[java-oidc-common] branch main updated: JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Jan 6 10:19:20 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=1fb033b435be089c275fb9bd8950f3a25f868edf
The following commit(s) were added to refs/heads/main by this push:
new 1fb033b JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
1fb033b is described below
commit 1fb033b435be089c275fb9bd8950f3a25f868edf
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Jan 6 12:17:51 2023 +0200
JCOMOIDC-41 - Move OIDC Signature Validation resolvers and parameter classes to commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-41
Added the new style credential and algorithm resolution functionality from client information.
---
.../impl/ClientInformationCredentialResolver.java | 177 ++++++++++++++++++
...tionDataEncryptionAlgorithmsLookupStrategy.java | 119 ++++++++++++
...ransportEncryptionAlgorithmsLookupStrategy.java | 120 ++++++++++++
.../ClientInformationCredentialResolverTest.java | 205 +++++++++++++++++++++
...st-resolver-client-information-inline-jwks.json | 26 +++
...st-resolver-client-information-remote-jwks.json | 9 +
.../test-resolver-client-information-secret.json | 9 +
...ClientInformationStringValueLookupFunction.java | 68 +++++++
8 files changed, 733 insertions(+)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
new file mode 100644
index 0000000..99990d6
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
@@ -0,0 +1,177 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential.impl;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.LinkedHashSet;
+
+import javax.annotation.Nonnull;
+import javax.crypto.spec.SecretKeySpec;
+
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+
+import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
+import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidc.security.criterion.ClientInformationCriterion;
+import net.shibboleth.oidc.security.impl.JWSAssemblyUtils;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.component.InitializableComponent;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * A {@link JOSEObjectCredentialResolver} that resolves credentials from the jwks or contents of jwks_uri of a
+ * ClientInformation. If the information contains client secret, it's converted into a {@link BasicJWKCredential}.
+ * Further filtering of credentials is provided by the {@link AbstractCriteriaFilteringCredentialResolver} parent
+ * class.
+ *
+ * <p>Note, only RSA or EC keys are resolved as these are the only key types which should be exposed in
+ * public JWKS documents.</p>
+ */
+public class ClientInformationCredentialResolver extends BasicJOSEObjectCredentialResolver
+ implements InitializableComponent {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ClientInformationCredentialResolver.class);
+
+ /** Initialization flag. */
+ private boolean isInitialized;
+
+ /** The cache for remote JWK key sets. */
+ @NonnullAfterInit private RemoteJwkSetCache remoteJwkSetCache;
+
+ /** The remote key refresh interval. Default value: 30 minutes. */
+ @Positive private Duration keyFetchInterval = Duration.ofMinutes(30);
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isInitialized() {
+ return isInitialized;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void initialize() throws ComponentInitializationException {
+
+ if (remoteJwkSetCache == null) {
+ throw new ComponentInitializationException("Remote JWK Set Cache can not be null");
+ }
+ isInitialized = true;
+ }
+
+ /**
+ * Set the remote key refresh interval.
+ *
+ * @param interval What to set.
+ */
+ public void setKeyFetchInterval(@Positive final Duration interval) {
+ Constraint.isFalse(interval == null || interval.isNegative(), "Remote key refresh must be greater than 0");
+ keyFetchInterval = interval;
+ }
+
+ /**
+ * Set the cache for remote JWK key sets.
+ *
+ * @param jwkSetCache What to set.
+ */
+ public void setRemoteJwkSetCache(final RemoteJwkSetCache jwkSetCache) {
+ remoteJwkSetCache = Constraint.isNotNull(jwkSetCache, "The remote JWK set cache cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected Iterable<Credential> resolveFromSource(@Nonnull final CriteriaSet criteriaSet) throws ResolverException {
+
+ ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
+ Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
+
+ if (criteriaSet.contains(ClientInformationCriterion.class)) {
+ final OIDCClientInformation information = criteriaSet.get(ClientInformationCriterion.class).getOidcClientInformation();
+ return resolveFromMetadata(criteriaSet, information);
+
+ } else {
+ log.debug("Criteria did not contain a ClientInformationCriterion could not perform resolution");
+ return Collections.emptySet();
+ }
+ }
+
+ /**
+ * Fetch the remote JWK Set from the jwk_uri in the RP/Client metadata. Convert each
+ * JWK into a {@link Credential} and return. Only supports EC (key agreement) and RSA (key encryption) keys.
+ * If the client information contains client secret, it's converted into a {@link BasicJWKCredential}.
+ *
+ * @param criteriaSet the criteria set
+ * @param information the RP/Client information
+ *
+ * @return a collection of credentials combined of client secret and keys from the key set (if any).
+ */
+ @Nonnull protected Collection<Credential> resolveFromMetadata(@Nonnull final CriteriaSet criteriaSet,
+ @Nonnull final OIDCClientInformation information) {
+
+ final LinkedHashSet<Credential> credentials = new LinkedHashSet<>(1);
+ final OIDCClientMetadata metadata = information.getOIDCMetadata();
+
+ if (information.getSecret() != null) {
+ final BasicJWKCredential jwkCredential = new BasicJWKCredential();
+ jwkCredential.setSecretKey(new SecretKeySpec(JWSAssemblyUtils.getSecretBytes(information.getSecret().getValue()), "AES"));
+ credentials.add(jwkCredential);
+ }
+
+ final JWKSet keySet;
+
+ if (metadata.getJWKSetURI() != null) {
+ final String keyIdFromCriteria = extractKeyIdFromCriteria(criteriaSet);
+
+ if (StringSupport.trimOrNull(keyIdFromCriteria) != null) {
+ keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(),keyIdFromCriteria,
+ Instant.now().plus(keyFetchInterval));
+ } else {
+ keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(),
+ Instant.now().plus(keyFetchInterval));
+ }
+
+ if (keySet == null) {
+ log.debug("Remote keys could not be fetched, unable to resolve credentials");
+ return credentials;
+ }
+ } else if (metadata.getJWKSet() != null) {
+ keySet = metadata.getJWKSet();
+ } else {
+ return credentials;
+ }
+
+ populateCredentialsFromKeySet(keySet, credentials);
+ return credentials;
+
+ }
+}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationDataEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationDataEncryptionAlgorithmsLookupStrategy.java
new file mode 100644
index 0000000..c1e82f7
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationDataEncryptionAlgorithmsLookupStrategy.java
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+
+import net.shibboleth.oidc.security.criterion.ClientInformationCriterion;
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+
+/**
+ * A lookup strategy that finds data/content encryption algorithms from local configuration that are compatible
+ * with those advertised by the RP/client information.
+ *
+ * <p>The set of supported and configured encryption methods ('enc') are derived from the intersection of
+ * those supported by local configuration and the one configured for the RP. </p>
+ */
+public class ClientInformationDataEncryptionAlgorithmsLookupStrategy
+ extends DefaultDataEncryptionAlgorithmsLookupStrategy {
+
+ /** Logger. */
+ @Nonnull private final Logger log =
+ LoggerFactory.getLogger(ClientInformationDataEncryptionAlgorithmsLookupStrategy.class);
+
+ /**
+ * A strategy to locate the encryption method ('enc') appropriate for the JWT to be encrypted.
+ * Can return {@code null} if the metadata does not contain a value (which is means no encryption should be done).
+ */
+ @Nonnull
+ private final Function<OIDCClientInformation, String> clientEncryptionMethodLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy the strategy used to locate the encryption methods ('enc') from the client metadata
+ * appropriate for the JWT to be encrypted.
+ * @param registry the algorithm registry to used when resolving algorithm URIs. Can be {@code null}.
+ */
+ public ClientInformationDataEncryptionAlgorithmsLookupStrategy(
+ @Nonnull @ParameterName(name="clientEncryptionMethodLookupStrategy")
+ final Function<OIDCClientInformation, String> strategy,
+ @Nullable @ParameterName(name = "AlgorithmRegistry") final AlgorithmRegistry registry){
+ super(registry);
+ clientEncryptionMethodLookupStrategy = Constraint.isNotNull(strategy, "The client key transport "
+ + "lookup strategy can not be null");
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param strategy the strategy used to locate the encryption methods ('enc') from the client metadata
+ * appropriate for the JWT to be encrypted.
+ */
+ public ClientInformationDataEncryptionAlgorithmsLookupStrategy(
+ @Nonnull @ParameterName(name="clientEncryptionMethodLookupStrategy")
+ final Function<OIDCClientInformation, String> strategy){
+ this(strategy, null);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public List<String> apply(final CriteriaSet criteria, final Predicate<String> includeExcludePredicate) {
+
+ OIDCClientInformation metadata = null;
+ if (criteria.contains(ClientInformationCriterion.class)) {
+ metadata = criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
+ }
+ if (metadata == null) {
+ log.debug("No client metadata, falling back to default local behaviour");
+ return super.apply(criteria, includeExcludePredicate);
+ }
+
+ final String dataEncryptionMethod = clientEncryptionMethodLookupStrategy.apply(metadata);
+ log.trace("Resolved effective data encryption algorithms from client metadata: {}", dataEncryptionMethod);
+ if (dataEncryptionMethod == null) {
+ log.debug("Client metadata does not contain 'enc' algorithm value, returning empty list");
+ return Collections.emptyList();
+ }
+
+ final List<String> dataEncryptionAlgorithmsSupported =
+ getDataEncryptionAlgorithmsFromConfiguration(criteria, includeExcludePredicate);
+ log.trace("Resolved supported data encryption algorithms from config: {}", dataEncryptionAlgorithmsSupported);
+
+ if (dataEncryptionAlgorithmsSupported.contains(dataEncryptionMethod)) {
+ log.debug("The algorithm configured in the metadata is supported");
+ return List.of(dataEncryptionMethod);
+ }
+ log.warn("No supported data encryption method. Client metadata and configuration are not compatible");
+ return Collections.emptyList();
+ }
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy.java
new file mode 100644
index 0000000..81d576f
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy.java
@@ -0,0 +1,120 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+
+import net.shibboleth.oidc.security.criterion.ClientInformationCriterion;
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+
+/**
+ * A lookup strategy that finds key transport algorithms from local configuration that are compatible with those
+ * configured to RP.
+ *
+ * <p>The set of supported and configured key transport ('alg') algorithms are derived from the intersection of
+ * those supported by local configuration and the one configured for RP. </p>
+ */
+public class ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy
+ extends DefaultKeyTransportEncryptionAlgorithmsLookupStrategy {
+
+ /** Logger. */
+ @Nonnull private final Logger log =
+ LoggerFactory.getLogger(ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy.class);
+
+ /**
+ * A strategy to locate the algorithm ('alg') appropriate for the JWT to be encrypted.
+ * Can return null if the metadata does not describe its supported algorithms (which is optional).
+ */
+ @Nonnull
+ private final Function<OIDCClientInformation, String> clientKeyTransportAlgorithmLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy the strategy used to locate the algorithm ('alg') from the client metadata
+ * appropriate for the JWT to be encrypted.
+ * @param registry the algorithm registry to used when resolving algorithm URIs. Can be {@code null}.
+ */
+ public ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy(
+ @Nonnull @ParameterName(name="clientKeyTransportAlgorithmsLookupStrategy")
+ final Function<OIDCClientInformation, String> strategy,
+ @Nullable @ParameterName(name = "AlgorithmRegistry") final AlgorithmRegistry registry){
+ super(registry);
+ clientKeyTransportAlgorithmLookupStrategy = Constraint.isNotNull(strategy, "The client key transport "
+ + "lookup strategy can not be null");
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param strategy the strategy used to locate the algorithm ('alg') from the client metadata
+ * appropriate for the JWT to be encrypted.
+ */
+ public ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy(
+ @Nonnull @ParameterName(name="clientKeyTransportAlgorithmLookupStrategy")
+ final Function<OIDCClientInformation, String> strategy){
+ this(strategy, null);
+ }
+
+ /** {@inheritDoc} */
+ @Override @Nonnull
+ public List<String> apply(final CriteriaSet criteria, final Predicate<String> includeExcludePredicate) {
+
+ OIDCClientInformation metadata = null;
+ if (criteria.contains(ClientInformationCriterion.class)) {
+ metadata = criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
+ }
+ if (metadata == null) {
+ log.debug("No client metadata, falling back to default local behaviour");
+ return super.apply(criteria, includeExcludePredicate);
+ }
+
+ final String keyTransportAlgorithm = clientKeyTransportAlgorithmLookupStrategy.apply(metadata);
+ log.trace("Resolved effective key transport algorithm from client metadata: {}", keyTransportAlgorithm);
+ if (keyTransportAlgorithm == null) {
+ log.debug("Client metadata does not contain 'alg' algorithm value, returning empty list");
+ return Collections.emptyList();
+ }
+
+ final List<String> keyTransportAlgorithmSupported =
+ getKeyTransportAlgorithmsFromConfiguration(criteria, includeExcludePredicate);
+ log.trace("Resolved supported key transport algorithms from config: {}",
+ keyTransportAlgorithmSupported);
+
+ if (keyTransportAlgorithmSupported.contains(keyTransportAlgorithm)) {
+ log.debug("The algorithm configured in the metadata is supported");
+ return List.of(keyTransportAlgorithm);
+ }
+ log.warn("No supported key transport algorithm. Client metadata and configuration are not compatible");
+ return Collections.emptyList();
+ }
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
new file mode 100644
index 0000000..9f9eb08
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
@@ -0,0 +1,205 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential.impl;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.mockito.Mockito;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.KeyAlgorithmCriterion;
+import org.opensaml.security.criteria.UsageCriterion;
+import org.springframework.core.io.ClassPathResource;
+import org.testng.annotations.Test;
+
+import com.nimbusds.oauth2.sdk.util.JSONObjectUtils;
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+
+import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
+import net.shibboleth.oidc.security.criterion.ClientInformationCriterion;
+import net.shibboleth.oidc.security.criterion.ProviderMetadataCriterion;
+import net.shibboleth.utilities.java.support.component.InitializableComponent;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+
+/**
+ * Unit tests for {@link ClientInformationCredentialResolver}.
+ */
+public class ClientInformationCredentialResolverTest extends BaseMetadataCredentialResolverTest<ClientInformationCredentialResolver> {
+
+ private static final ClassPathResource CLIENT_INFORMATION_REMOTE_KEYS =
+ new ClassPathResource("/metadata/test-resolver-client-information-remote-jwks.json");
+
+ private static final ClassPathResource CLIENT_INFORMATION_INLINE_KEYS =
+ new ClassPathResource("/metadata/test-resolver-client-information-inline-jwks.json");
+
+ private static final ClassPathResource CLIENT_INFORMATION_SECRET =
+ new ClassPathResource("/metadata/test-resolver-client-information-secret.json");
+
+ @Override
+ protected ClientInformationCredentialResolver constructResolver(final RemoteJwkSetCache cache) {
+ resolver = new ClientInformationCredentialResolver();
+ resolver.setRemoteJwkSetCache(cache);
+ return resolver;
+ }
+
+ @Override
+ protected CriteriaSet buildInitialCriteriaSet() throws Exception {
+ criteria = new CriteriaSet();
+
+ criteria.add(new ClientInformationCriterion(
+ OIDCClientInformation.parse(JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_REMOTE_KEYS)))));
+ return criteria;
+ }
+
+ @Test
+ public void testFail_IncorrectCriteria() throws Exception {
+ ((InitializableComponent) resolver).initialize();
+ // Needs ProviderMetadataCriterion or ClientInformationCriterion
+ criteria = new CriteriaSet();
+ criteria.add(new ProviderMetadataCriterion(Mockito.mock(OIDCProviderMetadata.class)));
+ final Iterable<Credential> creds = resolver.resolve(criteria);
+
+ assertNotNull(creds);
+ final List<Credential> credsList = new ArrayList<>();
+ creds.forEach(credsList::add);
+ // No keys
+ assertEquals(credsList.size(), 0);
+ }
+
+ @Test
+ public void testFail_EmptyCriteria() throws Exception {
+ ((InitializableComponent) resolver).initialize();
+ criteria = new CriteriaSet();
+ final Iterable<Credential> creds = resolver.resolve(criteria);
+
+ assertNotNull(creds);
+ final List<Credential> credsList = new ArrayList<>();
+ creds.forEach(credsList::add);
+ // No keys
+ assertEquals(credsList.size(), 0);
+ }
+
+ @Test
+ public void testSuccess_Secret() throws Exception {
+ ((InitializableComponent) resolver).initialize();
+ criteria = new CriteriaSet();
+
+ criteria.add(new ClientInformationCriterion(
+ OIDCClientInformation.parse(JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_SECRET)))));
+
+ final Iterable<Credential> creds = resolver.resolve(criteria);
+
+ assertNotNull(creds);
+ final List<Credential> credsList = new ArrayList<>();
+ creds.forEach(credsList::add);
+ // No keys
+ assertEquals(credsList.size(), 1);
+
+ }
+
+ @Test
+ public void testSuccess_InlineJwks() throws Exception {
+ ((InitializableComponent) resolver).initialize();
+ criteria = new CriteriaSet();
+ criteria.add(new ClientInformationCriterion(
+ OIDCClientInformation.parse(JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_INLINE_KEYS)))));
+
+ final Iterable<Credential> creds = resolver.resolve(criteria);
+
+ assertNotNull(creds);
+ final List<Credential> credsList = new ArrayList<>();
+ creds.forEach(credsList::add);
+ // No keys
+ assertEquals(credsList.size(), 2);
+ }
+
+ @Test
+ public void testSuccess_InlineJwks_ForKeyAlg() throws Exception {
+ ((InitializableComponent) resolver).initialize();
+ criteria = new CriteriaSet();
+ criteria.add(new ClientInformationCriterion(
+ OIDCClientInformation.parse(JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_INLINE_KEYS)))));
+ criteria.add(new KeyAlgorithmCriterion("RSA"));
+
+ final Iterable<Credential> creds = resolver.resolve(criteria);
+
+ assertNotNull(creds);
+ final List<Credential> credsList = new ArrayList<>();
+ creds.forEach(credsList::add);
+ // No keys
+ assertEquals(credsList.size(), 2);
+ }
+
+ @Test
+ public void testSuccess_InlineJwks_ForKeyAlgNotFound() throws Exception {
+ ((InitializableComponent) resolver).initialize();
+ criteria = new CriteriaSet();
+ criteria.add(new ClientInformationCriterion(
+ OIDCClientInformation.parse(JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_INLINE_KEYS)))));
+ criteria.add(new KeyAlgorithmCriterion("EC"));
+
+ final Iterable<Credential> creds = resolver.resolve(criteria);
+
+ assertNotNull(creds);
+ final List<Credential> credsList = new ArrayList<>();
+ creds.forEach(credsList::add);
+ // No keys
+ assertEquals(credsList.size(), 0);
+ }
+
+ @Test
+ public void testSuccess_InlineJwks_ForEncryptionAndKeyAlg() throws Exception {
+ ((InitializableComponent) resolver).initialize();
+
+ criteria = new CriteriaSet();
+ criteria.add(new ClientInformationCriterion(
+ OIDCClientInformation.parse(JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_INLINE_KEYS)))));
+ criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
+ criteria.add(new KeyAlgorithmCriterion("RSA"));
+
+ final Iterable<Credential> creds = resolver.resolve(criteria);
+
+ assertNotNull(creds);
+ final List<Credential> credsList = new ArrayList<>();
+ creds.forEach(credsList::add);
+ assertEquals(credsList.size(), 1);
+ }
+
+ @Test
+ public void testSuccess_InlineJwks_ForSigning() throws Exception {
+ ((InitializableComponent) resolver).initialize();
+
+ criteria = new CriteriaSet();
+ criteria.add(new ClientInformationCriterion(
+ OIDCClientInformation.parse(JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_INLINE_KEYS)))));
+ criteria.add(new UsageCriterion(UsageType.SIGNING));
+
+ final Iterable<Credential> creds = resolver.resolve(criteria);
+
+ assertNotNull(creds);
+ final List<Credential> credsList = new ArrayList<>();
+ creds.forEach(credsList::add);
+ assertEquals(credsList.size(), 1);
+ }
+
+}
diff --git a/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-inline-jwks.json b/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-inline-jwks.json
new file mode 100644
index 0000000..8bff474
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-inline-jwks.json
@@ -0,0 +1,26 @@
+ {
+ "client_name":"Example valid client information",
+ "scope":"openid phone profile email offline_access",
+ "redirect_uris":["https://localhost:9921/RP/callback"],
+ "client_id":"mymockclient",
+ "response_types":["code"],
+ "grant_types":["authorization_code"],
+ "jwks":{
+ "keys": [
+ {
+ "kty": "RSA",
+ "e": "AQAB",
+ "use": "sig",
+ "kid": "mockRSASig",
+ "n": "t2das2ad4qJFs9irOR6s4xYF6rCGZb1KkTZqu-C0enTFWDr6CZFCN645esS2n20-wbPzMZTcOxFTJN4vRwzEpz2t4DKwNmxMX8CXBmujY0EO-oY9888zoKy4M17KtJuWxcBw3djmcuy3srHsExx3Fj9IsYh2SO8vBBEFsj0MajeYi9xhZJv1pqg3HPrEptclIAEcjuIV2QtwJ3MtSPrmXuLV0WfGbJOVEZNS1JsqYLwMOpgnIBp2P2B_Iba4GwI_9FBpQJ486Szmcnf-8khzJwLmawDvIfrwyEspVF48EHgGLfwLOejAivYJKbEIaUtHDEm8fEx_zUJOp9sk7UvuFw"
+ },
+ {
+ "kty": "RSA",
+ "e": "AQAB",
+ "use": "enc",
+ "kid": "mockRSAEnc",
+ "n": "t2das2ad4qJFs9irOR6s4xYF6rCGZb1KkTZqu-C0enTFWDr6CZFCN645esS2n20-wbPzMZTcOxFTJN4vRwzEpz2t4DKwNmxMX8CXBmujY0EO-oY9888zoKy4M17KtJuWxcBw3djmcuy3srHsExx3Fj9IsYh2SO8vBBEFsj0MajeYi9xhZJv1pqg3HPrEptclIAEcjuIV2QtwJ3MtSPrmXuLV0WfGbJOVEZNS1JsqYLwMOpgnIBp2P2B_Iba4GwI_9FBpQJ486Szmcnf-8khzJwLmawDvIfrwyEspVF48EHgGLfwLOejAivYJKbEIaUtHDEm8fEx_zUJOp9sk7UvuFw"
+ }
+ ]
+ }
+}
diff --git a/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-remote-jwks.json b/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-remote-jwks.json
new file mode 100644
index 0000000..248413e
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-remote-jwks.json
@@ -0,0 +1,9 @@
+ {
+ "client_name":"Example valid client information",
+ "scope":"openid phone profile email offline_access",
+ "redirect_uris":["https://localhost:9921/RP/callback"],
+ "client_id":"mymockclient",
+ "response_types":["code"],
+ "grant_types":["authorization_code"],
+ "jwks_uri":"https://localhost:9921/oauth2/v3/certs"
+}
diff --git a/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-secret.json b/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-secret.json
new file mode 100644
index 0000000..6f9dda1
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/resources/metadata/test-resolver-client-information-secret.json
@@ -0,0 +1,9 @@
+ {
+ "client_name":"Example valid client information",
+ "scope":"openid phone profile email offline_access",
+ "redirect_uris":["https://localhost:9921/RP/callback"],
+ "client_id":"mymockclient",
+ "client_secret":"dFBg7w!z%C*F-JaNdRg34332s5v8fsdf",
+ "response_types":["code"],
+ "grant_types":["authorization_code"]
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClientInformationStringValueLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClientInformationStringValueLookupFunction.java
new file mode 100644
index 0000000..6bd9511
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/ClientInformationStringValueLookupFunction.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Fetches the value for the configured key as {@link String}. May be null if the value is not found or the given
+ * {@link OIDCClientInformation} or its metadata is null.
+ */
+public class ClientInformationStringValueLookupFunction implements Function<OIDCClientInformation, String> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ClientInformationStringValueLookupFunction.class);
+
+ /** The key for which to fetch the value for. */
+ @Nonnull private final String keyName;
+
+ /**
+ * Constructor.
+ *
+ * @param name The key for which to fetch the value for.
+ */
+ public ClientInformationStringValueLookupFunction(@Nonnull final String name) {
+ keyName = Constraint.isNotEmpty(name, "The key name cannot be empty");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public String apply(@Nullable final OIDCClientInformation information) {
+ if (information == null || information.getOIDCMetadata() == null) {
+ log.trace("No client information/metadata available");
+ return null;
+ }
+ final Object value = information.getOIDCMetadata().toJSONObject().get(keyName);
+ if (value == null) {
+ log.trace("No value found for the key {}", keyName);
+ return null;
+ }
+ return String.valueOf(value);
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list