[java-oidc-common] branch main updated: Feed ClientInformation to the criteria set if found via lookup function.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=f0523fc68cf72aeb5c1472eab4a9b5964983286e

The following commit(s) were added to refs/heads/main by this push:
     new f0523fc  Feed ClientInformation to the criteria set if found via lookup function.
f0523fc is described below

commit f0523fc68cf72aeb5c1472eab4a9b5964983286e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Jan 5 15:31:10 2023 +0200

    Feed ClientInformation to the criteria set if found via lookup function.
---
 .../impl/BaseJWTSignatureSecurityHandler.java      | 43 ++++++++++++++++++++--
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
index d5cfe32..3e71d87 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
@@ -27,6 +27,7 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.context.navigate.ParentProfileRequestContextLookup;
+import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler;
@@ -36,10 +37,12 @@ import org.slf4j.LoggerFactory;
 
 import com.nimbusds.jwt.SignedJWT;
 import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
 
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
 import net.shibboleth.oidc.security.context.JWTSecurityParametersContext;
+import net.shibboleth.oidc.security.criterion.ClientInformationCriterion;
 import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
 import net.shibboleth.oidc.security.criterion.StaticCredentialCriterion;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -65,7 +68,13 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
      * if not used.
      */
     @Nonnull private Function<MessageContext, OIDCProviderMetadata> providerMetadataLookupStrategy;
-    
+
+    /**
+     * Function that looks up client information from the given message context. Can return {@literal null}
+     * if not used.
+     */
+    @Nonnull private Function<MessageContext, OIDCClientInformation> clientInformationLookupStrategy;
+
     /** Lookup function for relying party context. */
     @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
     
@@ -75,9 +84,13 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
     /** The provider metadata found from the lookup strategy.*/
     @Nullable private OIDCProviderMetadata providerMetadata;
 
+    /** The client information found from the lookup strategy. */
+    @Nullable private OIDCClientInformation clientInformation;
+
     /** Constructor.*/
     protected BaseJWTSignatureSecurityHandler() {
         providerMetadataLookupStrategy = FunctionSupport.constant(null);
+        clientInformationLookupStrategy = FunctionSupport.constant(null);
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
     }
     
@@ -94,7 +107,20 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
                 Constraint.isNotNull(strategy,"Provider metadata lookup strategy can not be null");       
         
     }
-    
+
+    /**
+     * Set the lookup strategy to locate the client information.
+     * 
+     * @param strategy the strategy.
+     */
+    public void setClientInformationLookupStrategy(
+            @Nonnull final Function<MessageContext, OIDCClientInformation> strategy) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+        clientInformationLookupStrategy = 
+                Constraint.isNotNull(strategy, "Client information lookup strategy can not be null");
+    }
+
     /**
      * Set lookup strategy for relying party context.
      * 
@@ -126,6 +152,7 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
             return false;
         }        
         providerMetadata = providerMetadataLookupStrategy.apply(messageContext);  
+        clientInformation = clientInformationLookupStrategy.apply(messageContext);
         
         final RelyingPartyContext rpCtx = adapt(relyingPartyContextLookupStrategy).apply(messageContext);     
         if (rpCtx != null && rpCtx.getConfiguration() != null &&
@@ -146,9 +173,17 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
             criteriaSet.add(new ProviderMetadataCriterion(providerMetadata));
         }
         
+        if (clientInformation != null) {
+            criteriaSet.add(new ClientInformationCriterion(clientInformation));
+        }
+
         if (profileConfiguration != null) {
-            criteriaSet.add(new StaticCredentialCriterion(
-                    profileConfiguration.getClientCredential(PRC_LOOKUP.apply(messageContext))));
+            final Credential credential = profileConfiguration.getClientCredential(PRC_LOOKUP.apply(messageContext));
+            if (credential != null) {
+                criteriaSet.add(new StaticCredentialCriterion(credential));
+            } else {
+                log.trace("{} No credential found from the profile configuration", getLogPrefix());
+            }
         }
        
         criteriaSet.add( new UsageCriterion(UsageType.SIGNING) );

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.