[java-oidc-common] 01/01: Add profile interfaces. Incorrect for now, WIP.
Phil Smart
philip.smart at jisc.ac.uk
Fri Mar 17 08:42:09 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-66
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=731f054eb89a50069c8294aeae08c413b28ee609
commit 731f054eb89a50069c8294aeae08c413b28ee609
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Mar 17 08:39:00 2023 +0000
Add profile interfaces. Incorrect for now, WIP.
---
.../config/AbstractOIDCSSOConfiguration.java | 125 ++---------
.../config/OIDCAuthenticationConfiguration.java | 119 ++++++++++
.../OIDCAuthenticationProviderConfiguration.java | 125 +++++++++++
...IDCAuthenticationRelyingPartyConfiguration.java | 90 ++++++++
...thenticationRelyingPartyProxyConfiguration.java | 53 +++++
.../config/OIDCAuthorizationConfiguration.java | 243 +++------------------
.../profile/config/OIDCProfileConfiguration.java | 30 ---
.../OIDCProviderInformationConfiguration.java | 3 +-
.../config/OIDCPublishKeySetConfiguration.java | 3 +-
.../oidc/profile/encoding/OIDCMessageEncoder.java | 4 +-
...th2ClientAuthenticableProfileConfiguration.java | 44 +---
...bstractOAuth2FlowAwareProfileConfiguration.java | 32 +--
.../OAuth2AuthorizationClientConfiguration.java | 73 +++++++
.../config/OAuth2AuthorizationConfiguration.java | 153 +++++++++++++
.../OAuth2AuthorizationServerConfiguration.java | 138 ++++++++++++
.../oauth2/config/OAuth2ProfileConfiguration.java | 27 ---
.../config/OAuth2TokenAudienceConfiguration.java | 2 +-
.../encoding/impl/HTTPPostAuthnRequestEncoder.java | 6 +-
.../impl/HTTPRedirectAuthnRequestEncoder.java | 6 +-
...AuthenticationRequestMessageEncoderFactory.java | 4 +-
...enticationRequestMessageEncoderFactoryTest.java | 20 +-
21 files changed, 834 insertions(+), 466 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index 93615f8..8e00b2b 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -49,7 +49,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.
*/
public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
- implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration,
+ implements AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration,
AttributeResolvingProfileConfiguration {
/** OIDC base protocol URI. */
@@ -73,7 +73,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** Lookup function to supply ID token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> idTokenLifetimeLookupStrategy;
- /** Lookup functioon to supply access token type. */
+ /** Lookup function to supply access token type. */
@Nonnull private Function<ProfileRequestContext,String> accessTokenTypeLookupStrategy;
/** Lookup function to supply access token lifetime. */
@@ -177,13 +177,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
}
- /**
- * Get whether encryption is optional in the face of a missing key, etc.
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff encryption is optional
- */
+ @Override
public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptionOptionalPredicate.test(profileRequestContext);
}
@@ -206,13 +200,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
}
- /**
- * Get whether client is required to use PKCE.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is required to use PKCE
- */
+ @Override
public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
return forcePKCEPredicate.test(profileRequestContext);
}
@@ -235,13 +223,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Get whether client is allowed to use PKCE code challenge method plain.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is allowed to use PKCE code challenge method plain
- */
+ @Override
public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
return allowPKCEPlainPredicate.test(profileRequestContext);
}
@@ -264,17 +246,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
-
- /**
- * Get ID token lifetime.
- *
- * <p>Defaults to 1 hour.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return ID token lifetime
- */
+ @Override
@Positive @Nonnull public Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = idTokenLifetimeLookupStrategy.apply(profileRequestContext);
@@ -304,17 +276,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
public void setIDTokenLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
idTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
-
- /**
- * Get access token type.
- *
- * @param profileRequestContext profile request context
- *
- * @return access token type, or null for unspecified/opaque
- *
- * @since 2.1.0
- */
- @Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
+
+ @Override
+ @Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
return accessTokenTypeLookupStrategy.apply(profileRequestContext);
}
@@ -340,15 +304,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get access token lifetime.
- *
- * <p>Defaults to 10 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return access token lifetime
- */
+ @Override
@Positive @Nonnull
public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = accessTokenLifetimeLookupStrategy.apply(profileRequestContext);
@@ -380,15 +336,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get refresh token lifetime.
- *
- * <p>Defaults to 2 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return refresh token lifetime
- */
+ @Override
@Nonnull @Positive
public Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = refreshTokenLifetimeLookupStrategy.apply(profileRequestContext);
@@ -420,14 +368,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
refreshTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
- * which the token may be shared.
- *
- * @param profileRequestContext profile request context
- *
- * @return the additional audiences
- */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -465,17 +406,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the set of attribute IDs which should be included in the ID token regardless of response_type.
- *
- * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
- * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
- * attributes to be added to the ID token regardless of flow.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to include in all cases
- */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getAlwaysIncludedAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -516,15 +447,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
alwaysIncludedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the bi-function for manipulating id_token claims.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating id_token claims
- *
- * @since 2.1.0
- */
+ @Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -556,15 +479,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
idTokenManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the bi-function for manipulating access token claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating access token claims set
- *
- * @since 2.1.0
- */
+ @Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
getAccessTokenClaimsSetManipulationStrategy(
@@ -609,15 +524,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
responseModeLookupStrategy = Constraint.isNotNull(strategy, "ResponseMode lookup strategy can not be null");
}
- /**
- * Get the response_mode to use for authorization requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the response_mode
- *
- * @since 2.2.0
- */
+ @Override
public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext) {
return responseModeLookupStrategy.apply(profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationConfiguration.java
new file mode 100644
index 0000000..6d0d589
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationConfiguration.java
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import java.security.Principal;
+import java.time.Duration;
+import java.util.Collection;
+import java.util.Set;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+
+/** Generic configuration for an OIDC authentication request.*/
+public interface OIDCAuthenticationConfiguration {
+
+ /**
+ * Get the {@link ClaimsValidator} to apply to JWT-based client authentication.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the validator to use
+ *
+ * @since 3.1.0
+ */
+ @Nullable public ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the function used to translate AMRs in the inbound id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
+ *
+ * @param prc current profile request context
+ *
+ * @return translation function
+ *
+ * @since 2.2.0
+ */
+ @Nullable public Function<Collection<String>,Collection<Principal>>
+ getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc);
+
+ /**
+ * Get the function used to translate ACRs in the inbound id_token into an appropriate set of
+ * custom {@link Principal} objects to populate into the subject.
+ *
+ * @param prc current profile request context
+ *
+ * @return translation function
+ *
+ * @since 2.2.0
+ */
+ @Nullable public Function<Collection<String>,Collection<Principal>>
+ getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc);
+
+ /**
+ * Get the login_hint to use.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the login_hint to use
+ *
+ * @since 2.2.0
+ */
+ @Nullable public String getLoginHint(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the max authentication age.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return max authentication age
+ *
+ * @since 2.2.0
+ */
+ @Nullable
+ public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
+ * which the token may be shared.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the additional audiences
+ */
+ @Nonnull @NonnullElements @NotLive Set<String> getAdditionalAudiencesForIdToken(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether encryption is optional in the face of a missing key, etc.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff encryption is optional
+ */
+ boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderConfiguration.java
new file mode 100644
index 0000000..092410d
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderConfiguration.java
@@ -0,0 +1,125 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import java.time.Duration;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationServerConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+
+/**
+ * Configuration of an OIDC 1.0 authentication request.
+ *
+ * <p>This is specific to the role of the OpenID Provider (OP).</p>
+ */
+public interface OIDCAuthenticationProviderConfiguration extends OAuth2AuthorizationServerConfiguration,
+ OIDCAuthenticationConfiguration {
+
+ /**
+ * Get whether all acr claim requests should be treated as Essential.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether all acr claim requests should be treated as Essential
+ */
+ boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether to encode consent in authorization code and access/refresh tokens.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to encode consent in authorization code and access/refresh tokens
+ */
+ public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the set of attribute IDs which should be omitted from the UserInfo token.
+ *
+ * <p>Default behavior is to include all claims, but omiited claims also affect the set that
+ * may need to be embedded for recovery into the access/refresh tokens.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the attribute IDs to omit from UserInfo token
+ */
+ @Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether to include iss parameter in the authentication response.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether to include iss parameter in the authentication response
+ *
+ * @since 2.1.0
+ *
+ */
+ public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get ID token lifetime.
+ *
+ * <p>Defaults to 1 hour.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return ID token lifetime
+ */
+ @Positive @Nonnull Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get the set of attribute IDs which should be included in the ID token regardless of response_type.
+ *
+ * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
+ * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
+ * attributes to be added to the ID token regardless of flow.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the attribute IDs to include in all cases
+ */
+ @Nonnull @NonnullElements @NotLive Set<String> getAlwaysIncludedAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the bi-function for manipulating id_token claims.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating id_token claims
+ *
+ * @since 2.1.0
+ */
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyConfiguration.java
new file mode 100644
index 0000000..508eccf
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyConfiguration.java
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationClientConfiguration;
+
+/**
+ * Configuration of an OIDC 1.0 authentication request.
+ *
+ * <p>This is specific to the role of the RelyingParty (RP).</p>
+ */
+public interface OIDCAuthenticationRelyingPartyConfiguration extends OAuth2AuthorizationClientConfiguration,
+ OIDCAuthenticationConfiguration{
+
+ /**
+ * Get the HTTP request method for the UserInfo request. Both GET and POST are supported.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the UserInfo HTTP request method
+ *
+ * @since 2.2.0
+ */
+ @Nullable HttpRequestMethod getUserInfoHttpRequestMethod(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to make a request to the UserInfo Endpoint
+ *
+ * @since 2.2.0
+ */
+ boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Should authentication request parameters should be passed in a single, self contained, JWT?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return whether authentication request parameters should be passed in a single, self contained, JWT
+ */
+ boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Should the RequestObject (if configured) be signed?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return true iff the RequestObject should be signed, false otherwise.
+ *
+ * @since 2.2.0
+ */
+ boolean isSignRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Should the RequestObject (if configured) be encrypted?
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return true iff the RequestObject should be encrypted, false otherwise.
+ *
+ * @since 2.2.0
+ */
+ boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProxyConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProxyConfiguration.java
new file mode 100644
index 0000000..d7bb166
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProxyConfiguration.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/** Configuration for an OIDC authentication request specific to a Proxying Relying Party.*/
+public interface OIDCAuthenticationRelyingPartyProxyConfiguration extends OIDCAuthenticationRelyingPartyConfiguration {
+
+ /**
+ * Gets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's auth_time from the id_token, rather than the current time.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to proxy across the inbound auth_time
+ *
+ * @since 2.2.0
+ */
+ public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the redirect_uri override if set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the redirect_uri override
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NotEmpty String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext);
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 8bed866..93a8898 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -51,7 +51,8 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* <p>It is also usable as a Token endpoint configuration if no non-OIDC use cases are needed.</p>
*/
public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
- implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
+ implements OIDCAuthenticationRelyingPartyProxyConfiguration, OIDCAuthenticationProviderConfiguration,
+ AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
@@ -83,18 +84,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
/** Whether to include iss parameter in the authentication response. */
@Nonnull private Predicate<ProfileRequestContext> includeIssuerInResponsePredicate;
- /** Enumeration of the HTTP methods used in OIDC authentication requests.*/
- public enum OIDCHttpRequestMethod {
- /**
- * HTTP GET.
- */
- GET,
- /**
- * HTTP POST.
- */
- POST
- }
-
/** Whether to make a UserInfo Endpoint request for End-User claims.*/
@Nonnull private Predicate<ProfileRequestContext> retrieveUserInfoEndpointClaims;
@@ -168,28 +157,18 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
encodeConsentInTokensPredicate = Predicates.alwaysFalse();
useRequestObjectPredicate = Predicates.alwaysFalse();
-
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
-
encodedAttributesLookupStrategy = FunctionSupport.constant(null);
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
- httpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET.toString());
-
+ httpRequestMethodLookupStrategy = FunctionSupport.constant(HttpRequestMethod.GET.toString());
includeIssuerInResponsePredicate = Predicates.alwaysFalse();
-
authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
maxAuthenticationAgeLookupStrategy = FunctionSupport.constant(null);
loginHintLookupStrategy = FunctionSupport.constant(null);
- userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(OIDCHttpRequestMethod.GET.toString());
+ userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(HttpRequestMethod.GET.toString());
}
- /**
- * Get whether all acr claim requests should be treated as Essential.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether all acr claim requests should be treated as Essential
- */
+ @Override
public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
}
@@ -212,13 +191,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Should authentication request parameters should be passed in a single, self contained, JWT?
- *
- * @param profileRequestContext the profile request context
- *
- * @return whether authentication request parameters should be passed in a single, self contained, JWT
- */
+ @Override
public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
return useRequestObjectPredicate.test(profileRequestContext);
}
@@ -243,13 +216,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
}
- /**
- * Get whether to encode consent in authorization code and access/refresh tokens.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to encode consent in authorization code and access/refresh tokens
- */
+ @Override
public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
return encodeConsentInTokensPredicate.test(profileRequestContext);
}
@@ -272,15 +239,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Get whether to make a request to the UserInfo Endpoint to obtain authenticated End-User claims.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to make a request to the UserInfo Endpoint
- *
- * @since 2.2.0
- */
+ @Override
public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
return retrieveUserInfoEndpointClaims.test(profileRequestContext);
}
@@ -307,15 +266,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Should the RequestObject (if configured) be signed?
- *
- * @param profileRequestContext the profile request context
- *
- * @return true iff the RequestObject should be signed, false otherwise.
- *
- * @since 2.2.0
- */
+ @Override
public boolean isSignRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
return signRequestObjectPredicate.test(profileRequestContext);
}
@@ -342,15 +293,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
signRequestObjectPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /**
- * Should the RequestObject (if configured) be encrypted?
- *
- * @param profileRequestContext the profile request context
- *
- * @return true iff the RequestObject should be encrypted, false otherwise.
- *
- * @since 2.2.0
- */
+ @Override
public boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptRequestObjectPredicate.test(profileRequestContext);
}
@@ -404,28 +347,12 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
}
}
- /**
- * Get the redirect_uri override if set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the redirect_uri override
- *
- * @since 2.2.0
- */
+ @Override
public String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext) {
return redirectUriOverrideLookupStrategy.apply(profileRequestContext);
}
- /**
- * Get authz code lifetime.
- *
- * <p>Defaults to 5 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return authz code lifetime
- */
+ @Override
@Positive @Nonnull
public Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration lifetime = authorizeCodeLifetimeLookupStrategy.apply(profileRequestContext);
@@ -473,22 +400,16 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @param method the HTTP method to set, either POST or GET.
*/
- public void setHttpRequestMethod(@Nonnull @NotEmpty final OIDCHttpRequestMethod method){
+ public void setHttpRequestMethod(@Nonnull @NotEmpty final HttpRequestMethod method){
httpRequestMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
}
- /**
- * Get the HTTP request method for an authentication request.
- *
- * @param profileRequestContext profile request context
- *
- * @return the HTTP request method
- */
- public OIDCHttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext) {
+ @Override
+ public HttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext) {
final String method = httpRequestMethodLookupStrategy.apply(profileRequestContext);
if (method != null) {
try {
- return OIDCHttpRequestMethod.valueOf(method);
+ return HttpRequestMethod.valueOf(method);
} catch (final IllegalArgumentException e) {
throw new ConstraintViolationException("Unexpected HTTP method value: '" + method + "': "
+ e.getMessage());
@@ -497,14 +418,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
return null;
}
- /**
- * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
- * and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to encode
- */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getEncodedAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -542,16 +456,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
encodedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the set of attribute IDs which should be omitted from the UserInfo token.
- *
- * <p>Default behavior is to include all claims, but omiited claims also affect the set that
- * may need to be embedded for recovery into the access/refresh tokens.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to omit from UserInfo token
- */
+ @Override
@Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -590,15 +495,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get whether to include iss parameter in the authentication response.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether to include iss parameter in the authentication response
- *
- * @since 2.1.0
- */
+ @Override
public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext) {
return includeIssuerInResponsePredicate.test(profileRequestContext);
}
@@ -647,28 +544,13 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
responseTypeLookupStrategy = FunctionSupport.constant(responseType);
}
- /**
- * Get the response_type to use for authentication requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the response_type
- *
- * @since 2.2.0
- */
+
+ @Override
public String getResponseType(@Nullable final ProfileRequestContext profileRequestContext) {
return responseTypeLookupStrategy.apply(profileRequestContext);
}
- /**
- * Get the bi-function for manipulating authorization code claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating authorization code claims set
- *
- * @since 2.1.0
- */
+ @Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
getAuthorizationCodeClaimsSetManipulationStrategy(
@@ -729,15 +611,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
}
}
- /**
- * Get the scopes to use in authentication requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the scopes
- *
- * @since 2.2.0
- */
+ @Override
@Nullable public Set<String> getScopes(@Nullable final ProfileRequestContext profileRequestContext) {
return scopesLookupStrategy.apply(profileRequestContext);
}
@@ -756,16 +630,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
amrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the function used to translate AMRs in the inbound id_token into an appropriate set of
- * custom {@link Principal} objects to populate into the subject.
- *
- * @param prc current profile request context
- *
- * @return translation function
- *
- * @since 2.2.0
- */
+ @Override
@Nullable public Function<Collection<String>,Collection<Principal>>
getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc){
return amrTranslationStrategyLookupStrategy.apply(prc);
@@ -785,33 +650,13 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
acrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the function used to translate ACRs in the inbound id_token into an appropriate set of
- * custom {@link Principal} objects to populate into the subject.
- *
- * @param prc current profile request context
- *
- * @return translation function
- *
- * @since 2.2.0
- */
+ @Override
@Nullable public Function<Collection<String>,Collection<Principal>>
getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc){
return acrTranslationStrategyLookupStrategy.apply(prc);
}
- /**
- * Gets whether authentication results produced by use of this profile should carry the proxied
- * assertion's auth_time from the id_token, rather than the current time.
- *
- * <p>Defaults to true.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return whether to proxy across the inbound auth_time
- *
- * @since 2.2.0
- */
+ @Override
public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext) {
return proxiedAuthnInstantPredicate.test(profileRequestContext);
}
@@ -829,15 +674,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
proxiedAuthnInstantPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
- /**
- * Get the max authentication age.
- *
- * @param profileRequestContext profile request context
- *
- * @return max authentication age
- *
- * @since 2.2.0
- */
+ @Override
@Nullable
public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext) {
return maxAuthenticationAgeLookupStrategy.apply(profileRequestContext);
@@ -875,7 +712,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
* @param strategy lookup strategy
*
* @since 2.2.0
- */
+ */
public void setLoginHintLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
loginHintLookupStrategy = Constraint.isNotNull(loginHintLookupStrategy, "Login Hint strategy can not be null");
}
@@ -892,13 +729,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
loginHintLookupStrategy = FunctionSupport.constant(fixedLoginHint);
}
- /**
- * Get the login_hint to use.
- *
- * @param profileRequestContext profile request context
- *
- * @return the login_hint to use
- */
+ @Override
@Nullable public String getLoginHint(@Nullable final ProfileRequestContext profileRequestContext) {
return loginHintLookupStrategy.apply(profileRequestContext);
}
@@ -923,25 +754,17 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
*
* @since 2.2.0
*/
- public void setUserInfoHttpRequestMethod(@Nonnull @NotEmpty final OIDCHttpRequestMethod method){
+ public void setUserInfoHttpRequestMethod(@Nonnull @NotEmpty final HttpRequestMethod method){
userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
}
- /**
- * Get the HTTP request method for an UserInfo request.
- *
- * @param profileRequestContext profile request context
- *
- * @return the HTTP request method
- *
- * @since 2.2.0
- */
- @Nullable public OIDCHttpRequestMethod getUserInfoHttpRequestMethod(
+ @Override
+ @Nullable public HttpRequestMethod getUserInfoHttpRequestMethod(
@Nullable final ProfileRequestContext profileRequestContext) {
final String method = userInfoHttpRequestMethodLookupStrategy.apply(profileRequestContext);
if (method != null) {
try {
- return OIDCHttpRequestMethod.valueOf(method);
+ return HttpRequestMethod.valueOf(method);
} catch (final IllegalArgumentException e) {
throw new ConstraintViolationException("Unexpected HTTP method value: '" + method + "': "
+ e.getMessage());
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
deleted file mode 100644
index 1a68e6d..0000000
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.oidc.profile.config;
-
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ProfileConfiguration;
-
-/**
- * Marker interface for OIDC-specific profile configurations.
- *
- * <p>Such profiles may be OAuth-defined but if they include features specific to OIDC should
- * implement this interface as well.</p>
- */
-public interface OIDCProfileConfiguration extends OAuth2ProfileConfiguration {
-
-}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
index 00eb158..a5770f6 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationConfiguration.java
@@ -34,7 +34,7 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
* Profile configuration for the OpenID Connect Provider Configuration.
*/
public class OIDCProviderInformationConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration {
+ implements OverriddenIssuerProfileConfiguration {
/** OIDC base protocol URI. Section 4 is relevant. */
public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-discovery-1_0.html";
@@ -63,6 +63,7 @@ public class OIDCProviderInformationConfiguration extends AbstractConditionalPro
}
/** {@inheritDoc} */
+ @Override
@Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
return issuerLookupStrategy.apply(profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
index e7d0ba2..bec75ed 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetConfiguration.java
@@ -25,8 +25,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
* Profile configuration for publishing OP key set.
*/
-public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration{
+public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileConfiguration {
/** OIDC base protocol URI. Section 3 jwks_uri is the relevant. */
public static final String PROTOCOL_URI =
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/OIDCMessageEncoder.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/OIDCMessageEncoder.java
index 298b7e0..adfd952 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/OIDCMessageEncoder.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/encoding/OIDCMessageEncoder.java
@@ -21,7 +21,7 @@ import java.util.function.Predicate;
import org.opensaml.messaging.encoder.MessageEncoder;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationConfiguration.HttpRequestMethod;
/**
* An OIDC message encoder interface which requires implementations to test if the request
@@ -29,6 +29,6 @@ import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHtt
*
* @since 2.2.0
*/
-public interface OIDCMessageEncoder extends Predicate<OIDCHttpRequestMethod>, MessageEncoder {
+public interface OIDCMessageEncoder extends Predicate<HttpRequestMethod>, MessageEncoder {
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index d6d0f9f..b06b64a 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -51,8 +51,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Base class for OAuth profile configurations that support OAuth-defined client authentication methods.
*/
public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
- extends AbstractConditionalProfileConfiguration implements OAuth2ProfileConfiguration,
- AuthenticationProfileConfiguration {
+ extends AbstractConditionalProfileConfiguration implements AuthenticationProfileConfiguration {
/** Enabled token endpoint authentication methods. */
@Nonnull private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy;
@@ -114,13 +113,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
}
- /**
- * Get the enabled token endpoint authentication methods.
- *
- * @param profileRequestContext profile request context
- *
- * @return enabled token endpoint authentication methods
- */
+ @Override
@Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getTokenEndpointAuthMethods(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -157,15 +150,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
tokenEndpointAuthMethodsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
- /**
- * Get the token endpoint authentication method to use with an upstream OpenID Provider.
- *
- * @param profileRequestContext profile request context
- *
- * @return the token endpoint authentication method to use.
- *
- * @since 2.2.0
- */
+ @Override
@Nonnull public String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext) {
return tokenEndpointAuthMethodLookupStrategy.apply(profileRequestContext);
}
@@ -204,6 +189,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
*
* @since 3.1.0
*/
+ @Override
@Nullable public ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext) {
return claimsValidatorLookupStrategy.apply(profileRequestContext);
}
@@ -421,16 +407,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
clientCredentialLookupStrategy = FunctionSupport.constant(clientCredential);
}
- /**
- * Get the client credential for the given context. Typically a client_secret
- * associated with the current client_id.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client credential
- *
- * @since 2.2.0
- */
+ @Override
public ClientSecretCredential getClientCredential(
@Nullable final ProfileRequestContext profileRequestContext) {
return clientCredentialLookupStrategy.apply(profileRequestContext);
@@ -458,16 +435,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
clientIdLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(clientId));
}
- /**
- * Get the client_id appropriate for the given context. Typically that associated
- * with the chosen downstream OpenID Connect Provider.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client_id
- *
- * @since 2.2.0
- */
+ @Override
public String getClientId(@Nullable final ProfileRequestContext profileRequestContext) {
return clientIdLookupStrategy.apply(profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java
index 2fadc96..2c88dbd 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java
@@ -60,13 +60,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
refreshTokensPredicate = Predicates.alwaysTrue();
}
- /**
- * Get whether authorization code flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether authorization code flow is supported by this profile
- */
+ @Override
public boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return authorizationCodeFlowPredicate.test(profileRequestContext);
}
@@ -90,13 +84,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
"Condition used to indicate whether authorization code flow is supported cannot be null");
}
- /**
- * Get whether implicit flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether implicit flow is supported by this profile
- */
+ @Override
public boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return hybridFlowPredicate.test(profileRequestContext);
}
@@ -120,13 +108,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
"Condition used to indicate whether implicit flow is supported cannot be null");
}
- /**
- * Get whether hybrid flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether hybrid flow is supported by this profile
- */
+ @Override
public boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return implicitFlowPredicate.test(profileRequestContext);
}
@@ -150,13 +132,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
"Condition used to indicate whether hybrid flow is supported cannot be null");
}
- /**
- * Get whether refresh tokens are supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether refresh tokens are supported by this profile
- */
+ @Override
public boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return refreshTokensPredicate.test(profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationClientConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationClientConfiguration.java
new file mode 100644
index 0000000..95c85ff
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationClientConfiguration.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.security.credential.ClientSecretCredential;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Configuration for an OAuth 2.0 authorization request.
+ *
+ * <p>This is specific to the role of the client.</p>
+ *
+ */
+public interface OAuth2AuthorizationClientConfiguration extends OAuth2AuthorizationConfiguration {
+
+ /**
+ * Get the client credential for the given context. Typically a client_secret
+ * associated with the current client_id.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the client credential
+ *
+ * @since 2.2.0
+ *
+ */
+ @Nullable ClientSecretCredential getClientCredential(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the client_id appropriate for the given context. Typically that associated
+ * with the chosen OpenID Connect Provider.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the client_id
+ *
+ * @since 2.2.0
+ */
+ @Nonnull @NotEmpty String getClientId(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the token endpoint authentication method to use with an OpenID Provider.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the token endpoint authentication method to use.
+ *
+ * @since 2.2.0
+ */
+ @Nonnull String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationConfiguration.java
new file mode 100644
index 0000000..6a9d545
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationConfiguration.java
@@ -0,0 +1,153 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.util.Set;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+
+/**
+ * Configuration for an OAuth 2.0 authorization request.
+ *
+ * <p>This is common to both Authorization Server and Client roles.</p>
+ *
+ */
+public interface OAuth2AuthorizationConfiguration {
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
+
+ /** Enumeration of the HTTP methods used in various OAuth requests.*/
+ public enum HttpRequestMethod {
+ /**
+ * HTTP GET.
+ */
+ GET,
+ /**
+ * HTTP POST.
+ */
+ POST
+ }
+
+ /**
+ * Get the scopes to use in authentication requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the scopes
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NonnullElements @Unmodifiable @NotLive Set<String> getScopes(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the response_type to use for authorization requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_type
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NotEmpty String getResponseType(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the HTTP request method for an authentication request.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the HTTP request method
+ */
+ public HttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get the response_mode to use for authorization requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_mode
+ *
+ * @since 2.2.0
+ */
+ public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether authorization code flow is supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether authorization code flow is supported by this profile
+ */
+ boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether implicit flow is supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether implicit flow is supported by this profile
+ */
+ boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether hybrid flow is supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether hybrid flow is supported by this profile
+ */
+ boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether refresh tokens are supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether refresh tokens are supported by this profile
+ */
+ boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether client is required to use PKCE.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is required to use PKCE
+ */
+ public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether client is allowed to use PKCE code challenge method plain.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is allowed to use PKCE code challenge method plain
+ */
+ public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationServerConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationServerConfiguration.java
new file mode 100644
index 0000000..3125246
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationServerConfiguration.java
@@ -0,0 +1,138 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.time.Duration;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+
+/**
+ * Configuration for an OAuth 2.0 authorization request.
+ *
+ * <p>This is specific to the role of the Authorization Server.</p>
+ *
+ */
+public interface OAuth2AuthorizationServerConfiguration extends OAuth2AuthorizationConfiguration {
+
+ /**
+ * Get authz code lifetime.
+ *
+ * <p>Defaults to 5 minutes.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return authz code lifetime
+ */
+ @Positive @Nonnull
+ Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
+ * and/or access/refresh tokens to enable recovery on the back-channel.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the attribute IDs to encode
+ */
+ @Nonnull @NonnullElements @NotLive Set<String> getEncodedAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the bi-function for manipulating authorization code claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the bi-function for manipulating access token claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating access token claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get access token type.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return access token type, or null for unspecified/opaque
+ *
+ * @since 2.1.0
+ */
+ @Nullable @NotEmpty String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get access token lifetime.
+ *
+ * <p>Defaults to 10 minutes.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return access token lifetime
+ */
+ @Positive @Nonnull Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get refresh token lifetime.
+ *
+ * <p>Defaults to 2 hours.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return refresh token lifetime
+ */
+ @Nonnull @Positive Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the enabled token endpoint authentication methods.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return enabled token endpoint authentication methods
+ */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getTokenEndpointAuthMethods(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
deleted file mode 100644
index 8ed01c0..0000000
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.oidc.profile.oauth2.config;
-
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-
-/**
- * Marker interface for OAuth 2 profile configurations.
- */
-public interface OAuth2ProfileConfiguration extends ProfileConfiguration {
-
-}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
index 6d0a9bf..57076f9 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
@@ -44,7 +44,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* to the parties intended to process them, as distinct from the clients that use them.</p>
*/
public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfileConfiguration
- implements OAuth2ProfileConfiguration, OverriddenIssuerProfileConfiguration,
+ implements OverriddenIssuerProfileConfiguration,
AttributeResolvingProfileConfiguration {
/** OAuth2 Token Revocation URI. */
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java
index b8595cd..13df3e4 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java
@@ -34,8 +34,8 @@ import org.opensaml.messaging.encoder.MessageEncodingException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationConfiguration.HttpRequestMethod;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.codec.HTMLEncoder;
import net.shibboleth.utilities.java.support.collection.Pair;
@@ -90,8 +90,8 @@ public class HTTPPostAuthnRequestEncoder extends AbstractOIDCMessageEncoder {
@Override
- public boolean test(@Nonnull final OIDCHttpRequestMethod requestMethod) {
- return requestMethod == OIDCHttpRequestMethod.POST;
+ public boolean test(@Nonnull final HttpRequestMethod requestMethod) {
+ return requestMethod == HttpRequestMethod.POST;
}
/**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java
index 6ce81ee..791e39f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java
@@ -29,8 +29,8 @@ import org.opensaml.messaging.encoder.MessageEncodingException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationConfiguration.HttpRequestMethod;
import net.shibboleth.utilities.java.support.net.HttpServletSupport;
import net.shibboleth.utilities.java.support.net.URLBuilder;
@@ -45,8 +45,8 @@ public class HTTPRedirectAuthnRequestEncoder extends AbstractOIDCMessageEncoder
@Nonnull private final Logger log = LoggerFactory.getLogger(HTTPRedirectAuthnRequestEncoder.class);
@Override
- public boolean test(@Nonnull final OIDCHttpRequestMethod requestMethod) {
- return requestMethod == OIDCHttpRequestMethod.GET;
+ public boolean test(@Nonnull final HttpRequestMethod requestMethod) {
+ return requestMethod == HttpRequestMethod.GET;
}
@Override
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java
index c72a710..54ab901 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java
@@ -33,8 +33,8 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
import net.shibboleth.oidc.profile.encoding.OIDCMessageEncoder;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationConfiguration.HttpRequestMethod;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
@@ -86,7 +86,7 @@ public class AuthenticationRequestMessageEncoderFactory extends AbstractInitiali
return null;
}
- final OIDCHttpRequestMethod requestMethodFromConfig =
+ final HttpRequestMethod requestMethodFromConfig =
profileConfiguration.getHttpRequestMethod(profileRequestContext);
if (requestMethodFromConfig == null) {
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java
index 1f4937c..4823091 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java
@@ -30,9 +30,9 @@ import org.testng.annotations.Test;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration.OIDCHttpRequestMethod;
import net.shibboleth.oidc.profile.encoding.OIDCMessageEncoder;
import net.shibboleth.oidc.profile.encoding.impl.AbstractOIDCMessageEncoder;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationConfiguration.HttpRequestMethod;
/** Test of the AuthenticationRequestMessageEncoderFactory class.*/
public class AuthenticationRequestMessageEncoderFactoryTest {
@@ -55,8 +55,8 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final OIDCMessageEncoder mockPostEncoder = new AbstractOIDCMessageEncoder() {
@Override
- public boolean test(final OIDCHttpRequestMethod method) {
- if (method == OIDCHttpRequestMethod.POST) {
+ public boolean test(final HttpRequestMethod method) {
+ if (method == HttpRequestMethod.POST) {
return true;
}
return false;
@@ -72,7 +72,7 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final ProfileRequestContext prc = new ProfileRequestContext();
// mock a profile config to request form POST serialization
final OIDCAuthorizationConfiguration config = new OIDCAuthorizationConfiguration();
- config.setHttpRequestMethodLookupStrategy(rc -> OIDCHttpRequestMethod.POST.toString());
+ config.setHttpRequestMethodLookupStrategy(rc -> HttpRequestMethod.POST.toString());
final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class, true);
rpCtx.setProfileConfig(config);
@@ -86,8 +86,8 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final OIDCMessageEncoder mockGetEncoder = new AbstractOIDCMessageEncoder() {
@Override
- public boolean test(final OIDCHttpRequestMethod method) {
- if (method == OIDCHttpRequestMethod.GET) {
+ public boolean test(final HttpRequestMethod method) {
+ if (method == HttpRequestMethod.GET) {
return true;
}
return false;
@@ -103,7 +103,7 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final ProfileRequestContext prc = new ProfileRequestContext();
// mock a profile config to request form POST serialization
final OIDCAuthorizationConfiguration config = new OIDCAuthorizationConfiguration();
- config.setHttpRequestMethodLookupStrategy(rc -> OIDCHttpRequestMethod.GET.toString());
+ config.setHttpRequestMethodLookupStrategy(rc -> HttpRequestMethod.GET.toString());
final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class, true);
rpCtx.setProfileConfig(config);
@@ -118,8 +118,8 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final OIDCMessageEncoder mockGetEncoder = new AbstractOIDCMessageEncoder() {
@Override
- public boolean test(final OIDCHttpRequestMethod method) {
- if (method == OIDCHttpRequestMethod.GET) {
+ public boolean test(final HttpRequestMethod method) {
+ if (method == HttpRequestMethod.GET) {
return true;
}
return false;
@@ -135,7 +135,7 @@ public class AuthenticationRequestMessageEncoderFactoryTest {
final ProfileRequestContext prc = new ProfileRequestContext();
// mock a profile config to request form POST serialization
final OIDCAuthorizationConfiguration config = new OIDCAuthorizationConfiguration();
- config.setHttpRequestMethodLookupStrategy(rc -> OIDCHttpRequestMethod.POST.toString());
+ config.setHttpRequestMethodLookupStrategy(rc -> HttpRequestMethod.POST.toString());
final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class, true);
rpCtx.setProfileConfig(config);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list