[java-oidc-common] branch main updated: Change at_hash validator to use AccessToken response type
Phil Smart
philip.smart at jisc.ac.uk
Mon Mar 13 15:47:57 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=e598392db03fb38410f4028fadfabb0df391807f
The following commit(s) were added to refs/heads/main by this push:
new e598392 Change at_hash validator to use AccessToken response type
e598392 is described below
commit e598392db03fb38410f4028fadfabb0df391807f
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Mar 13 15:47:54 2023 +0000
Change at_hash validator to use AccessToken response type
---
.../ClientSecretCriterionCredentialResolver.java | 3 +-
.../jwt/claims/impl/AccessTokenHashValidator.java | 33 +++++++++-------------
.../claims/impl/AccessTokenHashValidatorTest.java | 15 +++++-----
3 files changed, 24 insertions(+), 27 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java
index 7088525..041b601 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java
@@ -52,7 +52,8 @@ public class ClientSecretCriterionCredentialResolver extends BasicJOSEObjectCred
Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
if (criteriaSet.contains(ClientSecretCredentialCriterion.class)) {
- final ClientSecretCredentialCriterion credentialCriterion = criteriaSet.get(ClientSecretCredentialCriterion.class);
+ final ClientSecretCredentialCriterion credentialCriterion =
+ criteriaSet.get(ClientSecretCredentialCriterion.class);
final ClientSecretCredential secretCred = credentialCriterion.getCredential();
log.trace("Found client secret credential");
final Credential derivedCredential = deriveClientSecretCredential(secretCred, criteriaSet);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java
index d286ad3..48b6a48 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java
@@ -17,7 +17,6 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
-import java.util.Map;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -28,13 +27,11 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.token.AccessToken;
import com.nimbusds.openid.connect.sdk.claims.AccessTokenHash;
import com.nimbusds.openid.connect.sdk.validators.AccessTokenValidator;
import com.nimbusds.openid.connect.sdk.validators.InvalidHashException;
-import net.minidev.json.JSONObject;
import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
@@ -46,16 +43,16 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
* A validator that checks the access_token value matches its encoded at_hash representation in the
* id_token.
- *
- * <p>Is essentially a facade to the Nimbus {@link AccessTokenValidator}.</p>
+ *
+ * @since 2.2.0
*/
public class AccessTokenHashValidator extends AbstractClaimsValidator {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(AccessTokenHashValidator.class);
- /** Strategy to find the token response JSON object.*/
- @NonnullAfterInit private Function<ProfileRequestContext, Map<String, Object>> tokenResponseLookupStrategy;
+ /** Strategy to find the access_token.*/
+ @NonnullAfterInit private Function<ProfileRequestContext, AccessToken> accessTokenLookupStrategy;
/** Strategy to find the JOSE headers relating to the id_token the at_hash is taken from.*/
@NonnullAfterInit private Function<ProfileRequestContext, JWSHeader> joseHeaderLookupStrategy;
@@ -76,17 +73,16 @@ public class AccessTokenHashValidator extends AbstractClaimsValidator {
/**
- * Set the lookup strategy used to locate the token response JSON object that contains the
- * access_token.
+ * Set the lookup strategy used to locate the access_token.
*
* @param strategy the strategy.
*/
- public void setTokenResponseLookupStrategy(final Function<ProfileRequestContext, Map<String, Object>> strategy) {
+ public void setAccessTokenLookupStrategy(final Function<ProfileRequestContext, AccessToken> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
- tokenResponseLookupStrategy = Constraint.isNotNull(strategy,
- "Token Response Lookup Strategy can not be null");
+ accessTokenLookupStrategy = Constraint.isNotNull(strategy,
+ "Access Token Lookup Strategy can not be null");
}
/**
@@ -106,7 +102,7 @@ public class AccessTokenHashValidator extends AbstractClaimsValidator {
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
- if (tokenResponseLookupStrategy == null) {
+ if (accessTokenLookupStrategy == null) {
throw new ComponentInitializationException("Token lookup strategy can not be null");
}
if (joseHeaderLookupStrategy == null) {
@@ -130,20 +126,19 @@ public class AccessTokenHashValidator extends AbstractClaimsValidator {
}
}
- final Map<String, Object> tokenResponse = tokenResponseLookupStrategy.apply(context);
- if (tokenResponse == null) {
- throw new JWTValidationException("Token response was not found, cannot validate 'at_hash' claim");
+ final AccessToken accessToken = accessTokenLookupStrategy.apply(context);
+ if (accessToken == null) {
+ throw new JWTValidationException("Access Tokene was not found, cannot validate 'at_hash' claim");
}
final JWSHeader joseHeader = joseHeaderLookupStrategy.apply(context);
if (joseHeader == null) {
throw new JWTValidationException("JWS Header from id_token not found, cannot validate 'at_hash' claim");
}
-
- final AccessToken accessToken = AccessToken.parse(new JSONObject(tokenResponse));
+
AccessTokenValidator.validate(accessToken, joseHeader.getAlgorithm(), new AccessTokenHash(atHashClaim));
- } catch (final InvalidHashException | ParseException | java.text.ParseException e) {
+ } catch (final InvalidHashException | java.text.ParseException e) {
throw new JWTValidationException(e);
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidatorTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidatorTest.java
index 149acb6..4a15855 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidatorTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidatorTest.java
@@ -29,6 +29,7 @@ import org.testng.annotations.Test;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -60,7 +61,7 @@ public class AccessTokenHashValidatorTest extends AbstractClaimsValidatorTest {
return null;
}
});
- validator.setTokenResponseLookupStrategy(prc -> Map.of("access_token", "token", "token_type","Bearer"));
+ validator.setAccessTokenLookupStrategy(prc -> new BearerAccessToken("token"));
validator.initialize();
validator.validate(claimsSet, prc);
@@ -78,8 +79,8 @@ public class AccessTokenHashValidatorTest extends AbstractClaimsValidatorTest {
return null;
}
});
- validator.setTokenResponseLookupStrategy(prc ->
- Map.of("access_token", "jHkWEdUXMU1BwAsC4vtUsZwnNvTIxEl0z9K3vx5KF0Y", "token_type","Bearer"));
+ validator.setAccessTokenLookupStrategy(prc ->
+ new BearerAccessToken("jHkWEdUXMU1BwAsC4vtUsZwnNvTIxEl0z9K3vx5KF0Y"));
validator.initialize();
validator.validate(claimsSet, prc);
@@ -97,7 +98,7 @@ public class AccessTokenHashValidatorTest extends AbstractClaimsValidatorTest {
return null;
}
});
- validator.setTokenResponseLookupStrategy(prc -> null);
+ validator.setAccessTokenLookupStrategy(prc -> null);
validator.initialize();
validator.validate(claimsSet, prc);
@@ -108,7 +109,7 @@ public class AccessTokenHashValidatorTest extends AbstractClaimsValidatorTest {
final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().claim("at_hash", "bad-at-hash").build();
validator.setJoseHeaderLookupStrategy(prc -> null);
- validator.setTokenResponseLookupStrategy(prc -> Map.of("access_token", "token", "token_type","Bearer"));
+ validator.setAccessTokenLookupStrategy(prc -> new BearerAccessToken("token"));
validator.initialize();
validator.validate(claimsSet, prc);
@@ -126,7 +127,7 @@ public class AccessTokenHashValidatorTest extends AbstractClaimsValidatorTest {
return null;
}
});
- validator.setTokenResponseLookupStrategy(prc -> Map.of("access_token", "token", "token_type","Bearer"));
+ validator.setAccessTokenLookupStrategy(prc ->new BearerAccessToken("token"));
validator.initialize();
validator.validate(claimsSet, prc);
@@ -144,7 +145,7 @@ public class AccessTokenHashValidatorTest extends AbstractClaimsValidatorTest {
return null;
}
});
- validator.setTokenResponseLookupStrategy(prc -> Map.of("access_token", "token", "token_type","Bearer"));
+ validator.setAccessTokenLookupStrategy(prc -> new BearerAccessToken("token"));
validator.initialize();
validator.validate(claimsSet, prc);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list