[java-oidc-common] branch dev/JCOMOIDC-66 updated: Add is TLS server validation sufficient to RP profile config

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch dev/JCOMOIDC-66
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=27196c1589635e504e70b70b7264e28a9a3be008

The following commit(s) were added to refs/heads/dev/JCOMOIDC-66 by this push:
     new 27196c1  Add is TLS server validation sufficient to RP profile config
27196c1 is described below

commit 27196c1589635e504e70b70b7264e28a9a3be008
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Mar 29 14:05:36 2023 +0100

    Add is TLS server validation sufficient to RP profile config
---
 ...enticationRelyingPartyProfileConfiguration.java | 15 ++++++++-
 .../DefaultOIDCAuthorizationConfiguration.java     | 37 ++++++++++++++++++++++
 2 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
index 88a05c4..764fc08 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
@@ -89,7 +89,7 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
      * 
      * @since 2.2.0
      */
-    public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext);
+     boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext);
     
     /**
      * Get the redirect_uri override if set.
@@ -101,6 +101,19 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
      * @since 2.2.0
      */
      @Nullable @NotEmpty String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext);
+     
+     /**
+      * Is TLS server validation of the token endpoint sufficient to verify an id_token without checking the id_token
+      * signature.
+      * 
+      * @param profileRequestContext profile request context
+      * 
+      * @return true if TLS server validation is required to verify the id_token. False if the token signature should
+      *                 be validated.
+      * 
+      * @since 2.2.0
+      */
+     boolean isTlsServerValidationSufficient(@Nullable final ProfileRequestContext profileRequestContext);
 
 
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 469fe36..2bf7013 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -130,6 +130,12 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
     
     /** Lookup function to override the default response_mode for a given response_type.*/
     @Nonnull private Function<ProfileRequestContext, String> responseModeLookupStrategy;
+    
+    /**
+     * Whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's 
+     * signature should be validated (false). The default is false, the id_token signature should be validated.
+     */
+    @Nonnull private Predicate<ProfileRequestContext> tlsServerValidationOnlyPredicate;
 
     /**
      * Constructor.
@@ -168,6 +174,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
         loginHintLookupStrategy = FunctionSupport.constant(null);
         userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(HttpRequestMethod.GET.toString());
         responseModeLookupStrategy = FunctionSupport.constant(null);
+        tlsServerValidationOnlyPredicate = Predicates.alwaysFalse();
     }
 
     @Override
@@ -802,5 +809,35 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
     public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext) {
         return responseModeLookupStrategy.apply(profileRequestContext);
     }
+    
+    /**
+     * Set whether TLS server validation alone is sufficient to verify the id_token (true), or whether the id_token's 
+     * signature should be validated (false).
+     * 
+     * @param flag flag to set
+     * 
+     * @since 2.2.0
+     */
+    public void setTlsServerValidationSufficient(final boolean flag) {
+        tlsServerValidationOnlyPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+    }
+
+    /**
+     * Set the predicate to determine whether TLS server validation alone is sufficient to verify the id_token (true), 
+     * or whether the id_token's signature should be validated (false).
+     * 
+     * @param condition condition to set
+     * 
+     * @since 2.2.0
+     */
+    public void setTlsServerValidationSufficient(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        tlsServerValidationOnlyPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+    }
+    
+    @Override
+    public boolean isTlsServerValidationSufficient(final ProfileRequestContext profileRequestContext) {
+        return tlsServerValidationOnlyPredicate.test(profileRequestContext);
+    }
+    
 
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.