[java-oidc-common] branch main updated: Add login_hint parameter to authn request

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=a1f8c383828323fd35fb77b61c8e70023404b097

The following commit(s) were added to refs/heads/main by this push:
     new a1f8c38  Add login_hint parameter to authn request
a1f8c38 is described below

commit a1f8c383828323fd35fb77b61c8e70023404b097
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Mar 14 15:57:54 2023 +0000

    Add login_hint parameter to authn request
    
     - Add to message encoder
     - Add to profile config
---
 .../config/OIDCAuthorizationConfiguration.java     | 38 ++++++++++++++++++++++
 .../profile/core/OIDCAuthenticationRequest.java    | 28 +++++++++++++++-
 .../encoding/impl/AbstractOIDCMessageEncoder.java  |  5 ++-
 3 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 5f406d3..ab8fbe9 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -132,6 +132,9 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
     
     /** Lookup function to determine the max_age of an authentication request. */
     @Nonnull private Function<ProfileRequestContext,Duration> maxAuthenticationAgeLookupStrategy;
+    
+    /** Lookup function to determine the login_hint of an authentication request.*/
+    @Nonnull private Function<ProfileRequestContext, String> loginHintLookupStrategy;
 
     /**
      * Constructor.
@@ -171,6 +174,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
 
         authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
         maxAuthenticationAgeLookupStrategy = FunctionSupport.constant(null);
+        loginHintLookupStrategy = FunctionSupport.constant(null);
     }
 
     /**
@@ -858,5 +862,39 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
             @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
         maxAuthenticationAgeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
     }
+    
+    /**
+     * Set the lookup strategy for setting the login_hint.
+     * 
+     * @param strategy lookup strategy
+     * 
+     * @since 2.2.0
+     */
+    public void setLoginHintLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
+        loginHintLookupStrategy = Constraint.isNotNull(loginHintLookupStrategy, "Login Hint strategy can not be null");
+    }
+    
+    /**
+     * Set a fixed login_hint. Will apply to all requests.
+     * 
+     * @param fixedLoginHint the login_hint
+     * 
+     * @since 2.2.0
+     */
+    public void setLoginHint(final String fixedLoginHint) {
+        Constraint.isNotEmpty(fixedLoginHint, "Fixed login hint can not be null or empty");
+        loginHintLookupStrategy = FunctionSupport.constant(fixedLoginHint);
+    }
+    
+    /**
+     * Get the login_hint to use.
+     * 
+     * @param profileRequestContext profile request context
+     *  
+     * @return the login_hint to use
+     */
+    @Nullable public String getLoginHint(@Nullable final ProfileRequestContext profileRequestContext) {
+        return loginHintLookupStrategy.apply(profileRequestContext);
+    }
 
 }
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
index 141aecd..a6995a5 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -56,6 +56,9 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
     /** Does the OpenID Provider support the claims parameter? Typically taken from its metadata.*/
     private boolean providerSupportsClaimsParameter;
     
+    /** Hint to the Authorization Server about the login identifier the End-User might use to log in.*/
+    @Nullable private String loginHint;
+    
     /**
      * 
      * Constructor.
@@ -174,7 +177,30 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
      */
     public void setProviderSupportsClaimsParameter(final boolean flag) {
         providerSupportsClaimsParameter = flag;
-    }    
+    }
+
+    /**
+     * Sets the login_hint authorisation request parameter.
+     * 
+     * @param hint the login hint
+     * 
+     * @since 2.2.0
+     */
+    public void setLoginHint(final String hint) {
+        loginHint = hint;
+        
+    } 
+    
+    /**
+     * Get the login_hint parameter.
+     * 
+     * @return the login_hint parameter
+     * 
+     * @since 2.2.0
+     */
+    @Nullable public String getLoginHint() {
+        return loginHint;
+    }
     
     
     //TODO others relating to sections 5.2, 5.5, 6, and 7.2.1
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
index 3bb68f8..397057e 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
@@ -221,6 +221,9 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
         if (req.getMaxAge() != null && req.getMaxAge().toSeconds() > 0) {          
             params.add(new Pair<>("max_age", Long.toString(req.getMaxAge().toSeconds())));          
         }
+        if (req.getLoginHint() != null) {          
+            params.add(new Pair<>("login_hint", req.getLoginHint()));          
+        }
         
         if (req.providerSupportsClaimsParameter()) {
             // Add ACRs to claims if any before the claims are serialised
@@ -237,7 +240,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
                     .collect(Collectors.toUnmodifiableList()));
             params.add(new Pair<>("acr_values", acrString));          
         }
-        //TODO: requestURI, includedGrantedScopes?, resource_uris, max_age?
+        //TODO: requestURI, includedGrantedScopes?, resource_uris?
         
         if (!validateParams(params)) {            
             throw new MessageEncodingException("Authorization parameters are not valid");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.