[java-oidc-common] branch main updated: JCOMOIDC-60 - JWT class naming convention
Phil Smart
philip.smart at jisc.ac.uk
Mon Jan 16 16:00:00 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=013e9f90a1fe5e1cdb62f3ae5ec54e6edb413c0b
The following commit(s) were added to refs/heads/main by this push:
new 013e9f9 JCOMOIDC-60 - JWT class naming convention
013e9f9 is described below
commit 013e9f90a1fe5e1cdb62f3ae5ec54e6edb413c0b
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jan 16 15:59:52 2023 +0000
JCOMOIDC-60 - JWT class naming convention
- Move JWE decryption action into commons
https://shibboleth.atlassian.net/browse/JCOMOIDC-60
---
.../shibboleth/oidc/security/impl/DecryptJWE.java | 196 +++++++++++++++++++++
1 file changed, 196 insertions(+)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DecryptJWE.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DecryptJWE.java
new file mode 100644
index 0000000..86d0ee3
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DecryptJWE.java
@@ -0,0 +1,196 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+import java.text.ParseException;
+import java.util.function.BiConsumer;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
+import org.opensaml.xmlsec.encryption.support.DecryptionException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.EncryptedJWT;
+import com.nimbusds.jwt.JWT;
+
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.oidc.security.jose.DecryptionParameters;
+import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Decrypt the located JWE using the decryption parameters stored in the security context.
+ *
+ * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_SEC_CFG}
+ * @event {@link OidcEventIds#INVALID_ID_TOKEN}
+ * @post Decrypt a JWT and add it back to via an update strategy.
+ */
+public class DecryptJWE extends AbstractProfileAction {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(DecryptJWE.class);
+
+ /** Function that looks up a signed JWT token from the given message context to validate.*/
+ @NonnullAfterInit private Function<ProfileRequestContext, EncryptedJWT> jwtTokenLookupStrategy;
+
+ /**
+ * A consumer that sets the JWT produced from this decryption operation back into the profile request context.
+ */
+ @NonnullAfterInit private BiConsumer<ProfileRequestContext, JWT> jwtUpdateStrategy;
+
+ /** The extracted encrypted JWT that is to be validated.*/
+ @Nullable private EncryptedJWT encryptedJwt;
+
+ /** The decryption object. */
+ @Nullable private OIDCTokenDecrypter decrypter;
+
+ /** Strategy used to locate the {@link SecurityParametersContext}. */
+ @Nonnull private Function<ProfileRequestContext, SecurityParametersContext> securityParamsLookupStrategy;
+
+ /** Constructor.*/
+ public DecryptJWE() {
+ securityParamsLookupStrategy =
+ new ChildContextLookup<>(SecurityParametersContext.class).compose(
+ new InboundMessageContextLookup());
+ }
+
+ /**
+ * Set the strategy used to locate the {@link SecurityParametersContext} associated with a given
+ * {@link ProfileRequestContext}.
+ *
+ * @param strategy strategy used to locate the {@link SecurityParametersContext} associated with a given
+ * {@link ProfileRequestContext}
+ */
+ public void setSecurityParametersContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, SecurityParametersContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ securityParamsLookupStrategy =
+ Constraint.isNotNull(strategy, "SecurityParametersContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the strategy used to update the profile request context with the JWT produced as a result
+ * of this decryption operation.
+ *
+ * @param strategy the strategy
+ */
+ public void setJwtUpdateStrategy(@Nonnull final BiConsumer<ProfileRequestContext, JWT> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ jwtUpdateStrategy = Constraint.isNotNull(strategy, "JWT update stategy can not be null");
+ }
+
+ /**
+ * Set the strategy used to look up a {@link EncryptedJWT encrypted JWT token}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setJwtTokenLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, EncryptedJWT> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ jwtTokenLookupStrategy = Constraint.isNotNull(strategy,
+ "JwtToken lookup strategy cannot be null");
+ }
+
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (jwtTokenLookupStrategy == null) {
+ throw new ComponentInitializationException("JWTTokenLookupStrategy cannot be null");
+ }
+ if (jwtUpdateStrategy == null) {
+ throw new ComponentInitializationException("JWTUpdateStrategy cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (!super.doPreExecute(profileRequestContext)) {
+ return false;
+ }
+
+ encryptedJwt = jwtTokenLookupStrategy.apply(profileRequestContext);
+ if (encryptedJwt == null) {
+ log.debug("{} JWT was not encrypted, nothing to decrypt",
+ getLogPrefix());
+ return false;
+ }
+
+ final SecurityParametersContext paramsCtx = securityParamsLookupStrategy.apply(profileRequestContext);
+ if (paramsCtx == null || paramsCtx.getDecryptionParameters() == null) {
+ log.debug("{} No security parameter context or decryption parameters", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
+ return false;
+ } else {
+ final DecryptionParameters params = paramsCtx.getDecryptionParameters();
+ decrypter = new OIDCTokenDecrypter(params);
+ }
+
+
+ return true;
+ }
+
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ log.debug("{} Decrypting encrypted JWT", getLogPrefix());
+ try {
+ final JWT decryptedJWT = decrypter.decrypt(encryptedJwt);
+ log.debug("{} JWT decrypted successfully", getLogPrefix());
+ if (log.isTraceEnabled()) {
+ logJWT(decryptedJWT);
+ }
+ jwtUpdateStrategy.accept(profileRequestContext, decryptedJWT);
+ } catch (final DecryptionException e) {
+ log.error("{} Unable to decrypt JWT", getLogPrefix(), e);
+ ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ID_TOKEN);
+ return;
+ }
+ }
+
+ /**
+ * Log (on trace) the JWT.
+ *
+ * @param jwt the JWT to log.
+ */
+ private void logJWT(@Nonnull final JWT jwt) {
+ try {
+ log.trace("{} Decrypted JWT: {}", getLogPrefix(), jwt.getJWTClaimsSet().toString());
+ } catch (final IllegalStateException | ParseException e) {
+ log.trace("{} Unable to print decrypted JWT: {}", getLogPrefix(), e.getMessage());
+ }
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list