e0434fd8687ef319ef3e2e97ee3dc60994188

The following commit(s) were added to refs/heads/main by this push:
     new 513e043  Renamed the signature algorithm handler and reduced the dependency tree.
513e043 is described below

commit 513e0434fd8687ef319ef3e2e97ee3dc60994188
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Feb 3 15:48:19 2023 +0200

    Renamed the signature algorithm handler and reduced the dependency tree.
    
    It now extends AbstractMessageHandler instead of BaseJWTSignatureSecurityHandler.
    The previous setup inherited e.g. TrustEngine, even though this handler is not
    performing the actual signature validation.
---
 ...> CheckClientJWTSignatureAlgorithmHandler.java} | 33 ++++++++++++++++++----
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationJWTSignatureAlgorithmSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTSignatureAlgorithmHandler.java
similarity index 84%
rename from oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationJWTSignatureAlgorithmSecurityHandler.java
rename to oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTSignatureAlgorithmHandler.java
index 9fee52c..d89678d 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationJWTSignatureAlgorithmSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTSignatureAlgorithmHandler.java
@@ -23,6 +23,7 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.AbstractMessageHandler;
 import org.opensaml.messaging.handler.MessageHandler;
 import org.opensaml.messaging.handler.MessageHandlerException;
 import org.slf4j.Logger;
@@ -41,21 +42,27 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
  * A {@link MessageHandler} that uses a {@link OIDCClientInformation} to verify the signature of a signed JWT uses
  * expected algorithm.
  */
-public class ClientInformationJWTSignatureAlgorithmSecurityHandler extends BaseJWTSignatureSecurityHandler {
+public class CheckClientJWTSignatureAlgorithmHandler extends AbstractMessageHandler {
     
     /** Logger. */
     @Nonnull private final Logger log =
-            LoggerFactory.getLogger(ClientInformationJWTSignatureAlgorithmSecurityHandler.class);
+            LoggerFactory.getLogger(CheckClientJWTSignatureAlgorithmHandler.class);
     
     /** Function that looks up a signed JWT token from the given message context to validate .*/
     @NonnullAfterInit private Function<MessageContext, SignedJWT> jwtTokenLookupStrategy;
 
+    /**
+     * Function that looks up client information from the given message context. Can return {@literal null}
+     * if not used.
+     */
+    @NonnullAfterInit private Function<MessageContext, OIDCClientInformation> clientInformationLookupStrategy;
+
     /** A lookup function for the signature algorithm in the client metadata. */
     @NonnullAfterInit private Function<OIDCClientInformation, String> signatureAlgorithmLookupStrategy;
 
     /** The extracted signed JWT that is to be validated.*/
     @Nullable private SignedJWT signedJwt;
-    
+
     /** The default algorithm value used if lookup strategy returned null. */
     @Nullable private String defaultAlgorithmValue;
 
@@ -72,6 +79,19 @@ public class ClientInformationJWTSignatureAlgorithmSecurityHandler extends BaseJ
                 "JwtToken lookup strategy cannot be null");
     }
 
+    /**
+     * Set the lookup strategy to locate the client information.
+     * 
+     * @param strategy the strategy.
+     */
+    public void setClientInformationLookupStrategy(
+            @Nonnull final Function<MessageContext, OIDCClientInformation> strategy) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+        clientInformationLookupStrategy = 
+                Constraint.isNotNull(strategy, "Client information lookup strategy can not be null");
+    }
+
     /**
      * Set the strategy used to look up the signature algorithm in the client metadata.
      * 
@@ -105,7 +125,10 @@ public class ClientInformationJWTSignatureAlgorithmSecurityHandler extends BaseJ
             throw new ComponentInitializationException("JwtTokenLookupStrategy cannot be null");
         }
         if (signatureAlgorithmLookupStrategy == null) {
-            throw new ComponentInitializationException("SignatureAlgorithmLookupStrategy cannot be null");            
+            throw new ComponentInitializationException("SignatureAlgorithmLookupStrategy cannot be null");
+        }
+        if (clientInformationLookupStrategy == null) {
+            throw new ComponentInitializationException("ClientInformationLookupStrategy cannot be null");
         }
     }
 
@@ -129,7 +152,7 @@ public class ClientInformationJWTSignatureAlgorithmSecurityHandler extends BaseJ
     @Override
     protected void doInvoke(final MessageContext messageContext) throws MessageHandlerException {
         final String tokenAlgorithm = signedJwt.getHeader().getAlgorithm().getName();
-        final String expectedAlgorithm = getExpectedAlgorithm(clientInformation);
+        final String expectedAlgorithm = getExpectedAlgorithm(clientInformationLookupStrategy.apply(messageContext));
 
         if (expectedAlgorithm == null) {
             log.debug("No expected algorithm defined, accepting {} from the token", tokenAlgorithm);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.