[java-oidc-common] 07/18: Complete interface first pass
Phil Smart
philip.smart at jisc.ac.uk
Tue Mar 28 15:26:34 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch dev/JCOMOIDC-66
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=fa15401dba817fc932acf735938e15fe66e97b38
commit fa15401dba817fc932acf735938e15fe66e97b38
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Mar 22 10:21:44 2023 +0000
Complete interface first pass
- Need to adjust logic functions to point to the interfaces
---
oidc-common-crypto-impl/pom.xml | 8 +--
.../oidc/security/impl/AbstractHandlerTest.java | 1 -
.../OIDCAuthenticationProfileConfiguration.java | 18 +------
...AuthenticationProviderProfileConfiguration.java | 17 ------
...IDCDynamicRegistrationProfileConfiguration.java | 8 ++-
...=> OIDCEncryptedTokenProfileConfiguration.java} | 26 ++-------
.../OIDCIDTokenProducingProfileConfiguration.java | 33 +++++++++++-
.../profile/config/OIDCProfileConfiguration.java | 10 ++--
...IDCProviderInformationProfileConfiguration.java | 6 +++
.../OIDCPublishKeySetProfileConfiguration.java | 7 +++
.../config/OIDCSSOProfileConfiguration.java | 20 ++++---
...> OIDCTokenEncryptionProfileConfiguration.java} | 23 ++------
.../config/OIDCUserInfoProfileConfiguration.java | 9 +++-
.../AuthorizationCodeFlowEnabledPredicate.java | 6 ++-
.../config/navigate/GrantTypesLookupFunction.java | 12 +++--
.../OAuth2TokenAudienceProfileConfiguration.java | 36 ++++---------
...uth2TokenIntrospectionProfileConfiguration.java | 11 +++-
.../config/OAuth2TokenProfileConfiguration.java | 7 ++-
.../OAuth2TokenRevocationProfileConfiguration.java | 20 ++++++-
...OAuth2TokenValidatingProfileConfiguration.java} | 20 ++++++-
.../config/impl/AbstractOIDCSSOConfiguration.java | 37 +------------
.../impl/OIDCAuthorizationConfiguration.java | 40 ++++++++++++--
.../impl/OIDCDynamicRegistrationConfiguration.java | 8 +--
.../impl/OIDCProviderInformationConfiguration.java | 8 +--
.../impl/OIDCPublishKeySetConfiguration.java | 9 +---
.../config/impl/OIDCUserInfoConfiguration.java | 10 +---
.../oidc/profile/config/impl/TestInterfaces.java | 44 +++++++++++++++
...AbstractOAuth2TokenValidatingConfiguration.java | 4 +-
.../impl/OAuth2TokenAudienceConfiguration.java | 63 +++++++++++++++++-----
.../config/impl/OAuth2TokenConfiguration.java | 7 +--
.../OAuth2TokenIntrospectionConfiguration.java | 8 +--
.../impl/OAuth2TokenRevocationConfiguration.java | 20 +------
32 files changed, 303 insertions(+), 253 deletions(-)
diff --git a/oidc-common-crypto-impl/pom.xml b/oidc-common-crypto-impl/pom.xml
index 354cb26..7a4ea09 100644
--- a/oidc-common-crypto-impl/pom.xml
+++ b/oidc-common-crypto-impl/pom.xml
@@ -18,13 +18,7 @@
<automatic.module.name>net.shibboleth.oidc.crypto.impl</automatic.module.name>
</properties>
- <dependencies>
- <!-- Do we need this? should not!! -->
- <!-- <dependency>
- <groupId>${opensaml.groupId}</groupId>
- <artifactId>opensaml-xmlsec-impl</artifactId>
- <scope>provided</scope>
- </dependency> -->
+ <dependencies>
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java
index f0b1ce3..641584f 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/AbstractHandlerTest.java
@@ -28,7 +28,6 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
-import net.shibboleth.oidc.profile.config.impl.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.security.impl.support.TestCredentialHelper;
/** Abstract class for tests that require context setup appropriate for message handlers.*/
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
index 860fa07..6fcd98d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
@@ -20,17 +20,13 @@ package net.shibboleth.oidc.profile.config;
import java.security.Principal;
import java.time.Duration;
import java.util.Collection;
-import java.util.Set;
import java.util.function.Function;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
/** Generic configuration for an OIDC 1.0 authentication request.*/
public interface OIDCAuthenticationProfileConfiguration extends OAuth2AuthorizationProfileConfiguration {
@@ -84,18 +80,6 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
*/
@Nullable
public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext);
-
-
- /**
- * Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
- * which the token may be shared.
- *
- * @param profileRequestContext profile request context
- *
- * @return the additional audiences
- */
- @Nonnull @NonnullElements @NotLive Set<String> getAdditionalAudiencesForIdToken(
- @Nullable final ProfileRequestContext profileRequestContext);
-
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderProfileConfiguration.java
index 60e1e2b..0658f1a 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProviderProfileConfiguration.java
@@ -77,22 +77,5 @@ public interface OIDCAuthenticationProviderProfileConfiguration extends OIDCAuth
*/
public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext);
-
-
- /**
- * Get the set of attribute IDs which should be included in the ID token regardless of response_type.
- *
- * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
- * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
- * attributes to be added to the ID token regardless of flow.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return the attribute IDs to include in all cases
- */
- @Nonnull @NonnullElements @NotLive Set<String> getAlwaysIncludedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext);
-
-
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationProfileConfiguration.java
index 208d4fa..d0b2bbc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationProfileConfiguration.java
@@ -30,7 +30,13 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
/**
* Configuration of OpenID Connect Dynamic Client Registration 1.0.
*/
-public interface OIDCDynamicRegistrationProfileConfiguration extends OIDCProfileConfiguration{
+public interface OIDCDynamicRegistrationProfileConfiguration extends OIDCProfileConfiguration {
+
+ /** OIDC base protocol URI. */
+ public static final String PROTOCOL_URI = "https://openid.net/specs/openid-connect-registration-1_0.html";
+
+ /** ID for this profile configuration. */
+ public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/registration";
/**
* Get dynamic registration validity period.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCEncryptedTokenProfileConfiguration.java
similarity index 61%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCEncryptedTokenProfileConfiguration.java
index c7fdf0b..28b9ec7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCEncryptedTokenProfileConfiguration.java
@@ -21,10 +21,11 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-/** Profile configuration generic to all OIDC SSO profiles.*/
-public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
-
-
+/**
+ * Profile configuration for token endpoints that deal with token encryption.
+ */
+public interface OIDCEncryptedTokenProfileConfiguration {
+
/**
* Get whether encryption is optional in the face of a missing key, etc.
*
@@ -34,22 +35,5 @@ public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
*/
boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
- /**
- * Get whether client is required to use PKCE.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is required to use PKCE
- */
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether client is allowed to use PKCE code challenge method plain.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is allowed to use PKCE code challenge method plain
- */
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
index 7539940..fa87e10 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
@@ -19,6 +19,7 @@ package net.shibboleth.oidc.profile.config;
import java.time.Duration;
import java.util.Map;
+import java.util.Set;
import java.util.function.BiFunction;
import javax.annotation.Nonnull;
@@ -26,12 +27,14 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
/**
* Configuration common to ID Token producing profiles.
*/
-public interface OIDCIDTokenProducingProfileConfiguration {
+public interface OIDCIDTokenProducingProfileConfiguration extends OIDCEncryptedTokenProfileConfiguration {
/**
* Get ID token lifetime.
@@ -56,5 +59,31 @@ public interface OIDCIDTokenProducingProfileConfiguration {
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
@Nullable final ProfileRequestContext profileRequestContext);
-
+
+
+ /**
+ * Get the set of attribute IDs which should be included in the ID token regardless of response_type.
+ *
+ * <p>Default behavior is to include claims only with the implicit id_token type only, while any use
+ * of a back-channel relies on the user_info endpoint to get the claims. This setting forces certain
+ * attributes to be added to the ID token regardless of flow.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the attribute IDs to include in all cases
+ */
+ @Nonnull @NonnullElements @NotLive Set<String> getAlwaysIncludedAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the ID Token, with
+ * which the token may be shared.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the additional audiences
+ */
+ @Nonnull @NonnullElements @NotLive Set<String> getAdditionalAudiencesForIdToken(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
index f6cc117..cbad257 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProfileConfiguration.java
@@ -17,12 +17,16 @@
package net.shibboleth.oidc.profile.config;
+import javax.annotation.Nonnull;
+
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ProfileConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/** Common interface for OpenID Connect 1.0 Profile Configurations.*/
-public interface OIDCProfileConfiguration extends OAuth2ProfileConfiguration {
-
+public interface OIDCProfileConfiguration extends OAuth2ProfileConfiguration {
-
+ /** OIDC base protocol URI. */
+ @Nonnull @NotEmpty
+ public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationProfileConfiguration.java
index 1c2a3d5..5c6f441 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCProviderInformationProfileConfiguration.java
@@ -19,5 +19,11 @@ package net.shibboleth.oidc.profile.config;
/** OpenID Connect Provider Configuration.*/
public interface OIDCProviderInformationProfileConfiguration {
+
+ /** OIDC base protocol URI. Section 4 is relevant. */
+ public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-discovery-1_0.html";
+
+ /** ID for this profile configuration. */
+ public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/configuration";
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetProfileConfiguration.java
index b0b3d08..437819a 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCPublishKeySetProfileConfiguration.java
@@ -23,4 +23,11 @@ package net.shibboleth.oidc.profile.config;
*/
public interface OIDCPublishKeySetProfileConfiguration {
+ /** OIDC base protocol URI. Section 3 jwks_uri is the relevant. */
+ public static final String PROTOCOL_URI =
+ "https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata";
+
+ /** ID for this profile configuration. */
+ public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/keyset";
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
index c7fdf0b..af56ea5 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
@@ -17,23 +17,19 @@
package net.shibboleth.oidc.profile.config;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
/** Profile configuration generic to all OIDC SSO profiles.*/
-public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
-
-
- /**
- * Get whether encryption is optional in the face of a missing key, etc.
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff encryption is optional
- */
- boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
+public interface OIDCSSOProfileConfiguration extends OIDCTokenEncryptionProfileConfiguration {
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
+
/**
* Get whether client is required to use PKCE.
*
@@ -51,5 +47,7 @@ public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
* @return whether client is allowed to use PKCE code challenge method plain
*/
public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext);
+
+
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenEncryptionProfileConfiguration.java
similarity index 62%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenEncryptionProfileConfiguration.java
index c7fdf0b..63ab9d8 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCTokenEncryptionProfileConfiguration.java
@@ -21,8 +21,10 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-/** Profile configuration generic to all OIDC SSO profiles.*/
-public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
+/**
+ * Profile configuration for token endpoints that deal with encryption.
+ */
+public interface OIDCTokenEncryptionProfileConfiguration extends OIDCProfileConfiguration {
/**
@@ -34,22 +36,5 @@ public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
*/
boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
- /**
- * Get whether client is required to use PKCE.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is required to use PKCE
- */
- public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether client is allowed to use PKCE code challenge method plain.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether client is allowed to use PKCE code challenge method plain
- */
- public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoProfileConfiguration.java
index 181b0b4..c5fa918 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoProfileConfiguration.java
@@ -25,6 +25,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
/**
@@ -32,7 +33,13 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
*/
//TODO encryption settings move out of extends OIDCSSOProfileConfiguration
-public interface OIDCUserInfoProfileConfiguration {
+public interface OIDCUserInfoProfileConfiguration extends OIDCTokenEncryptionProfileConfiguration {
+
+ /** OIDC base protocol URI. */
+ @Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/userinfo";
/**
* Get the set of attribute IDs which should be omitted from the UserInfo token.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java
index be31cd0..d60bd54 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AuthorizationCodeFlowEnabledPredicate.java
@@ -24,6 +24,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2FlowAwareProfileConfiguration;
/**
@@ -33,12 +34,13 @@ import net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2FlowAwarePro
public class AuthorizationCodeFlowEnabledPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
+ @Override
public boolean test(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOAuth2FlowAwareProfileConfiguration) {
- return ((AbstractOAuth2FlowAwareProfileConfiguration) pc).isAuthorizationCodeFlowEnabled(input);
+ if (pc instanceof OAuth2FlowAwareProfileConfiguration) {
+ return ((OAuth2FlowAwareProfileConfiguration) pc).isAuthorizationCodeFlowEnabled(input);
}
}
return false;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/GrantTypesLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/GrantTypesLookupFunction.java
index f1fff90..d4c0e81 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/GrantTypesLookupFunction.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/GrantTypesLookupFunction.java
@@ -29,8 +29,9 @@ import com.nimbusds.oauth2.sdk.GrantType;
import net.shibboleth.idp.profile.config.ProfileConfiguration;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.oidc.profile.config.impl.OIDCAuthorizationConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.impl.OAuth2TokenConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthenticationProviderProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenProfileConfiguration;
+
/**
* A function that obtains
@@ -44,18 +45,19 @@ import net.shibboleth.oidc.profile.oauth2.config.impl.OAuth2TokenConfiguration;
public class GrantTypesLookupFunction extends AbstractRelyingPartyLookupFunction<Set<GrantType>> {
/** {@inheritDoc} */
+ @Override
@Nullable public Set<GrantType> apply(@Nullable final ProfileRequestContext input) {
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OAuth2TokenConfiguration) {
- final Set<String> types = ((OAuth2TokenConfiguration)pc).getGrantTypes(input);
+ if (pc instanceof OAuth2TokenProfileConfiguration) {
+ final Set<String> types = ((OAuth2TokenProfileConfiguration)pc).getGrantTypes(input);
if (types != null) {
return types.stream()
.map(GrantType::new)
.collect(Collectors.toUnmodifiableSet());
}
- } else if (pc instanceof OIDCAuthorizationConfiguration) {
+ } else if (pc instanceof OIDCAuthenticationProviderProfileConfiguration) {
// For compatibility just return the lone supported type.
return Set.of(GrantType.AUTHORIZATION_CODE, GrantType.REFRESH_TOKEN);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenIntrospectionConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceProfileConfiguration.java
similarity index 55%
copy from oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenIntrospectionConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceProfileConfiguration.java
index 9ea6038..e455beb 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenIntrospectionConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceProfileConfiguration.java
@@ -15,40 +15,26 @@
* limitations under the License.
*/
-package net.shibboleth.oidc.profile.oauth2.config.impl;
-
+package net.shibboleth.oidc.profile.oauth2.config;
import javax.annotation.Nonnull;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenIntrospectionProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCTokenEncryptionProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
- * Profile configuration for the OAuth2 Token Introspection.
+ * Profile interface for OAuth 2 token "audience" profile configuration.
+ *
+ * <p>This applies to behaviour controlling the characteristics of tokens issued
+ * to the parties intended to process them, as distinct from the clients that use them.</p>
*/
-public class OAuth2TokenIntrospectionConfiguration extends AbstractOAuth2TokenValidatingConfiguration implements
- OAuth2TokenIntrospectionProfileConfiguration {
+public interface OAuth2TokenAudienceProfileConfiguration extends OIDCTokenEncryptionProfileConfiguration{
/** OAuth2 Token Revocation URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
+ @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc6749";
/** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
-
- /**
- * Constructor.
- */
- public OAuth2TokenIntrospectionConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public OAuth2TokenIntrospectionConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- }
+ @Nonnull @NotEmpty
+ public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token/audience";
-}
\ No newline at end of file
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionProfileConfiguration.java
index f86680d..62f01f9 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionProfileConfiguration.java
@@ -17,9 +17,18 @@
package net.shibboleth.oidc.profile.oauth2.config;
+import javax.annotation.Nonnull;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
/**
* Profile configuration for OAuth2 Token Introspection.
*/
-public interface OAuth2TokenIntrospectionProfileConfiguration {
+public interface OAuth2TokenIntrospectionProfileConfiguration {
+
+ /** OAuth2 Token Revocation URI. */
+ @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
index 8890106..9ca794c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenProfileConfiguration.java
@@ -28,6 +28,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
@@ -35,8 +36,10 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
* OIDC-aware OAuth 2.0 token endpoint profile configuration.
*/
public interface OAuth2TokenProfileConfiguration extends OIDCSSOProfileConfiguration,
- OAuth2RefreshTokenProducingProfileConfiguration {
-
+ OAuth2RefreshTokenProducingProfileConfiguration {
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token";
/**
* Get the enabled grant types.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationProfileConfiguration.java
index 0b1df61..1e4b32b 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationProfileConfiguration.java
@@ -25,7 +25,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.oidc.profile.oauth2.config.impl.OAuth2TokenRevocationConfiguration.OAuth2TokenRevocationMethod;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
/**
@@ -33,6 +33,24 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
*/
public interface OAuth2TokenRevocationProfileConfiguration {
+ /** OAuth2 Token Revocation URI. */
+ @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7009";
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/revocation";
+
+ /** Enumeration of the OAuth2 token revocation methods. */
+ public enum OAuth2TokenRevocationMethod {
+ /**
+ * Revoke full chain of tokens (from authorization code (or initial access token) onwards).
+ */
+ CHAIN,
+ /**
+ * Revoke single access or refresh token.
+ */
+ TOKEN
+ }
+
/**
* Get the revocation method used when revoking a token.
*
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java
similarity index 58%
copy from oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionProfileConfiguration.java
copy to oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java
index f86680d..d9a7086 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenIntrospectionProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java
@@ -15,11 +15,27 @@
* limitations under the License.
*/
+
package net.shibboleth.oidc.profile.oauth2.config;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+
/**
- * Profile configuration for OAuth2 Token Introspection.
+ * Profile configuration for OIDC-aware OAuth 2.0 token endpoints.
*/
-public interface OAuth2TokenIntrospectionProfileConfiguration {
+public interface OAuth2TokenValidatingProfileConfiguration {
+
+ /**
+ * Get the {@link ClaimsValidator} to apply to issued JWT-based tokens being validated by this profile.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the validator to use
+ */
+ @Nullable ClaimsValidator getIssuedClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 122867d..45f4d0f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -56,10 +56,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
implements OIDCSSOProfileConfiguration, OIDCIDTokenProducingProfileConfiguration,
AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration,
OAuth2AccessTokenProducingProfileConfiguration, OAuth2RefreshTokenProducingProfileConfiguration,
- AttributeResolvingProfileConfiguration {
-
- /** OIDC base protocol URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
+ AttributeResolvingProfileConfiguration {
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
@@ -103,9 +100,6 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
@Nonnull
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
accessTokenClaimsSetManipulationStrategyLookupStrategy;
-
- /** Lookup function to override the default response_mode for a given response_type.*/
- @Nonnull private Function<ProfileRequestContext, String> responseModeLookupStrategy;
/**
* Creates a new configuration instance.
@@ -132,7 +126,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- responseModeLookupStrategy = FunctionSupport.constant(null);
+
}
/** {@inheritDoc} */
@@ -518,32 +512,5 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
"Lookup strategy cannot be null");
}
-
- /**
- * Set the lookup strategy to determine the response_mode for authorization requests.
- *
- * @param strategy the strategy to use
- *
- * @since 2.2.0
- */
- public void setResponseModeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
- responseModeLookupStrategy = Constraint.isNotNull(strategy, "ResponseMode lookup strategy can not be null");
- }
-
- @Override
- public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext) {
- return responseModeLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the response_mode to use for authorization requests.
- *
- * @param responseMode the response_mode to use
- *
- * @since 2.2.0
- */
- public void setResponseMode(@Nonnull final String responseMode) {
- responseModeLookupStrategy = FunctionSupport.constant(responseMode);
- }
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCAuthorizationConfiguration.java
index 42c6b62..d683443 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCAuthorizationConfiguration.java
@@ -38,6 +38,7 @@ import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.oidc.profile.config.OIDCAuthenticationProviderProfileConfiguration;
import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProxyProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationCodeProducingProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenHandlingProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
@@ -50,7 +51,7 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Profile configuration for the OpenID Connect authorization endpoint.
+ * Implementation of a profile configuration for the OpenID Connect authorization endpoint.
*
* <p>It is also usable as a Token endpoint configuration if no non-OIDC use cases are needed.</p>
*/
@@ -60,9 +61,6 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
OAuth2TokenHandlingProfileConfiguration, AuthenticationProfileConfiguration,
OverriddenIssuerProfileConfiguration {
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/sso/browser";
-
/** Whether all acr claim requests should be treated as Essential. */
@Nonnull private Predicate<ProfileRequestContext> acrRequestAlwaysEssentialPredicate;
@@ -135,12 +133,15 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
* Supported values are POST and GET. The default is GET.
*/
@Nonnull private Function<ProfileRequestContext,String> userInfoHttpRequestMethodLookupStrategy;
+
+ /** Lookup function to override the default response_mode for a given response_type.*/
+ @Nonnull private Function<ProfileRequestContext, String> responseModeLookupStrategy;
/**
* Constructor.
*/
public OIDCAuthorizationConfiguration() {
- this(PROFILE_ID);
+ this(OIDCSSOProfileConfiguration.PROFILE_ID);
}
/**
@@ -172,6 +173,7 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
maxAuthenticationAgeLookupStrategy = FunctionSupport.constant(null);
loginHintLookupStrategy = FunctionSupport.constant(null);
userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(HttpRequestMethod.GET.toString());
+ responseModeLookupStrategy = FunctionSupport.constant(null);
}
@Override
@@ -778,5 +780,33 @@ public class OIDCAuthorizationConfiguration extends AbstractOIDCSSOConfiguration
}
return null;
}
+
+
+ /**
+ * Set the lookup strategy to determine the response_mode for authorization requests.
+ *
+ * @param strategy the strategy to use
+ *
+ * @since 2.2.0
+ */
+ public void setResponseModeLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
+ responseModeLookupStrategy = Constraint.isNotNull(strategy, "ResponseMode lookup strategy can not be null");
+ }
+
+ /**
+ * Set the response_mode to use for authorization requests.
+ *
+ * @param responseMode the response_mode to use
+ *
+ * @since 2.2.0
+ */
+ public void setResponseMode(@Nonnull final String responseMode) {
+ responseModeLookupStrategy = FunctionSupport.constant(responseMode);
+ }
+
+ @Override
+ public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext) {
+ return responseModeLookupStrategy.apply(profileRequestContext);
+ }
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCDynamicRegistrationConfiguration.java
index ac0b3c3..a9ba9d1 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCDynamicRegistrationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCDynamicRegistrationConfiguration.java
@@ -36,17 +36,11 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * Profile configuration for the OpenID Connect dynamic client registration.
+ * Implemenation of a profile configuration for the OpenID Connect dynamic client registration.
*/
public class OIDCDynamicRegistrationConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
implements OIDCDynamicRegistrationProfileConfiguration, OverriddenIssuerProfileConfiguration {
- /** OIDC base protocol URI. */
- public static final String PROTOCOL_URI = "https://openid.net/specs/openid-connect-registration-1_0.html";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/registration";
-
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCProviderInformationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCProviderInformationConfiguration.java
index d365b36..454aed7 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCProviderInformationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCProviderInformationConfiguration.java
@@ -32,17 +32,11 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * Profile configuration for the OpenID Connect Provider Configuration.
+ * Implementation of a profile configuration for the OpenID Connect Provider Configuration.
*/
public class OIDCProviderInformationConfiguration extends AbstractConditionalProfileConfiguration
implements OIDCProviderInformationProfileConfiguration, OverriddenIssuerProfileConfiguration {
- /** OIDC base protocol URI. Section 4 is relevant. */
- public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-discovery-1_0.html";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/configuration";
-
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCPublishKeySetConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCPublishKeySetConfiguration.java
index 5cc50c7..06ac6e8 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCPublishKeySetConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCPublishKeySetConfiguration.java
@@ -24,18 +24,11 @@ import net.shibboleth.oidc.profile.config.OIDCPublishKeySetProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
- * Profile configuration for publishing OP key set.
+ * Implementation of a profile configuration for publishing OP key set.
*/
public class OIDCPublishKeySetConfiguration extends AbstractConditionalProfileConfiguration
implements OIDCPublishKeySetProfileConfiguration {
- /** OIDC base protocol URI. Section 3 jwks_uri is the relevant. */
- public static final String PROTOCOL_URI =
- "https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/keyset";
-
/**
* Constructor.
*/
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCUserInfoConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCUserInfoConfiguration.java
index 3688072..c9b71bf 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCUserInfoConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/OIDCUserInfoConfiguration.java
@@ -41,17 +41,11 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Profile configuration for the OpenID Connect core protocol userinfo endpoint.
+ * Implementation of a profile configuration for the OpenID Connect core protocol userinfo endpoint.
*/
public class OIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConfiguration
implements OIDCUserInfoProfileConfiguration, AttributeResolvingProfileConfiguration {
- /** OIDC base protocol URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/userinfo";
-
/** Whether attributes should be resolved in the course of the profile. */
@Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
@@ -65,7 +59,7 @@ public class OIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConf
* Constructor.
*/
public OIDCUserInfoConfiguration() {
- this(PROFILE_ID);
+ this(OIDCUserInfoProfileConfiguration.PROFILE_ID);
}
/**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/TestInterfaces.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/TestInterfaces.java
new file mode 100644
index 0000000..6859483
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/TestInterfaces.java
@@ -0,0 +1,44 @@
+
+package net.shibboleth.oidc.profile.config.impl;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenValidatingProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.impl.OAuth2TokenConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.impl.OAuth2TokenIntrospectionConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.impl.OAuth2TokenRevocationConfiguration;
+
+public class TestInterfaces {
+
+ public static void main(final String args[]) {
+ final var configClass = new OAuth2TokenConfiguration();
+ if (configClass instanceof OAuth2TokenProfileConfiguration) {
+ System.out.println("Interface is: "+configClass);
+ System.out.println("Has method: "+((OAuth2TokenProfileConfiguration)configClass).getRefreshTokenLifetime(new ProfileRequestContext()));
+ }
+ if (configClass instanceof OAuth2RefreshTokenProducingProfileConfiguration) {
+ System.out.println("Interface is: "+configClass);
+ System.out.println("Has method: "+((OAuth2RefreshTokenProducingProfileConfiguration)configClass).getRefreshTokenLifetime(new ProfileRequestContext()));
+ }
+ final var configClassTwo = new OAuth2TokenIntrospectionConfiguration();
+ if (configClassTwo instanceof OverriddenIssuerProfileConfiguration) {
+ System.out.println("Interface is: "+configClassTwo);
+ System.out.println("Has method: "+((OverriddenIssuerProfileConfiguration)configClassTwo).getIssuer(new ProfileRequestContext()));
+ }
+ final var configClassThree = new OIDCAuthorizationConfiguration();
+ if (configClassThree instanceof OIDCAuthenticationRelyingPartyProfileConfiguration) {
+ System.out.println("Interface is: "+configClassThree);
+ System.out.println("Has method: "+((OIDCAuthenticationRelyingPartyProfileConfiguration)configClassThree).getResponseMode(new ProfileRequestContext()));
+ }
+ final var configClassFour = new OAuth2TokenRevocationConfiguration();
+ if (configClassFour instanceof OAuth2TokenValidatingProfileConfiguration) {
+ System.out.println("Interface is: "+configClassFour);
+ System.out.println("Has method: "+((OAuth2TokenValidatingProfileConfiguration)configClassFour).getIssuedClaimsValidator(new ProfileRequestContext()));
+ }
+ }
+
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
index ff0e403..59280d8 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
@@ -26,6 +26,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenValidatingProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
@@ -36,7 +37,7 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
* @since 2.0.0
*/
public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2ClientAuthenticableProfileConfiguration
- implements OverriddenIssuerProfileConfiguration {
+ implements OAuth2TokenValidatingProfileConfiguration, OverriddenIssuerProfileConfiguration {
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
@@ -87,6 +88,7 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
*
* @return the validator to use
*/
+ @Override
@Nullable public ClaimsValidator getIssuedClaimsValidator(
@Nullable final ProfileRequestContext profileRequestContext) {
return issuedClaimsValidatorLookupStrategy.apply(profileRequestContext);
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenAudienceConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenAudienceConfiguration.java
index e895289..fbbe930 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenAudienceConfiguration.java
@@ -18,6 +18,8 @@
package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.time.Duration;
+import java.util.Map;
+import java.util.function.BiFunction;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -32,6 +34,7 @@ import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration
import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -39,21 +42,12 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * Interface for OAuth 2 token "audience" profile configuration.
- *
- * <p>This applies to behavior controlling the characteristics of tokens issued
- * to the parties intended to process them, as distinct from the clients that use them.</p>
+ * Implementation of an OAuth 2.0 token "audience" profile configuration.
*/
public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfileConfiguration
implements OverriddenIssuerProfileConfiguration, OAuth2AccessTokenProducingProfileConfiguration,
- AttributeResolvingProfileConfiguration {
+ AttributeResolvingProfileConfiguration, OAuth2TokenAudienceProfileConfiguration {
- /** OAuth2 Token Revocation URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc6749";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token/audience";
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
@@ -69,11 +63,16 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
/** Lookup function to supply access token lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> accessTokenLifetimeLookupStrategy;
-
+
+ /** Lookup function to supply strategy bi-function for manipulating access token claims set. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ accessTokenClaimsSetManipulationStrategyLookupStrategy;
+
/** Constructor. */
public OAuth2TokenAudienceConfiguration() {
this(PROFILE_ID);
- }
+ }
/**
* Creates a new configuration instance.
@@ -90,6 +89,7 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
+ accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -147,6 +147,7 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
*
* @return true iff encryption is optional
*/
+ @Override
public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptionOptionalPredicate.test(profileRequestContext);
}
@@ -239,5 +240,41 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
@Nullable final Function<ProfileRequestContext,Duration> strategy) {
accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
+ // TODO: This was added in 2.2.0 to be compatible with the access token interface
+ @Override
+ @Nonnull
+ public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return accessTokenClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-function for manipulating access token claims set.
+ *
+ * @param strategy bi-function for manipulating access token claims set
+ *
+ * @since 2.2.0
+ */
+ public void setAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
+ accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-function for manipulating access token claims set.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 2.2.0
+ */
+ public void setAccessTokenClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
+ strategy) {
+ accessTokenClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenConfiguration.java
index f709444..f14af80 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenConfiguration.java
@@ -44,13 +44,10 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
- * OIDC-aware OAuth 2 token endpoint profile configuration.
+ * Implementation of an OIDC-aware OAuth 2 token endpoint profile configuration.
*/
public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration implements OAuth2TokenProfileConfiguration {
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/token";
-
/** Enabled grant types. */
@Nonnull private Function<ProfileRequestContext,Set<String>> grantTypesLookupStrategy;
@@ -66,7 +63,7 @@ public class OAuth2TokenConfiguration extends AbstractOIDCSSOConfiguration imple
* Constructor.
*/
public OAuth2TokenConfiguration() {
- this(PROFILE_ID);
+ this(OAuth2TokenProfileConfiguration.PROFILE_ID);
grantTypesLookupStrategy = FunctionSupport.constant(
Set.of(GrantType.AUTHORIZATION_CODE.toString(), GrantType.REFRESH_TOKEN.toString()));
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenIntrospectionConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenIntrospectionConfiguration.java
index 9ea6038..fbfe948 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenIntrospectionConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenIntrospectionConfiguration.java
@@ -24,16 +24,10 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenIntrospectionProfile
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/**
- * Profile configuration for the OAuth2 Token Introspection.
+ * Implementation of a profile configuration for the OAuth2 Token Introspection.
*/
public class OAuth2TokenIntrospectionConfiguration extends AbstractOAuth2TokenValidatingConfiguration implements
OAuth2TokenIntrospectionProfileConfiguration {
-
- /** OAuth2 Token Revocation URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7662";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/introspection";
/**
* Constructor.
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfiguration.java
index e9a9244..939f8ae 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfiguration.java
@@ -33,29 +33,11 @@ import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
- * Profile configuration for the OAuth2 Token Revocation.
+ * Implementation of a profile configuration for the OAuth2 Token Revocation.
*/
public class OAuth2TokenRevocationConfiguration extends AbstractOAuth2TokenValidatingConfiguration implements
OAuth2TokenRevocationProfileConfiguration {
- /** OAuth2 Token Revocation URI. */
- @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc7009";
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oauth2/revocation";
-
- /** Enumeration of the OAuth2 token revocation methods. */
- public enum OAuth2TokenRevocationMethod {
- /**
- * Revoke full chain of tokens (from authorization code (or initial access token) onwards).
- */
- CHAIN,
- /**
- * Revoke single access or refresh token.
- */
- TOKEN
- }
-
/**
* Which revocation method should be used when revoking a token.
* Supported values are CHAIN and TOKEN. The default is CHAIN.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list