[java-oidc-common] 04/18: Latest attempt to re-organise interface definitions
Phil Smart
philip.smart at jisc.ac.uk
Tue Mar 28 15:26:31 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-66
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=e0b0fc43c6e01610bc585add64600e1c0b1e224f
commit e0b0fc43c6e01610bc585add64600e1c0b1e224f
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Mar 17 16:23:02 2023 +0000
Latest attempt to re-organise interface definitions
- remove OAuthServer and Client layers
---
.../config/AbstractOIDCSSOConfiguration.java | 6 +-
.../config/OIDCAuthenticationConfiguration.java | 30 ++---
.../OIDCAuthenticationProviderConfiguration.java | 33 +----
...IDCAuthenticationRelyingPartyConfiguration.java | 9 +-
.../config/OIDCAuthorizationConfiguration.java | 5 +-
.../OIDCIDTokenProducingProfileConfiguration.java} | 47 +++----
.../profile/config/OIDCProfileConfiguration.java | 15 +++
.../oidc/profile/config/OIDCSSOConfiguration.java | 55 ++++++++
...bstractOAuth2FlowAwareProfileConfiguration.java | 6 +-
...2AccessTokenProducingProfileConfiguration.java} | 69 +++++------
.../OAuth2AuthorizationClientConfiguration.java | 73 -----------
...orizationCodeProducingProfileConfiguration.java | 46 +++++++
.../config/OAuth2AuthorizationConfiguration.java | 80 +++---------
.../OAuth2AuthorizationServerConfiguration.java | 138 ---------------------
...th2ClientAuthenticableProfileConfiguration.java | 12 ++
.../oauth2/config/OAuth2ProfileConfiguration.java | 35 ++++++
...RefreshTokenProducingProfileConfiguration.java} | 29 ++++-
...> OAuth2TokenHandlingProfileConfiguration.java} | 45 +++----
.../config/OAuth2TokenProfileConfiguration.java | 24 ++--
19 files changed, 317 insertions(+), 440 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index 8e00b2b..8937536 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -37,6 +37,8 @@ import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
@@ -49,7 +51,9 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.
*/
public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
- implements AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration,
+ implements OIDCSSOConfiguration, OIDCIDTokenProducingProfileConfiguration,
+ AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration,
+ OAuth2AccessTokenProducingProfileConfiguration, OAuth2RefreshTokenProducingProfileConfiguration,
AttributeResolvingProfileConfiguration {
/** OIDC base protocol URI. */
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationConfiguration.java
index 8f36e5d..c8da2fb 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationConfiguration.java
@@ -28,23 +28,13 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
/** Generic configuration for an OIDC authentication request.*/
-public interface OIDCAuthenticationConfiguration extends OIDCProfileConfiguration {
+public interface OIDCAuthenticationConfiguration extends OAuth2AuthorizationConfiguration {
- /**
- * Get the {@link ClaimsValidator} to apply to JWT-based client authentication.
- *
- * @param profileRequestContext current profile request context
- *
- * @return the validator to use
- *
- * @since 3.1.0
- */
- @Nullable public ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the function used to translate AMRs in the inbound id_token into an appropriate set of
@@ -107,13 +97,13 @@ public interface OIDCAuthenticationConfiguration extends OIDCProfileConfiguratio
@Nonnull @NonnullElements @NotLive Set<String> getAdditionalAudiencesForIdToken(
@Nullable final ProfileRequestContext profileRequestContext);
- /**
- * Get whether encryption is optional in the face of a missing key, etc.
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff encryption is optional
- */
- boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
+// /**
+// * Get whether encryption is optional in the face of a missing key, etc.
+// *
+// * @param profileRequestContext current profile request context
+// *
+// * @return true iff encryption is optional
+// */
+// boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderConfiguration.java
index 092410d..c547199 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderConfiguration.java
@@ -17,28 +17,22 @@
package net.shibboleth.oidc.profile.config;
-import java.time.Duration;
-import java.util.Map;
import java.util.Set;
-import java.util.function.BiFunction;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationServerConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
/**
* Configuration of an OIDC 1.0 authentication request.
*
* <p>This is specific to the role of the OpenID Provider (OP).</p>
*/
-public interface OIDCAuthenticationProviderConfiguration extends OAuth2AuthorizationServerConfiguration,
- OIDCAuthenticationConfiguration {
+public interface OIDCAuthenticationProviderConfiguration extends OIDCAuthenticationConfiguration {
/**
* Get whether all acr claim requests should be treated as Essential.
@@ -82,17 +76,7 @@ public interface OIDCAuthenticationProviderConfiguration extends OAuth2Authoriza
*
*/
public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get ID token lifetime.
- *
- * <p>Defaults to 1 hour.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return ID token lifetime
- */
- @Positive @Nonnull Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
/**
@@ -109,17 +93,6 @@ public interface OIDCAuthenticationProviderConfiguration extends OAuth2Authoriza
@Nonnull @NonnullElements @NotLive Set<String> getAlwaysIncludedAttributes(
@Nullable final ProfileRequestContext profileRequestContext);
- /**
- * Get the bi-function for manipulating id_token claims.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating id_token claims
- *
- * @since 2.1.0
- */
- @Nonnull
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext);
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyConfiguration.java
index 508eccf..487bf2e 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyConfiguration.java
@@ -22,15 +22,12 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationClientConfiguration;
-
/**
* Configuration of an OIDC 1.0 authentication request.
*
* <p>This is specific to the role of the RelyingParty (RP).</p>
*/
-public interface OIDCAuthenticationRelyingPartyConfiguration extends OAuth2AuthorizationClientConfiguration,
- OIDCAuthenticationConfiguration{
+public interface OIDCAuthenticationRelyingPartyConfiguration extends OIDCAuthenticationConfiguration {
/**
* Get the HTTP request method for the UserInfo request. Both GET and POST are supported.
@@ -85,6 +82,10 @@ public interface OIDCAuthenticationRelyingPartyConfiguration extends OAuth2Autho
* @since 2.2.0
*/
boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 93a8898..e2e1ebc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -36,6 +36,8 @@ import com.google.common.base.Predicates;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationCodeProducingProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenHandlingProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
@@ -51,7 +53,8 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* <p>It is also usable as a Token endpoint configuration if no non-OIDC use cases are needed.</p>
*/
public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
- implements OIDCAuthenticationRelyingPartyProxyConfiguration, OIDCAuthenticationProviderConfiguration,
+ implements OIDCAuthenticationRelyingPartyProxyConfiguration, OIDCAuthenticationProviderConfiguration,
+ OAuth2AuthorizationCodeProducingProfileConfiguration, OAuth2TokenHandlingProfileConfiguration,
AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
/** ID for this profile configuration. */
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
similarity index 53%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
index 2489401..ed5afad 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
@@ -15,10 +15,10 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config;
+package net.shibboleth.oidc.profile.config;
+import java.time.Duration;
import java.util.Map;
-import java.util.Set;
import java.util.function.BiFunction;
import javax.annotation.Nonnull;
@@ -26,49 +26,36 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+
+/**
+ * Configuration common to ID Token producing profiles.
+ */
+public interface OIDCIDTokenProducingProfileConfiguration {
-public interface OAuth2TokenProfileConfiguration extends OAuth2ProfileConfiguration{
-
/**
- * Get the enabled grant types.
- *
- * @param profileRequestContext profile request context
+ * Get ID token lifetime.
*
- * @return enabled grant types
- */
- @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getGrantTypes(
- @Nullable final ProfileRequestContext profileRequestContext);
-
-
- /**
- * Get the bi-function for manipulating refresh token claims set.
+ * <p>Defaults to 1 hour.</p>
*
* @param profileRequestContext profile request context
*
- * @return the bi-function for manipulating refresh token claims set
- *
- * @since 2.1.0
+ * @return ID token lifetime
*/
- @Nonnull
- BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getRefreshTokenClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext);
+ @Positive @Nonnull Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get whether always revoke the refresh_token after it's used.
+ * Get the bi-function for manipulating id_token claims.
*
* @param profileRequestContext profile request context
*
- * @return whether always revoke the refresh_token after it's used
+ * @return the bi-function for manipulating id_token claims
*
* @since 2.1.0
*/
@Nonnull
- public boolean isEnforceRefreshTokenRotation(
- @Nullable final ProfileRequestContext profileRequestContext)
-
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
index 461b768..ff23ed7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
@@ -17,8 +17,23 @@
package net.shibboleth.oidc.profile.config;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ProfileConfiguration;
+/** Common interface for OIDC Profile Configurations.*/
public interface OIDCProfileConfiguration extends OAuth2ProfileConfiguration {
+
+ /**
+ * Get whether implicit flow is supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether implicit flow is supported by this profile
+ */
+ boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOConfiguration.java
new file mode 100644
index 0000000..a703712
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOConfiguration.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/** Profile configuration generic to all OIDC SSO profiles.*/
+public interface OIDCSSOConfiguration extends OIDCProfileConfiguration {
+
+
+ /**
+ * Get whether encryption is optional in the face of a missing key, etc.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff encryption is optional
+ */
+ boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether client is required to use PKCE.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is required to use PKCE
+ */
+ public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether client is allowed to use PKCE code challenge method plain.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether client is allowed to use PKCE code challenge method plain
+ */
+ public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java
index 2c88dbd..b4ca87d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/AbstractOAuth2FlowAwareProfileConfiguration.java
@@ -26,14 +26,16 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
+import net.shibboleth.oidc.profile.config.OIDCProfileConfiguration;
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
* Base class for OIDC protocol configuration, containing configuration bits shared by all flow aware OIDC protocol
* configurations.
*/
-public abstract class AbstractOAuth2FlowAwareProfileConfiguration
- extends AbstractOAuth2ClientAuthenticableProfileConfiguration {
+public abstract class AbstractOAuth2FlowAwareProfileConfiguration
+ extends AbstractOAuth2ClientAuthenticableProfileConfiguration implements OIDCProfileConfiguration,
+ OAuth2ProfileConfiguration {
/** Predicate used to indicate whether authorization code flow is supported by this profile. Default true. */
@Nonnull private Predicate<ProfileRequestContext> authorizationCodeFlowPredicate;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
similarity index 51%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
index 2489401..0c795be 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
@@ -17,8 +17,8 @@
package net.shibboleth.oidc.profile.oauth2.config;
+import java.time.Duration;
import java.util.Map;
-import java.util.Set;
import java.util.function.BiFunction;
import javax.annotation.Nonnull;
@@ -26,49 +26,48 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-public interface OAuth2TokenProfileConfiguration extends OAuth2ProfileConfiguration{
-
-
- /**
- * Get the enabled grant types.
- *
- * @param profileRequestContext profile request context
- *
- * @return enabled grant types
- */
- @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getGrantTypes(
- @Nullable final ProfileRequestContext profileRequestContext);
-
+/**
+ * Configuration common to access token producing profiles.
+ */
+public interface OAuth2AccessTokenProducingProfileConfiguration {
- /**
- * Get the bi-function for manipulating refresh token claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating refresh token claims set
- *
- * @since 2.1.0
- */
- @Nonnull
- BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getRefreshTokenClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get whether always revoke the refresh_token after it's used.
+ * Get access token type.
*
* @param profileRequestContext profile request context
*
- * @return whether always revoke the refresh_token after it's used
+ * @return access token type, or null for unspecified/opaque
*
* @since 2.1.0
*/
- @Nonnull
- public boolean isEnforceRefreshTokenRotation(
- @Nullable final ProfileRequestContext profileRequestContext)
+ @Nullable @NotEmpty String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get access token lifetime.
+ *
+ * <p>Defaults to 10 minutes.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return access token lifetime
+ */
+ @Positive @Nonnull Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the bi-function for manipulating access token claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating access token claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationClientConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationClientConfiguration.java
deleted file mode 100644
index 95c85ff..0000000
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationClientConfiguration.java
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.oidc.profile.oauth2.config;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.security.credential.ClientSecretCredential;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-
-/**
- * Configuration for an OAuth 2.0 authorization request.
- *
- * <p>This is specific to the role of the client.</p>
- *
- */
-public interface OAuth2AuthorizationClientConfiguration extends OAuth2AuthorizationConfiguration {
-
- /**
- * Get the client credential for the given context. Typically a client_secret
- * associated with the current client_id.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client credential
- *
- * @since 2.2.0
- *
- */
- @Nullable ClientSecretCredential getClientCredential(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the client_id appropriate for the given context. Typically that associated
- * with the chosen OpenID Connect Provider.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the client_id
- *
- * @since 2.2.0
- */
- @Nonnull @NotEmpty String getClientId(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the token endpoint authentication method to use with an OpenID Provider.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the token endpoint authentication method to use.
- *
- * @since 2.2.0
- */
- @Nonnull String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext);
-
-}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java
new file mode 100644
index 0000000..4542cee
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java
@@ -0,0 +1,46 @@
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.time.Duration;
+import java.util.Map;
+import java.util.function.BiFunction;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+
+/**
+ * Configuration common to authorizaton code producing profiles.
+ */
+public interface OAuth2AuthorizationCodeProducingProfileConfiguration {
+
+
+ /**
+ * Get authz code lifetime.
+ *
+ * <p>Defaults to 5 minutes.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return authz code lifetime
+ */
+ @Positive @Nonnull
+ Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the bi-function for manipulating authorization code claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating authorization code claims set
+ *
+ * @since 2.1.0
+ */
+ @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAuthorizationCodeClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationConfiguration.java
index 31f07cd..b1507ba 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationConfiguration.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.oidc.profile.config.OIDCSSOConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
@@ -35,7 +36,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
* <p>This is common to both Authorization Server and Client roles.</p>
*
*/
-public interface OAuth2AuthorizationConfiguration extends OAuth2ProfileConfiguration {
+public interface OAuth2AuthorizationConfiguration extends OIDCSSOConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
@@ -63,17 +64,6 @@ public interface OAuth2AuthorizationConfiguration extends OAuth2ProfileConfigura
*/
@Nullable @NonnullElements @Unmodifiable @NotLive Set<String> getScopes(
@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the response_type to use for authorization requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the response_type
- *
- * @since 2.2.0
- */
- @Nullable @NotEmpty String getResponseType(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the HTTP request method for an authentication request.
@@ -95,59 +85,17 @@ public interface OAuth2AuthorizationConfiguration extends OAuth2ProfileConfigura
* @since 2.2.0
*/
public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether authorization code flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether authorization code flow is supported by this profile
- */
- boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether implicit flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether implicit flow is supported by this profile
- */
- boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether hybrid flow is supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether hybrid flow is supported by this profile
- */
- boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether refresh tokens are supported by this profile.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether refresh tokens are supported by this profile
- */
- boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether client is required to use PKCE.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is required to use PKCE
- */
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether client is allowed to use PKCE code challenge method plain.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is allowed to use PKCE code challenge method plain
- */
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the response_type to use for authorization requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_type
+ *
+ * @since 2.2.0
+ */
+ @Nullable @NotEmpty String getResponseType(@Nullable final ProfileRequestContext profileRequestContext);
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationServerConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationServerConfiguration.java
deleted file mode 100644
index 3125246..0000000
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationServerConfiguration.java
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.oidc.profile.oauth2.config;
-
-import java.time.Duration;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.BiFunction;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-
-/**
- * Configuration for an OAuth 2.0 authorization request.
- *
- * <p>This is specific to the role of the Authorization Server.</p>
- *
- */
-public interface OAuth2AuthorizationServerConfiguration extends OAuth2AuthorizationConfiguration {
-
- /**
- * Get authz code lifetime.
- *
- * <p>Defaults to 5 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return authz code lifetime
- */
- @Positive @Nonnull
- Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-
-
- /**
- * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
- * and/or access/refresh tokens to enable recovery on the back-channel.
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to encode
- */
- @Nonnull @NonnullElements @NotLive Set<String> getEncodedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the bi-function for manipulating authorization code claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating authorization code claims set
- *
- * @since 2.1.0
- */
- @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getAuthorizationCodeClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the bi-function for manipulating access token claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating access token claims set
- *
- * @since 2.1.0
- */
- @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getAccessTokenClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get access token type.
- *
- * @param profileRequestContext profile request context
- *
- * @return access token type, or null for unspecified/opaque
- *
- * @since 2.1.0
- */
- @Nullable @NotEmpty String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get access token lifetime.
- *
- * <p>Defaults to 10 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return access token lifetime
- */
- @Positive @Nonnull Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get refresh token lifetime.
- *
- * <p>Defaults to 2 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return refresh token lifetime
- */
- @Nonnull @Positive Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the enabled token endpoint authentication methods.
- *
- * @param profileRequestContext profile request context
- *
- * @return enabled token endpoint authentication methods
- */
- @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getTokenEndpointAuthMethods(
- @Nullable final ProfileRequestContext profileRequestContext);
-
-
-}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
index 8c2b82c..39e9be1 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -33,6 +34,17 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
/** OAuth 2.0 profile configurations that support OAuth-defined client authentication methods.*/
public interface OAuth2ClientAuthenticableProfileConfiguration extends OAuth2ProfileConfiguration {
+ /**
+ * Get the {@link ClaimsValidator} to apply to JWT-based client authentication.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the validator to use
+ *
+ * @since 3.1.0
+ */
+ @Nullable public ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
+
/**
* Get the enabled token endpoint authentication methods.
*
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
index e0f602b..664a761 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
@@ -17,6 +17,41 @@
package net.shibboleth.oidc.profile.oauth2.config;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/** Common interface for Oauth 2.0 Profile Configurations.*/
public interface OAuth2ProfileConfiguration {
+
+ /**
+ * Get whether authorization code flow is supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether authorization code flow is supported by this profile
+ */
+ boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get whether hybrid flow is supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether hybrid flow is supported by this profile
+ */
+ boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether refresh tokens are supported by this profile.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether refresh tokens are supported by this profile
+ */
+ boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
similarity index 50%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
index e0f602b..e56eb28 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
@@ -17,6 +17,33 @@
package net.shibboleth.oidc.profile.oauth2.config;
-public interface OAuth2ProfileConfiguration {
+import java.time.Duration;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
+
+/**
+ * Configuration common to refresh token producing profiles.
+ */
+public interface OAuth2RefreshTokenProducingProfileConfiguration {
+
+ /**
+ * Get refresh token lifetime.
+ *
+ * <p>Defaults to 2 hours.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return refresh token lifetime
+ */
+ @Nonnull @Positive Duration getRefreshTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ //TODO: can move the getRefreshTokenClaimsSetManipulationStrategy from the OAuth2TokenProfileConfiguration in 3.0.0
+ // to keep consistent with other token producers
+
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenHandlingProfileConfiguration.java
similarity index 63%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenHandlingProfileConfiguration.java
index 2489401..1c2efa5 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenHandlingProfileConfiguration.java
@@ -17,9 +17,7 @@
package net.shibboleth.oidc.profile.oauth2.config;
-import java.util.Map;
import java.util.Set;
-import java.util.function.BiFunction;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -30,45 +28,32 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElemen
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-public interface OAuth2TokenProfileConfiguration extends OAuth2ProfileConfiguration{
-
-
+/** Profile configuration common to generic Token handling.*/
+public interface OAuth2TokenHandlingProfileConfiguration {
+
+
/**
- * Get the enabled grant types.
- *
+ * Get the set of attribute IDs which should be encoded in encrypted form into the authorization code
+ * and/or access/refresh tokens to enable recovery on the back-channel.
+ *
* @param profileRequestContext profile request context
- *
- * @return enabled grant types
+ *
+ * @return the attribute IDs to encode
*/
- @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getGrantTypes(
+ @Nonnull @NonnullElements @NotLive Set<String> getEncodedAttributes(
@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get the bi-function for manipulating refresh token claims set.
+ * Get the enabled token endpoint authentication methods.
*
* @param profileRequestContext profile request context
*
- * @return the bi-function for manipulating refresh token claims set
- *
- * @since 2.1.0
+ * @return enabled token endpoint authentication methods
*/
- @Nonnull
- BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getRefreshTokenClaimsSetManipulationStrategy(
+ @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getTokenEndpointAuthMethods(
@Nullable final ProfileRequestContext profileRequestContext);
- /**
- * Get whether always revoke the refresh_token after it's used.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether always revoke the refresh_token after it's used
- *
- * @since 2.1.0
- */
- @Nonnull
- public boolean isEnforceRefreshTokenRotation(
- @Nullable final ProfileRequestContext profileRequestContext)
-
+
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
index 2489401..92d5fbf 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
@@ -26,11 +26,16 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.oidc.profile.config.OIDCSSOConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-public interface OAuth2TokenProfileConfiguration extends OAuth2ProfileConfiguration{
+/**
+ * OIDC-aware OAuth 2.0 token endpoint profile configuration.
+ */
+public interface OAuth2TokenProfileConfiguration extends OIDCSSOConfiguration,
+ OAuth2RefreshTokenProducingProfileConfiguration {
/**
@@ -44,31 +49,32 @@ public interface OAuth2TokenProfileConfiguration extends OAuth2ProfileConfigurat
@Nullable final ProfileRequestContext profileRequestContext);
+
/**
- * Get the bi-function for manipulating refresh token claims set.
+ * Get whether always revoke the refresh_token after it's used.
*
* @param profileRequestContext profile request context
*
- * @return the bi-function for manipulating refresh token claims set
+ * @return whether always revoke the refresh_token after it's used
*
* @since 2.1.0
*/
@Nonnull
- BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getRefreshTokenClaimsSetManipulationStrategy(
+ public boolean isEnforceRefreshTokenRotation(
@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get whether always revoke the refresh_token after it's used.
+ * Get the bi-function for manipulating refresh token claims set.
*
* @param profileRequestContext profile request context
*
- * @return whether always revoke the refresh_token after it's used
+ * @return the bi-function for manipulating refresh token claims set
*
* @since 2.1.0
*/
@Nonnull
- public boolean isEnforceRefreshTokenRotation(
- @Nullable final ProfileRequestContext profileRequestContext)
+ BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getRefreshTokenClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list