[java-oidc-common] branch main updated: Refactored the JWT security configuration lookup functions.
Henri Mikkonen
henri.mikkonen at iki.fi
Mon Jun 26 12:15:16 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=b5e74d0a685fa1cbb00b7486ad4b72f706de6089
The following commit(s) were added to refs/heads/main by this push:
new b5e74d0 Refactored the JWT security configuration lookup functions.
b5e74d0 is described below
commit b5e74d0a685fa1cbb00b7486ad4b72f706de6089
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Jun 26 15:11:49 2023 +0300
Refactored the JWT security configuration lookup functions.
The first iteration for V5-compatibility was not right: now the function
structure should correspond to the functions that nowadays exist in the
net.shibboleth.profile.config.navigate -package. (Previously in idp.profile).
The property for rpResolver was removed: as it's not used anymore.
---
.../JWTDecryptionConfigurationLookupFunction.java | 43 +++++----------------
.../JWTEncryptionConfigurationLookupFunction.java | 39 +++++--------------
...ignatureSigningConfigurationLookupFunction.java | 40 ++++++-------------
...atureValidationConfigurationLookupFunction.java | 45 ++++++----------------
4 files changed, 43 insertions(+), 124 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTDecryptionConfigurationLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTDecryptionConfigurationLookupFunction.java
index 460a60c..2ddcb98 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTDecryptionConfigurationLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTDecryptionConfigurationLookupFunction.java
@@ -28,7 +28,7 @@ import org.opensaml.security.config.SecurityConfiguration;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.config.navigate.AbstractDefaultSecurityConfigurationLookupFunction;
import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
import net.shibboleth.oidc.security.jose.DecryptionConfiguration;
@@ -45,22 +45,8 @@ import net.shibboleth.oidc.security.jose.DecryptionConfiguration;
public class JWTDecryptionConfigurationLookupFunction
extends AbstractDefaultSecurityConfigurationLookupFunction<List<DecryptionConfiguration>> {
- /** A resolver for default security configurations. */
- @Nullable
- private RelyingPartyConfigurationResolver rpResolver;
-
- /**
- * Set the resolver for default security configurations.
- *
- * @param resolver the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
- rpResolver = resolver;
- }
-
/** {@inheritDoc} */
- @Override
- @Nullable
+ @Nullable @Live
public List<DecryptionConfiguration> apply(@Nullable final ProfileRequestContext input) {
final List<DecryptionConfiguration> configs = new ArrayList<>();
@@ -68,28 +54,19 @@ public class JWTDecryptionConfigurationLookupFunction
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null &&
- pc.getSecurityConfiguration(input)
- instanceof JSONSecurityConfiguration
- && ((JSONSecurityConfiguration) pc.getSecurityConfiguration(
- input))
- .getJwtDecryptionConfiguration() != null) {
- configs.add(((JSONSecurityConfiguration) pc.getSecurityConfiguration(
- input))
- .getJwtDecryptionConfiguration());
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc instanceof JSONSecurityConfiguration jsc && jsc.getJwtDecryptionConfiguration() != null) {
+ configs.add(jsc.getJwtDecryptionConfiguration());
+ }
}
- }
- // Check for a per-profile default (relying party independent) config.
- if (input != null && rpResolver != null) {
final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
- if (defaultConfig instanceof JSONSecurityConfiguration
- && ((JSONSecurityConfiguration) defaultConfig)
- .getJwtDecryptionConfiguration() != null) {
- configs.add(
- ((JSONSecurityConfiguration) defaultConfig).getJwtDecryptionConfiguration());
+ if (defaultConfig instanceof JSONSecurityConfiguration jsc && jsc.getJwtDecryptionConfiguration() != null) {
+ configs.add(jsc.getJwtDecryptionConfiguration());
}
}
+
// TODO: Support for Global Default configuration?
return configs;
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTEncryptionConfigurationLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTEncryptionConfigurationLookupFunction.java
index 53fe7be..762a016 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTEncryptionConfigurationLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTEncryptionConfigurationLookupFunction.java
@@ -28,7 +28,7 @@ import org.opensaml.security.config.SecurityConfiguration;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.config.navigate.AbstractDefaultSecurityConfigurationLookupFunction;
import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
import net.shibboleth.oidc.security.jose.EncryptionConfiguration;
@@ -45,22 +45,8 @@ import net.shibboleth.oidc.security.jose.EncryptionConfiguration;
public class JWTEncryptionConfigurationLookupFunction
extends AbstractDefaultSecurityConfigurationLookupFunction<List<EncryptionConfiguration>> {
- /** A resolver for default security configurations. */
- @Nullable
- private RelyingPartyConfigurationResolver rpResolver;
-
- /**
- * Set the resolver for default security configurations.
- *
- * @param resolver the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
- rpResolver = resolver;
- }
-
/** {@inheritDoc} */
- @Override
- @Nullable
+ @Nullable @Live
public List<EncryptionConfiguration> apply(@Nullable final ProfileRequestContext input) {
final List<EncryptionConfiguration> configs = new ArrayList<>();
@@ -68,24 +54,19 @@ public class JWTEncryptionConfigurationLookupFunction
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc.getSecurityConfiguration(input) instanceof JSONSecurityConfiguration
- && ((JSONSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getJwtEncryptionConfiguration() != null) {
- configs.add(((JSONSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getJwtEncryptionConfiguration());
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc instanceof JSONSecurityConfiguration jsc && jsc.getJwtEncryptionConfiguration() != null) {
+ configs.add(jsc.getJwtEncryptionConfiguration());
+ }
}
- }
- // Check for a per-profile default (relying party independent) config.
- if (input != null && rpResolver != null) {
final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
- if (defaultConfig instanceof JSONSecurityConfiguration
- && ((JSONSecurityConfiguration) defaultConfig)
- .getJwtEncryptionConfiguration() != null) {
- configs.add(
- ((JSONSecurityConfiguration) defaultConfig).getJwtEncryptionConfiguration());
+ if (defaultConfig instanceof JSONSecurityConfiguration jsc && jsc.getJwtEncryptionConfiguration() != null) {
+ configs.add(jsc.getJwtEncryptionConfiguration());
}
}
+
// TODO: Support for Global Default configuration?
return configs;
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureSigningConfigurationLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureSigningConfigurationLookupFunction.java
index bf0bfd2..493c098 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureSigningConfigurationLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureSigningConfigurationLookupFunction.java
@@ -28,7 +28,7 @@ import org.opensaml.security.config.SecurityConfiguration;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.config.navigate.AbstractDefaultSecurityConfigurationLookupFunction;
import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
@@ -45,22 +45,8 @@ import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
public class JWTSignatureSigningConfigurationLookupFunction
extends AbstractDefaultSecurityConfigurationLookupFunction<List<SignatureSigningConfiguration>> {
- /** A resolver for default security configurations. */
- @Nullable
- private RelyingPartyConfigurationResolver rpResolver;
-
- /**
- * Set the resolver for default security configurations.
- *
- * @param resolver the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
- rpResolver = resolver;
- }
-
/** {@inheritDoc} */
- @Override
- @Nullable
+ @Nullable @Live
public List<SignatureSigningConfiguration> apply(@Nullable final ProfileRequestContext input) {
final List<SignatureSigningConfiguration> configs = new ArrayList<>();
@@ -68,24 +54,20 @@ public class JWTSignatureSigningConfigurationLookupFunction
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc.getSecurityConfiguration(input) instanceof JSONSecurityConfiguration
- && ((JSONSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getJwtSignatureSigningConfiguration() != null) {
- configs.add(((JSONSecurityConfiguration) pc.getSecurityConfiguration(input))
- .getJwtSignatureSigningConfiguration());
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc instanceof JSONSecurityConfiguration jsc && jsc.getJwtSignatureSigningConfiguration() != null) {
+ configs.add(jsc.getJwtSignatureSigningConfiguration());
+ }
}
- }
- // Check for a per-profile default (relying party independent) config.
- if (input != null && rpResolver != null) {
final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
- if (defaultConfig instanceof JSONSecurityConfiguration
- && ((JSONSecurityConfiguration) defaultConfig)
- .getJwtSignatureSigningConfiguration() != null) {
- configs.add(
- ((JSONSecurityConfiguration) defaultConfig).getJwtSignatureSigningConfiguration());
+ if (defaultConfig instanceof JSONSecurityConfiguration jsc &&
+ jsc.getJwtSignatureSigningConfiguration() != null) {
+ configs.add(jsc.getJwtSignatureSigningConfiguration());
}
}
+
// TODO: Support for Global Default configuration?
return configs;
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureValidationConfigurationLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureValidationConfigurationLookupFunction.java
index 338f279..ffb17db 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureValidationConfigurationLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/JWTSignatureValidationConfigurationLookupFunction.java
@@ -28,7 +28,7 @@ import org.opensaml.security.config.SecurityConfiguration;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.config.navigate.AbstractDefaultSecurityConfigurationLookupFunction;
import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
@@ -45,22 +45,8 @@ import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
public class JWTSignatureValidationConfigurationLookupFunction
extends AbstractDefaultSecurityConfigurationLookupFunction<List<SignatureValidationConfiguration>> {
- /** A resolver for default security configurations. */
- @Nullable
- private RelyingPartyConfigurationResolver rpResolver;
-
- /**
- * Set the resolver for default security configurations.
- *
- * @param resolver the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(@Nullable final RelyingPartyConfigurationResolver resolver) {
- rpResolver = resolver;
- }
-
/** {@inheritDoc} */
- @Override
- @Nullable
+ @Nullable @Live
public List<SignatureValidationConfiguration> apply(@Nullable final ProfileRequestContext input) {
final List<SignatureValidationConfiguration> configs = new ArrayList<>();
@@ -68,28 +54,21 @@ public class JWTSignatureValidationConfigurationLookupFunction
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null &&
- pc.getSecurityConfiguration(input)
- instanceof JSONSecurityConfiguration
- && ((JSONSecurityConfiguration) pc.getSecurityConfiguration(
- input))
- .getJwtSignatureValidationConfiguration() != null) {
- configs.add(((JSONSecurityConfiguration) pc.getSecurityConfiguration(
- input))
- .getJwtSignatureValidationConfiguration());
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc instanceof JSONSecurityConfiguration jsc &&
+ jsc.getJwtSignatureValidationConfiguration() != null) {
+ configs.add(jsc.getJwtSignatureValidationConfiguration());
+ }
}
- }
- // Check for a per-profile default (relying party independent) config.
- if (input != null && rpResolver != null) {
final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
- if (defaultConfig instanceof JSONSecurityConfiguration
- && ((JSONSecurityConfiguration) defaultConfig)
- .getJwtSignatureValidationConfiguration() != null) {
- configs.add(
- ((JSONSecurityConfiguration) defaultConfig).getJwtSignatureValidationConfiguration());
+ if (defaultConfig instanceof JSONSecurityConfiguration jsc &&
+ jsc.getJwtSignatureValidationConfiguration() != null) {
+ configs.add(jsc.getJwtSignatureValidationConfiguration());
}
}
+
// TODO: Support for Global Default configuration?
return configs;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list