[java-oidc-common] 02/02: Move PopulateJWTDecryptionParameters from RP to commons.
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Jan 4 14:33:14 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=80f9a67276c3001e2a1c7b19fbe198c7bf2759ac
commit 80f9a67276c3001e2a1c7b19fbe198c7bf2759ac
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Jan 4 16:32:13 2023 +0200
Move PopulateJWTDecryptionParameters from RP to commons.
---
.../impl/PopulateJWTDecryptionParameters.java | 230 +++++++++++++++++++++
1 file changed, 230 insertions(+)
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
new file mode 100644
index 0000000..7b87e6f
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
@@ -0,0 +1,230 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.impl;
+
+import java.util.List;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.xmlsec.context.SecurityParametersContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.security.JWTDecryptionConfiguration;
+import net.shibboleth.oidc.security.JWTDecryptionParameters;
+import net.shibboleth.oidc.security.JWTDecryptionParametersResolver;
+import net.shibboleth.oidc.security.JWTEncryptionConfiguration;
+import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
+import net.shibboleth.oidc.security.criterion.JWTDecryptionConfigurationCriterion;
+import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * Action that resolves and populates {@link JWTDecryptionParameters} on an {@link JWTSecurityParametersContext}
+ * created/accessed via a lookup function, by default on a child of the outbound message context.
+ *
+ * <p>The default, per-RelyingParty, and default per-profile {@link JWTEncryptionConfiguration}
+ * objects are input to the resolution process, along with any static, symmetric key credentials
+ * configured on the relying party i.e. the client_secret.</p>
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_PROFILE_CTX}
+ * @event {@link EventIds#INVALID_SEC_CFG}
+ * @post set the decryption parameters onto the security parameters context
+ */
+public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateJWTDecryptionParameters.class);
+
+ /** Strategy used to look up the {@link SecurityParametersContext} to set the parameters for. */
+ @Nonnull
+ private Function<ProfileRequestContext,JWTSecurityParametersContext> securityParametersContextLookupStrategy;
+
+ /** Strategy used to lookup a per-request {@link JWTDecryptionConfiguration} list. */
+ @NonnullAfterInit
+ private Function<ProfileRequestContext,List<JWTDecryptionConfiguration>> configurationLookupStrategy;
+
+ /** Lookup function for relying party context. */
+ @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
+
+ /** Resolver for parameters to store into context. */
+ @NonnullAfterInit private JWTDecryptionParametersResolver resolver;
+
+ /**
+ * Constructor.
+ */
+ public PopulateJWTDecryptionParameters() {
+ // Create context by default.
+ securityParametersContextLookupStrategy =
+ new ChildContextLookup<>(JWTSecurityParametersContext.class, true).compose(
+ new InboundMessageContextLookup());
+ relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ }
+
+ /**
+ * Set lookup strategy for relying party context.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ relyingPartyContextLookupStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the resolver to use for the parameters to store into the context.
+ *
+ * @param newResolver resolver to use
+ */
+ public void setDecryptionParametersResolver(@Nonnull final JWTDecryptionParametersResolver newResolver) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ resolver = Constraint.isNotNull(newResolver, "DecryptionParametersResolver cannot be null");
+ }
+
+ /**
+ * Set the strategy used to look up a per-request {@link JWTDecryptionConfiguration} list.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setConfigurationLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, List<JWTDecryptionConfiguration>> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ configurationLookupStrategy = Constraint.isNotNull(strategy,
+ "DecryptionConfiguration lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the strategy used to look up the {@link SecurityParametersContext} to set the parameters for.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setSecurityParametersContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, JWTSecurityParametersContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ securityParametersContextLookupStrategy = Constraint.isNotNull(strategy,
+ "SecurityParametersContext lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (resolver == null) {
+ throw new ComponentInitializationException("DecryptionParametersResolver cannot be null");
+ }
+ if (configurationLookupStrategy == null) {
+ throw new ComponentInitializationException("DecryptionConfiguraitonLookup cannot be null");
+ }
+ }
+
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ log.debug("{} Resolving JWT DecryptionParameters for request", getLogPrefix());
+
+ final List<JWTDecryptionConfiguration> configs = configurationLookupStrategy.apply(profileRequestContext);
+ if (configs == null || configs.isEmpty()) {
+ log.error("{} No DecryptionConfigurations returned by lookup strategy", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
+ return;
+ }
+
+ final JWTSecurityParametersContext paramsCtx =
+ securityParametersContextLookupStrategy.apply(profileRequestContext);
+ if (paramsCtx == null) {
+ log.debug("{} No SecurityParametersContext returned by lookup strategy", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return;
+ }
+
+ try {
+ final JWTDecryptionParameters params =
+ resolver.resolveSingle(buildCriteriaSet(profileRequestContext, configs));
+ paramsCtx.setDecryptionParameters(params);
+ log.debug("{} {} DecryptionParameters", getLogPrefix(),
+ params != null ? "Resolved" : "Failed to resolve");
+ } catch (final ResolverException e) {
+ log.error("{} Error resolving DecryptionParameters", getLogPrefix(), e);
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
+ }
+
+ }
+
+ /**
+ * Build the criteria used as input to the {@link JWTDecryptionParametersResolver}.
+ *
+ * @param profileRequestContext current profile request context
+ * @param configs a list of {@link JWTDecryptionConfiguration}s to add to the criteria set.
+ *
+ * @return the criteria set to use
+ */
+ @Nonnull
+ private CriteriaSet buildCriteriaSet(@Nonnull final ProfileRequestContext profileRequestContext,
+ final List<JWTDecryptionConfiguration> configs) {
+
+ final CriteriaSet criteria = new CriteriaSet();
+ criteria.add(new JWTDecryptionConfigurationCriterion(configs));
+
+ // Build a static credential criteria. Extract the decryption credential from the RP config.
+ final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
+ if (rpCtx != null && rpCtx.getConfiguration() != null &&
+ rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
+ final OIDCAuthorizationConfiguration profileConfiguration =
+ (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
+
+ if (profileConfiguration != null) {
+ final Credential credential = profileConfiguration.getClientCredential(profileRequestContext);
+ if (credential != null) {
+ criteria.add(new StaticCredentialCriterion(credential));
+ } else {
+ log.trace("{} No credential found from the profile configuration", getLogPrefix());
+ }
+ } else {
+ log.warn("{} Profile configuration not available, client credential missing", getLogPrefix());
+ }
+ }
+
+ return criteria;
+
+ }
+
+}
+
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list