[java-oidc-common] branch main updated: Move JWT encryption/decryption/signature -related lookups from RP to commons.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=a30800de77c004a9d7a45652854190e9acb46573

The following commit(s) were added to refs/heads/main by this push:
     new a30800d  Move JWT encryption/decryption/signature -related lookups from RP to commons.
a30800d is described below

commit a30800de77c004a9d7a45652854190e9acb46573
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Jan 4 16:48:21 2023 +0200

    Move JWT encryption/decryption/signature -related lookups from RP to commons.
    
    The functions were named after more specific needs of RP:
    
    - RequestObjectEncryptionConfigurationLookupFunction
    - IDTokenDecryptionConfigurationLookupFunction
    - JWTSignatureValidationConfigurationLookupFunction
    - UserInfoDecryptionConfigurationLookupFunction
    
    I renamed them with JWT -prefix as they are generic. Also swiched the input type into
    PRC in order to be compatible with the OP's code.
---
 .../JWTDecryptionConfigurationLookupFunction.java  | 98 ++++++++++++++++++++++
 .../JWTEncryptionConfigurationLookupFunction.java  | 94 +++++++++++++++++++++
 ...ignatureSigningConfigurationLookupFunction.java | 94 +++++++++++++++++++++
 ...atureValidationConfigurationLookupFunction.java | 98 ++++++++++++++++++++++
 4 files changed, 384 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTDecryptionConfigurationLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTDecryptionConfigurationLookupFunction.java
new file mode 100644
index 0000000..77dc8d0
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTDecryptionConfigurationLookupFunction.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
+import net.shibboleth.oidc.security.JWTDecryptionConfiguration;
+
+/**
+ * A function that returns a {@link JWTSignatureValidationConfiguration} list for JWS validation by way
+ * of various lookup strategies. 
+ * 
+ * <p>
+ * If a specific setting is unavailable, a null value is returned.
+ * </p>
+ * 
+ * @since 2.2.0
+ */
+public class JWTDecryptionConfigurationLookupFunction 
+            extends AbstractRelyingPartyLookupFunction<List<JWTDecryptionConfiguration>> {
+
+    /** A resolver for default security configurations. */
+    @Nullable
+    private RelyingPartyConfigurationResolver rpResolver;
+
+    /**
+     * Set the resolver for default security configurations.
+     * 
+     * @param resolver the resolver to use
+     */
+    public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
+        rpResolver = resolver;
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    @Nullable
+    public List<JWTDecryptionConfiguration> apply(@Nullable final ProfileRequestContext input) {
+
+        final List<JWTDecryptionConfiguration> configs = new ArrayList<>();
+
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc != null && 
+                    pc.getSecurityConfiguration(input) 
+                        instanceof OIDCSecurityConfiguration
+                    && ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(
+                            input))
+                    .getJwtSignatureValidationConfiguration() != null) {
+                configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(
+                        input))
+                        .getJwtDecryptionConfiguration());
+            }
+        }
+
+        // Check for a per-profile default (relying party independent) config.
+        if (input != null && rpResolver != null) {
+            final SecurityConfiguration defaultConfig =
+                    rpResolver.getDefaultSecurityConfiguration(
+                            input.getProfileId());
+            if (defaultConfig instanceof OIDCSecurityConfiguration
+                    && ((OIDCSecurityConfiguration) defaultConfig)
+                    .getJwtSignatureValidationConfiguration() != null) {
+                configs.add(
+                        ((OIDCSecurityConfiguration) defaultConfig).getJwtDecryptionConfiguration());
+            }
+        }
+        // TODO: Support for Global Default configuration?
+        return configs;
+    }
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTEncryptionConfigurationLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTEncryptionConfigurationLookupFunction.java
new file mode 100644
index 0000000..b363394
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTEncryptionConfigurationLookupFunction.java
@@ -0,0 +1,94 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
+import net.shibboleth.oidc.security.JWTEncryptionConfiguration;
+
+/**
+ * A function that returns an {@link JWTEncryptionConfiguration} list for JWT encryption by way
+ * of various lookup strategies. 
+ * 
+ * <p>
+ * If a specific setting is unavailable, a null value is returned.
+ * </p>
+ * 
+ * @since 2.2.0
+ */
+public class JWTEncryptionConfigurationLookupFunction 
+            extends AbstractRelyingPartyLookupFunction<List<JWTEncryptionConfiguration>> {
+
+    /** A resolver for default security configurations. */
+    @Nullable
+    private RelyingPartyConfigurationResolver rpResolver;
+
+    /**
+     * Set the resolver for default security configurations.
+     * 
+     * @param resolver the resolver to use
+     */
+    public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
+        rpResolver = resolver;
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    @Nullable
+    public List<JWTEncryptionConfiguration> apply(@Nullable final ProfileRequestContext input) {
+
+        final List<JWTEncryptionConfiguration> configs = new ArrayList<>();
+
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
+                    && ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
+                            .getJwtEncryptionConfiguration() != null) {
+                configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
+                        .getJwtEncryptionConfiguration());
+            }
+        }
+
+        // Check for a per-profile default (relying party independent) config.
+        if (input != null && rpResolver != null) {
+            final SecurityConfiguration defaultConfig =
+                    rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
+            if (defaultConfig instanceof OIDCSecurityConfiguration
+                    && ((OIDCSecurityConfiguration) defaultConfig)
+                    .getJwtEncryptionConfiguration() != null) {
+                configs.add(
+                        ((OIDCSecurityConfiguration) defaultConfig).getJwtEncryptionConfiguration());
+            }
+        }
+        // TODO: Support for Global Default configuration?
+        return configs;
+    }
+}
+
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureSigningConfigurationLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureSigningConfigurationLookupFunction.java
new file mode 100644
index 0000000..ed3a796
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureSigningConfigurationLookupFunction.java
@@ -0,0 +1,94 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
+import net.shibboleth.oidc.security.JWTSignatureSigningConfiguration;
+
+/**
+ * A function that returns a {@link JWTSignatureSigningConfiguration} list for JWT signing by way of various lookup
+ * strategies. 
+ * 
+ * <p>
+ * If a specific setting is unavailable, a null value is returned.
+ * </p>
+ * 
+ * @since 2.2.0
+ */
+public class JWTSignatureSigningConfigurationLookupFunction 
+            extends AbstractRelyingPartyLookupFunction<List<JWTSignatureSigningConfiguration>> {
+
+    /** A resolver for default security configurations. */
+    @Nullable
+    private RelyingPartyConfigurationResolver rpResolver;
+
+    /**
+     * Set the resolver for default security configurations.
+     * 
+     * @param resolver the resolver to use
+     */
+    public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
+        rpResolver = resolver;
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    @Nullable
+    public List<JWTSignatureSigningConfiguration> apply(@Nullable final ProfileRequestContext input) {
+
+        final List<JWTSignatureSigningConfiguration> configs = new ArrayList<>();
+
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc != null && pc.getSecurityConfiguration(input) instanceof OIDCSecurityConfiguration
+                    && ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
+                            .getJwtSignatureSigningConfiguration() != null) {
+                configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(input))
+                        .getJwtSignatureSigningConfiguration());
+            }
+        }
+
+        // Check for a per-profile default (relying party independent) config.
+        if (input != null && rpResolver != null) {
+            final SecurityConfiguration defaultConfig =
+                    rpResolver.getDefaultSecurityConfiguration(input.getProfileId());
+            if (defaultConfig instanceof OIDCSecurityConfiguration
+                    && ((OIDCSecurityConfiguration) defaultConfig)
+                    .getJwtSignatureSigningConfiguration() != null) {
+                configs.add(
+                        ((OIDCSecurityConfiguration) defaultConfig).getJwtSignatureSigningConfiguration());
+            }
+        }
+        // TODO: Support for Global Default configuration?
+        return configs;
+    }
+}
+
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureValidationConfigurationLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureValidationConfigurationLookupFunction.java
new file mode 100644
index 0000000..36409d0
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureValidationConfigurationLookupFunction.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.oidc.profile.config.OIDCSecurityConfiguration;
+import net.shibboleth.oidc.security.JWTSignatureValidationConfiguration;
+
+/**
+ * A function that returns a {@link JWTSignatureValidationConfiguration} list for JWS validation by way
+ * of various lookup strategies. 
+ * 
+ * <p>
+ * If a specific setting is unavailable, a null value is returned.
+ * </p>
+ * 
+ * @since 2.2.0
+ */
+public class JWTSignatureValidationConfigurationLookupFunction 
+            extends AbstractRelyingPartyLookupFunction<List<JWTSignatureValidationConfiguration>> {
+
+    /** A resolver for default security configurations. */
+    @Nullable
+    private RelyingPartyConfigurationResolver rpResolver;
+
+    /**
+     * Set the resolver for default security configurations.
+     * 
+     * @param resolver the resolver to use
+     */
+    public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
+        rpResolver = resolver;
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    @Nullable
+    public List<JWTSignatureValidationConfiguration> apply(@Nullable final ProfileRequestContext input) {
+
+        final List<JWTSignatureValidationConfiguration> configs = new ArrayList<>();
+
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc != null && 
+                    pc.getSecurityConfiguration(input) 
+                        instanceof OIDCSecurityConfiguration
+                    && ((OIDCSecurityConfiguration) pc.getSecurityConfiguration(
+                            input))
+                    .getJwtSignatureValidationConfiguration() != null) {
+                configs.add(((OIDCSecurityConfiguration) pc.getSecurityConfiguration(
+                        input))
+                        .getJwtSignatureValidationConfiguration());
+            }
+        }
+
+        // Check for a per-profile default (relying party independent) config.
+        if (input != null && rpResolver != null) {
+            final SecurityConfiguration defaultConfig =
+                    rpResolver.getDefaultSecurityConfiguration(
+                            input.getProfileId());
+            if (defaultConfig instanceof OIDCSecurityConfiguration
+                    && ((OIDCSecurityConfiguration) defaultConfig)
+                    .getJwtSignatureValidationConfiguration() != null) {
+                configs.add(
+                        ((OIDCSecurityConfiguration) defaultConfig).getJwtSignatureValidationConfiguration());
+            }
+        }
+        // TODO: Support for Global Default configuration?
+        return configs;
+    }
+}

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.