[java-oidc-common] 01/03: Add ClientInformationCriterion to the criteria set if client information was found.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=064099c40f44442b54f8a35b4db05d72e7c554ac

commit 064099c40f44442b54f8a35b4db05d72e7c554ac
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Mar 28 16:30:07 2023 +0300

    Add ClientInformationCriterion to the criteria set if client information was found.
    
    The criteria set is used as input for DecryptionParametersResolver.
---
 .../impl/PopulateJWTDecryptionParameters.java      | 38 ++++++++++++++++++++--
 1 file changed, 35 insertions(+), 3 deletions(-)

diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
index 956c331..6c08ddf 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
@@ -21,6 +21,7 @@ import java.util.List;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.action.ActionSupport;
@@ -32,6 +33,7 @@ import org.slf4j.LoggerFactory;
 
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
 import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
 import net.shibboleth.oidc.security.credential.ClientSecretCredential;
 import net.shibboleth.oidc.security.jose.DecryptionConfiguration;
@@ -39,6 +41,7 @@ import net.shibboleth.oidc.security.jose.DecryptionParameters;
 import net.shibboleth.oidc.security.jose.DecryptionParametersResolver;
 import net.shibboleth.oidc.security.jose.EncryptionConfiguration;
 import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
+import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
 import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
 import net.shibboleth.oidc.security.jose.criterion.DecryptionConfigurationCriterion;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
@@ -74,6 +77,9 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
     @NonnullAfterInit 
     private Function<ProfileRequestContext,List<DecryptionConfiguration>> configurationLookupStrategy;
     
+    /** Strategy used to look up a OIDC client metadata context. */
+    @Nullable private Function<ProfileRequestContext, OIDCMetadataContext> oidcClientMetadataContextLookupStrategy;
+
     /** Lookup function for relying party context. */
     @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
     
@@ -87,7 +93,9 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
         // Create context by default.
         securityParametersContextLookupStrategy =
                 new ChildContextLookup<>(SecurityParametersContext.class, true).compose(
-                        new InboundMessageContextLookup());       
+                        new InboundMessageContextLookup());
+        oidcClientMetadataContextLookupStrategy = new ChildContextLookup<>(OIDCMetadataContext.class).compose(
+                new InboundMessageContextLookup());
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
     }
     
@@ -140,7 +148,19 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
         securityParametersContextLookupStrategy = Constraint.isNotNull(strategy,
                 "SecurityParametersContext lookup strategy cannot be null");
     }
-    
+
+    /**
+     * Set lookup strategy for {@link OIDCMetadataContext} for input to resolution.
+     * 
+     * @param strategy lookup strategy
+     */
+    public void setClientMetadataContextLookupStrategy(
+            @Nullable final Function<ProfileRequestContext, OIDCMetadataContext> strategy) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+        oidcClientMetadataContextLookupStrategy = strategy;
+    }
+
     /** {@inheritDoc} */
     @Override
     protected void doInitialize() throws ComponentInitializationException {
@@ -201,7 +221,19 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
         
         final CriteriaSet criteria = new CriteriaSet();
         criteria.add(new DecryptionConfigurationCriterion(configs));
-        
+
+        // Add client metadata criterion
+        final OIDCMetadataContext oidcMetadataCtx = 
+                oidcClientMetadataContextLookupStrategy.apply(profileRequestContext);
+        if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
+            log.debug(
+                    "{} Adding OIDC client information to resolution criteria for encryption algorithms",
+                    getLogPrefix());
+            criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
+        } else {
+            log.debug("{} No OIDC client information available", getLogPrefix());
+        }
+
         // Build a client secret credential criteria. Extract the decryption credential from the RP config.
         final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);     
         if (rpCtx != null && rpCtx.getConfiguration() != null &&

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.