[java-idp-plugin-oidc-rp] branch main updated: Add UserInfo HTTP request method lookup strategy
Phil Smart
philip.smart at jisc.ac.uk
Wed Mar 15 15:15:07 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=21b7d8380f04d05681c080ff629e41261333bc0d
The following commit(s) were added to refs/heads/main by this push:
new 21b7d83 Add UserInfo HTTP request method lookup strategy
21b7d83 is described below
commit 21b7d8380f04d05681c080ff629e41261333bc0d
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Mar 15 15:15:00 2023 +0000
Add UserInfo HTTP request method lookup strategy
- Pulling in the configuration item from the profile config
---
.../UserInfoHttpRequestMethodLookupStrategy.java | 48 ++++++++++++++++++++++
.../impl/DefaultUserInfoRequestEncoder.java | 16 ++++----
.../authn/oidc/rp/conf/authn/oidc-rp.properties | 1 +
3 files changed, 58 insertions(+), 7 deletions(-)
diff --git a/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoHttpRequestMethodLookupStrategy.java b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoHttpRequestMethodLookupStrategy.java
new file mode 100644
index 0000000..f91ca83
--- /dev/null
+++ b/idp-oidc-rp-api/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/config/navigate/UserInfoHttpRequestMethodLookupStrategy.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
+
+/**
+ * Locate the HTTP request method to use for the UserInfo request. Returns {@link OIDCHttpRequestMethod#GET} if not
+ * found on the profile configuration.
+ */
+public class UserInfoHttpRequestMethodLookupStrategy extends AbstractRelyingPartyLookupFunction<OIDCHttpRequestMethod> {
+
+ @Override
+ @Nullable public OIDCHttpRequestMethod apply(final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OIDCAuthorizationConfiguration){
+ return ((OIDCAuthorizationConfiguration)pc).getUserInfoHttpRequestMethod(input);
+ }
+ }
+ return OIDCHttpRequestMethod.GET;
+ }
+
+}
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java
index 3287e2d..5acc369 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/encoding/impl/DefaultUserInfoRequestEncoder.java
@@ -37,7 +37,9 @@ import com.nimbusds.jose.util.StandardCharset;
import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
import net.shibboleth.idp.plugin.authn.oidc.rp.OIDCRPException;
+import net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.UserInfoHttpRequestMethodLookupStrategy;
import net.shibboleth.idp.plugin.authn.oidc.rp.context.AccessTokenResponseContext;
+import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -58,8 +60,8 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
@Nonnull private Function<ProfileRequestContext, AccessTokenResponseContext>
tokenResponseContextLookupStrategy;
- /** Strategy used to look up the {@link HttpMethod} used for this request. Defaults to GET.*/
- @Nonnull private Function<ProfileRequestContext, HttpMethod> httpMethodLookupStrategy;
+ /** Strategy used to look up the {@link HttpMethod} used for this request.*/
+ @Nonnull private Function<ProfileRequestContext, OIDCHttpRequestMethod> httpMethodLookupStrategy;
/** Constructor.*/
public DefaultUserInfoRequestEncoder() {
@@ -67,7 +69,7 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
new ChildContextLookup<>(AccessTokenResponseContext.class, true).compose(
new InboundMessageContextLookup());
- httpMethodLookupStrategy = prc -> HttpMethod.GET;
+ httpMethodLookupStrategy = new UserInfoHttpRequestMethodLookupStrategy();
}
/**
@@ -89,7 +91,7 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
*
* @param strategy the strategy
*/
- public void setHttpMethodLookupStrategy(final Function<ProfileRequestContext, HttpMethod> strategy) {
+ public void setHttpMethodLookupStrategy(final Function<ProfileRequestContext, OIDCHttpRequestMethod> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
@@ -102,7 +104,7 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
public HttpUriRequest doApply(@Nonnull final ProfileRequestContext profileRequestContext) {
try {
- final HttpMethod requestMethod = httpMethodLookupStrategy.apply(profileRequestContext);
+ final OIDCHttpRequestMethod requestMethod = httpMethodLookupStrategy.apply(profileRequestContext);
final AccessTokenResponseContext responseCtx =
tokenResponseContextLookupStrategy.apply(profileRequestContext);
@@ -123,13 +125,13 @@ public class DefaultUserInfoRequestEncoder extends AbstractRequestEncoderFunctio
// Add headers and create request.
RequestBuilder rb = null;
- if (requestMethod == HttpMethod.GET) {
+ if (requestMethod == OIDCHttpRequestMethod.GET) {
rb = RequestBuilder.get().setUri(uri)
.setHeader("Content-Type", ContentType.APPLICATION_FORM_URLENCODED.getMimeType())
.setCharset(StandardCharset.UTF_8);
addBearerTokenToGet(rb, responseCtx);
- } else if (requestMethod == HttpMethod.POST) {
+ } else if (requestMethod == OIDCHttpRequestMethod.POST) {
rb = RequestBuilder.post().setUri(uri)
.setHeader("Content-Type", ContentType.APPLICATION_FORM_URLENCODED.getMimeType())
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
index 431bdf3..2db786d 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
@@ -16,6 +16,7 @@ idp.authn.oidc.rp.client.redirecturl.allowedOrigins = https://localhost:8443
#idp.authn.oidc.rp.client.idtoken.tlsServerValidationOnly = false
#idp.authn.oidc.rp.client.userinfo.enabled = true
+#idp.authn.oidc.rp.client.userinfo.httpRequestMethod = GET
## Should validation be skipped if the at_hash is not present in the id_token response. Defaults to 'true' as
## access token at_hash validation is optional in the Authorization Code Flow.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list