[java-oidc-common] branch main updated: Null cleanup of profile-impl.
Scott Cantor
cantor.2 at osu.edu
Thu Nov 9 18:24:45 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=c1fe2eb7c778dfbb368a103a7e14781b8917dcb6
The following commit(s) were added to refs/heads/main by this push:
new c1fe2eb Null cleanup of profile-impl.
c1fe2eb is described below
commit c1fe2eb7c778dfbb368a103a7e14781b8917dcb6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Nov 9 13:24:41 2023 -0500
Null cleanup of profile-impl.
---
.../impl/AbstractClaimsSetAuditExtractor.java | 11 +-
.../impl/AuthorizationEndpointAuditExtractor.java | 10 +-
.../audit/impl/ClaimSetFromJWTLookupStrategy.java | 11 +-
.../impl/DateBasedJWTClaimAuditExtractor.java | 8 +-
.../audit/impl/ForceAuthnAuditExtractor.java | 31 +++---
.../impl/InboundMessageClassLookupFunction.java | 12 +--
.../profile/audit/impl/NonceAuditExtractor.java | 11 +-
.../impl/OutboundMessageClassLookupFunction.java | 12 +--
.../audit/impl/RedirectURIAuditExtractor.java | 10 +-
.../audit/impl/ResponseModeAuditExtractor.java | 11 +-
.../audit/impl/ResponseTypeAuditExtractor.java | 12 +--
.../profile/audit/impl/ScopeAuditExtractor.java | 4 +-
.../impl/StringBasedJWTClaimAuditExtractor.java | 7 +-
.../StringListBasedJWTClaimAuditExtractor.java | 7 +-
.../config/impl/AbstractOIDCSSOConfiguration.java | 45 +++++---
.../DefaultOIDCAuthorizationConfiguration.java | 25 ++++-
...efaultOIDCDynamicRegistrationConfiguration.java | 11 +-
.../impl/DefaultOIDCUserInfoConfiguration.java | 23 ++--
.../impl/HTTPPostAuthnResponseDecoder.java | 7 +-
.../impl/HTTPRedirectAuthnResponseDecoder.java | 4 +-
.../encoding/impl/AbstractOIDCMessageEncoder.java | 117 +++++++++++++--------
.../encoding/impl/HTTPPostAuthnRequestEncoder.java | 35 +++---
.../impl/HTTPRedirectAuthnRequestEncoder.java | 30 ++++--
.../encoding/impl/OIDCResponseEncoderFactory.java | 2 +-
.../encoding/impl/SimpleNimbusResponseEncoder.java | 16 +--
.../impl/AbstractBuildErrorResponseFromEvent.java | 25 +++--
...AuthenticationRequestMessageEncoderFactory.java | 22 ++--
.../impl/BuildJSONErrorResponseFromEvent.java | 9 +-
.../impl/FormOutboundKeySetResponseMessage.java | 10 +-
.../impl/PopulateJWTDecryptionParameters.java | 17 +--
.../impl/PopulateJWTEncryptionParameters.java | 57 +++++-----
.../PopulateJWTSignatureSigningParameters.java | 24 +++--
...pulateJWTSignatureSigningParametersHandler.java | 32 ++++--
.../PopulateJWTSignatureValidationParameters.java | 13 +--
...ateJWTSignatureValidationParametersHandler.java | 5 +-
...entIDFromOIDCMetadataContextLookupFunction.java | 3 +-
...mOIDCProviderMetadataContextLookupFunction.java | 4 +-
...th2ClientAuthenticableProfileConfiguration.java | 41 ++++----
...bstractOAuth2FlowAwareProfileConfiguration.java | 26 +++--
.../DefaultOAuth2TokenAudienceConfiguration.java | 19 ++--
.../impl/DefaultOAuth2TokenConfiguration.java | 34 +++---
.../DefaultOAuth2TokenRevocationConfiguration.java | 7 +-
.../audit/impl/ForceAuthnAuditExtractorTest.java | 25 +++--
.../impl/OIDCCoreProtocolConfigurationTest.java | 11 +-
.../impl/HTTPPostAuthnResponseDecoderTest.java | 24 ++---
.../impl/HTTPRedirectAuthnResponseDecoderTest.java | 26 ++---
.../impl/HTTPPostAuthnRequestEncoderTest.java | 4 +-
.../impl/HTTPRedirectAuthnRequestEncoderTest.java | 9 +-
.../impl/SimpleNimbusResponseEncoderTest.java | 1 +
...enticationRequestMessageEncoderFactoryTest.java | 1 +
.../FormOutboundKeySetResponseMessageTest.java | 12 +--
.../OAuth2TokenRevocationConfigurationTest.java | 1 +
52 files changed, 533 insertions(+), 401 deletions(-)
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractClaimsSetAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractClaimsSetAuditExtractor.java
index 747b9eb..9e07e56 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractClaimsSetAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AbstractClaimsSetAuditExtractor.java
@@ -25,7 +25,6 @@ import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
@@ -35,6 +34,7 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An abstract audit extractor function to extract claims from the located claims set.
@@ -55,6 +55,7 @@ public abstract class AbstractClaimsSetAuditExtractor<T> extends AbstractInitial
@NonnullAfterInit @GuardedBy("this") private Function<ProfileRequestContext, ClaimsSet> claimsSetLookupStrategy;
+ /** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
@@ -72,7 +73,7 @@ public abstract class AbstractClaimsSetAuditExtractor<T> extends AbstractInitial
*
* @return the claim name.
*/
- protected synchronized String getClaimName() {
+ @NonnullAfterInit protected synchronized String getClaimName() {
return claimName;
}
@@ -106,7 +107,7 @@ public abstract class AbstractClaimsSetAuditExtractor<T> extends AbstractInitial
*
* @return the strategy
*/
- private synchronized Function<ProfileRequestContext, ClaimsSet> getClaimsSetLookupStrategy() {
+ @NonnullAfterInit private synchronized Function<ProfileRequestContext, ClaimsSet> getClaimsSetLookupStrategy() {
return claimsSetLookupStrategy;
}
@@ -121,7 +122,7 @@ public abstract class AbstractClaimsSetAuditExtractor<T> extends AbstractInitial
*/
@Nullable protected abstract T doLookup(final @Nonnull ClaimsSet req) throws ParseException;
- @Override
+ /** {@inheritDoc} */
@Nullable public T apply(@Nullable final ProfileRequestContext input) {
final ClaimsSet claims = getClaimsSetLookupStrategy().apply(input);
@@ -136,4 +137,4 @@ public abstract class AbstractClaimsSetAuditExtractor<T> extends AbstractInitial
return null;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthorizationEndpointAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthorizationEndpointAuditExtractor.java
index 5e0f513..6058eb9 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthorizationEndpointAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/AuthorizationEndpointAuditExtractor.java
@@ -14,6 +14,7 @@
package net.shibboleth.oidc.profile.audit.impl;
+import java.net.URI;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -37,12 +38,11 @@ public class AuthorizationEndpointAuditExtractor extends AbstractAuthenticationR
}
/** {@inheritDoc} */
- @Override
- @Nullable
- public String apply(@Nullable final ProfileRequestContext input) {
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
- if (request != null && request.getEndpointURI() != null) {
- return request.getEndpointURI().toString();
+ if (request != null) {
+ final URI uri = request.getEndpointURI();
+ return uri != null ? uri.toString() : null;
}
return null;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java
index 2d4d82a..f87283d 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ClaimSetFromJWTLookupStrategy.java
@@ -22,7 +22,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -30,16 +29,16 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/** Strategy to pull out a ClaimsSet from a located JWT.*/
public class ClaimSetFromJWTLookupStrategy implements Function<ProfileRequestContext, ClaimsSet> {
/** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(ClaimSetFromJWTLookupStrategy.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ClaimSetFromJWTLookupStrategy.class);
/** Strategy used to lookup the JWT to retrieve the claimsset from.*/
- private final Function<ProfileRequestContext, JWT> jwtLookupStrategy;
+ @Nonnull private final Function<ProfileRequestContext, JWT> jwtLookupStrategy;
/**
*
@@ -53,7 +52,7 @@ public class ClaimSetFromJWTLookupStrategy implements Function<ProfileRequestCon
Constraint.isNotNull(strategy, "JWT lookup strategy can not be null");
}
- @Override
+ /** {@inheritDoc} */
@Nullable public ClaimsSet apply(@Nullable final ProfileRequestContext input) {
final JWT locatedJwt = jwtLookupStrategy.apply(input);
if (locatedJwt == null) {
@@ -73,4 +72,4 @@ public class ClaimSetFromJWTLookupStrategy implements Function<ProfileRequestCon
return null;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java
index adc95c2..4d61fa6 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/DateBasedJWTClaimAuditExtractor.java
@@ -23,11 +23,11 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/** A JWT claim extractor function that returns a formatted String representation of the JSON Date.*/
@@ -57,8 +57,9 @@ public class DateBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtra
}
}
+ /** {@inheritDoc} */
@Override
- protected String doLookup(final ClaimsSet claimsSet) throws ParseException {
+ @Nullable protected String doLookup(@Nonnull final ClaimsSet claimsSet) throws ParseException {
final Date dateClaim = claimsSet.getDateClaim(getClaimName());
if (dateClaim == null) {
log.trace("Date claim '{}' was null", getClaimName());
@@ -71,4 +72,5 @@ public class DateBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtra
return null;
}
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java
index 2e6493c..2df2a93 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractor.java
@@ -26,42 +26,39 @@ import com.nimbusds.openid.connect.sdk.Prompt;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
-/** {@link Function} that returns true if the OIDC prompt is set as 'login' in the authentication request. Both
- * {@link OIDCAuthenticationRequest} and {@link AuthenticationRequest} are supported. */
+/**
+ * {@link Function} that returns true if the OIDC prompt is set as 'login' in the authentication request. Both
+ * {@link OIDCAuthenticationRequest} and {@link AuthenticationRequest} are supported.
+ */
public class ForceAuthnAuditExtractor implements Function<ProfileRequestContext, Boolean> {
/** Lookup strategy to locate the authentication request. */
- @Nonnull
- private final Function<ProfileRequestContext, Object> requestLookupStrategy;
+ @Nonnull private final Function<ProfileRequestContext, Object> requestLookupStrategy;
/**
* Constructor.
*
* @param strategy lookup strategy for locating the authentication request
*/
- public ForceAuthnAuditExtractor(
- @Nonnull final Function<ProfileRequestContext, Object> strategy) {
+ public ForceAuthnAuditExtractor(@Nonnull final Function<ProfileRequestContext, Object> strategy) {
requestLookupStrategy = strategy;
}
/** {@inheritDoc} */
- @Override
- @Nullable
- public Boolean apply(@Nullable final ProfileRequestContext input) {
+ @Nullable public Boolean apply(@Nullable final ProfileRequestContext input) {
final Object requestObject = requestLookupStrategy.apply(input);
if (requestObject == null) {
return null;
}
- if (requestObject instanceof OIDCAuthenticationRequest) {
- final OIDCAuthenticationRequest request = (OIDCAuthenticationRequest) requestObject;
- if (request.getPrompt() != null) {
- return request.getPrompt().contains(Prompt.Type.LOGIN);
+ if (requestObject instanceof OIDCAuthenticationRequest req) {
+ final Prompt prompt = req.getPrompt();
+ if (prompt != null) {
+ return prompt.contains(Prompt.Type.LOGIN);
}
}
- if (requestObject instanceof AuthenticationRequest) {
- final AuthenticationRequest request = (AuthenticationRequest) requestObject;
- if (request.getPrompt() != null) {
- return request.getPrompt().contains(Prompt.Type.LOGIN);
+ if (requestObject instanceof AuthenticationRequest req) {
+ if (req.getPrompt() != null) {
+ return req.getPrompt().contains(Prompt.Type.LOGIN);
}
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/InboundMessageClassLookupFunction.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/InboundMessageClassLookupFunction.java
index 280caac..f5da682 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/InboundMessageClassLookupFunction.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/InboundMessageClassLookupFunction.java
@@ -16,7 +16,6 @@ package net.shibboleth.oidc.profile.audit.impl;
import java.util.function.Function;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -31,15 +30,16 @@ public class InboundMessageClassLookupFunction implements Function<ProfileReques
*
* {@inheritDoc}
*/
- @Nullable
- public String apply(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (profileRequestContext.getInboundMessageContext() == null) {
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
+ if (input == null || input.getInboundMessageContext() == null) {
return null;
}
- final Object message = profileRequestContext.getInboundMessageContext().getMessage();
+
+ final Object message = input.ensureInboundMessageContext().getMessage();
if (message == null) {
return null;
}
return message.getClass().getSimpleName();
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/NonceAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/NonceAuditExtractor.java
index ba826cc..6426db8 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/NonceAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/NonceAuditExtractor.java
@@ -21,6 +21,8 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.openid.connect.sdk.Nonce;
+
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
/** {@link Function} that extracts nonce in the {@link OIDCAuthenticationRequest}. */
@@ -36,12 +38,11 @@ public class NonceAuditExtractor extends AbstractAuthenticationRequestAuditExtra
}
/** {@inheritDoc} */
- @Override
- @Nullable
- public String apply(@Nullable final ProfileRequestContext input) {
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
- if (request != null && request.getNonce() != null) {
- return request.getNonce().getValue();
+ if (request != null) {
+ final Nonce nonce = request.getNonce();
+ return nonce != null ? nonce.getValue() : null;
}
return null;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/OutboundMessageClassLookupFunction.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/OutboundMessageClassLookupFunction.java
index a3b6e5c..c8fdd0f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/OutboundMessageClassLookupFunction.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/OutboundMessageClassLookupFunction.java
@@ -16,7 +16,6 @@ package net.shibboleth.oidc.profile.audit.impl;
import java.util.function.Function;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -38,15 +37,16 @@ public class OutboundMessageClassLookupFunction implements Function<ProfileReque
*
* {@inheritDoc}
*/
- @Nullable @Override
- public String apply(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (profileRequestContext.getOutboundMessageContext() == null) {
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
+ if (input == null || input.getOutboundMessageContext() == null) {
return null;
}
- final Object message = profileRequestContext.getOutboundMessageContext().getMessage();
+
+ final Object message = input.ensureOutboundMessageContext().getMessage();
if (message == null) {
return null;
}
return message.getClass().getSimpleName();
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/RedirectURIAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/RedirectURIAuditExtractor.java
index 3f8044f..7ff90e1 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/RedirectURIAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/RedirectURIAuditExtractor.java
@@ -14,6 +14,7 @@
package net.shibboleth.oidc.profile.audit.impl;
+import java.net.URI;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -37,12 +38,11 @@ public class RedirectURIAuditExtractor extends AbstractAuthenticationRequestAudi
}
/** {@inheritDoc} */
- @Override
- @Nullable
- public String apply(@Nullable final ProfileRequestContext input) {
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
- if (request != null && request.getRedirectURI() != null) {
- return request.getRedirectURI().toString();
+ if (request != null) {
+ final URI uri = request.getRedirectURI();
+ return uri != null ? uri.toString() : null;
}
return null;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseModeAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseModeAuditExtractor.java
index b986387..050ee7f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseModeAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseModeAuditExtractor.java
@@ -21,6 +21,8 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.oauth2.sdk.ResponseMode;
+
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
/** {@link Function} that extracts response_mode in the {@link OIDCAuthenticationRequest}. */
@@ -37,12 +39,11 @@ public class ResponseModeAuditExtractor extends AbstractAuthenticationRequestAud
}
/** {@inheritDoc} */
- @Override
- @Nullable
- public String apply(@Nullable final ProfileRequestContext input) {
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
- if (request != null && request.getResponseMode() != null) {
- return request.getResponseMode().getValue();
+ if (request != null) {
+ final ResponseMode mode = request.getResponseMode();
+ return mode != null ? mode.getValue() : null;
}
return null;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseTypeAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseTypeAuditExtractor.java
index 4d82037..d3607d2 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseTypeAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ResponseTypeAuditExtractor.java
@@ -21,12 +21,13 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.oauth2.sdk.ResponseType;
+
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
/** {@link Function} that extracts response_type in the {@link OIDCAuthenticationRequest}. */
public class ResponseTypeAuditExtractor extends AbstractAuthenticationRequestAuditExtractor<String> {
-
/**
* Constructor.
*
@@ -38,12 +39,11 @@ public class ResponseTypeAuditExtractor extends AbstractAuthenticationRequestAud
}
/** {@inheritDoc} */
- @Override
- @Nullable
- public String apply(@Nullable final ProfileRequestContext input) {
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
- if (request != null && request.getResponseType() != null) {
- return request.getResponseType().toString();
+ if (request != null) {
+ final ResponseType type = request.getResponseType();
+ return type != null ? type.toString() : null;
}
return null;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ScopeAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ScopeAuditExtractor.java
index 0a5d980..c0b09e9 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ScopeAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/ScopeAuditExtractor.java
@@ -36,9 +36,7 @@ public class ScopeAuditExtractor extends AbstractAuthenticationRequestAuditExtra
}
/** {@inheritDoc} */
- @Override
- @Nullable
- public String apply(@Nullable final ProfileRequestContext input) {
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
final OIDCAuthenticationRequest request = getRequestLookupStrategy().apply(input);
if (request != null) {
return request.getScope().toString();
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java
index 341f04f..971f41d 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringBasedJWTClaimAuditExtractor.java
@@ -16,6 +16,7 @@ package net.shibboleth.oidc.profile.audit.impl;
import java.text.ParseException;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
@@ -23,8 +24,10 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
/** A JWT claim extractor function that returns String objects.*/
public class StringBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtractor<String> {
+ /** {@inheritDoc} */
@Override
- @Nullable protected String doLookup(final ClaimsSet claimsSet) throws ParseException {
+ @Nullable protected String doLookup(@Nonnull final ClaimsSet claimsSet) throws ParseException {
return claimsSet.getStringClaim(getClaimName());
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java
index 1b915fa..864e0bf 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/audit/impl/StringListBasedJWTClaimAuditExtractor.java
@@ -17,6 +17,7 @@ package net.shibboleth.oidc.profile.audit.impl;
import java.text.ParseException;
import java.util.List;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
@@ -24,8 +25,10 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
/** A JWT claim extractor function that returns lists of string objects.*/
public class StringListBasedJWTClaimAuditExtractor extends AbstractClaimsSetAuditExtractor<List<String>> {
+ /** {@inheritDoc} */
@Override
- @Nullable protected List<String> doLookup(final ClaimsSet claimsSet) throws ParseException {
+ @Nullable protected List<String> doLookup(@Nonnull final ClaimsSet claimsSet) throws ParseException {
return claimsSet.getStringListClaim(getClaimName());
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 20e89da..4b3797b 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -16,7 +16,6 @@ package net.shibboleth.oidc.profile.config.impl;
import java.time.Duration;
import java.util.Collection;
-import java.util.Collections;
import java.util.Map;
import java.util.Set;
import java.util.function.BiFunction;
@@ -28,8 +27,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
-
import net.shibboleth.oidc.profile.config.OIDCSSOProviderConfiguration;
import net.shibboleth.oidc.profile.config.OIDCSSORelyingPartyConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2FlowAwareProfileConfiguration;
@@ -37,8 +34,10 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Positive;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -101,11 +100,11 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
public AbstractOIDCSSOConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
issuerLookupStrategy = FunctionSupport.constant(null);
- resolveAttributesPredicate = Predicates.alwaysTrue();
- encryptionOptionalPredicate = Predicates.alwaysTrue();
+ resolveAttributesPredicate = PredicateSupport.alwaysTrue();
+ encryptionOptionalPredicate = PredicateSupport.alwaysTrue();
- forcePKCEPredicate = Predicates.alwaysFalse();
- allowPKCEPlainPredicate = Predicates.alwaysFalse();
+ forcePKCEPredicate = PredicateSupport.alwaysFalse();
+ allowPKCEPlainPredicate = PredicateSupport.alwaysFalse();
idTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(1));
accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
@@ -158,7 +157,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
* @param flag flag to set
*/
public void setResolveAttributes(final boolean flag) {
- resolveAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ resolveAttributesPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -170,6 +169,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptionOptionalPredicate.test(profileRequestContext);
@@ -181,7 +181,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
* @param flag flag to set
*/
public void setEncryptionOptional(final boolean flag) {
- encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ encryptionOptionalPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -193,6 +193,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext) {
return forcePKCEPredicate.test(profileRequestContext);
@@ -204,7 +205,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
* @param flag flag to set
*/
public void setForcePKCE(final boolean flag) {
- forcePKCEPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ forcePKCEPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -216,6 +217,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
forcePKCEPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext) {
return allowPKCEPlainPredicate.test(profileRequestContext);
@@ -227,7 +229,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
* @param flag flag to set
*/
public void setAllowPKCEPlain(final boolean flag) {
- allowPKCEPlainPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ allowPKCEPlainPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -239,6 +241,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
allowPKCEPlainPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Positive @Nonnull public Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -246,6 +249,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
"ID token lifetime must be greater than 0");
+ assert lifetime != null;
return lifetime;
}
@@ -270,6 +274,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
idTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nullable @NotEmpty public String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext) {
return accessTokenTypeLookupStrategy.apply(profileRequestContext);
@@ -297,6 +302,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Positive @Nonnull
public Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -304,6 +310,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
"Access token lifetime must be greater than 0");
+ assert lifetime != null;
return lifetime;
}
@@ -329,6 +336,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nonnull @Positive
public Duration getRefreshTokenTimeout(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -336,6 +344,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
Constraint.isTrue(timeout != null && !timeout.isZero() && !timeout.isNegative(),
"Refresh token timeout must be greater than 0");
+ assert timeout != null;
return timeout;
}
@@ -365,6 +374,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
refreshTokenTimeoutLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nonnull @Positive
public Duration getRefreshTokenChainLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -372,6 +382,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
"Refresh token chain lifetime must be greater than 0");
+ assert lifetime != null;
return lifetime;
}
@@ -401,15 +412,16 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
refreshTokenChainLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForIdToken(
@Nullable final ProfileRequestContext profileRequestContext) {
final Set<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
if (audiences != null) {
- return Set.copyOf(audiences);
+ return CollectionSupport.copyToSet(audiences);
}
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
/**
@@ -439,15 +451,16 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nonnull @NonnullElements @NotLive public Set<String> getAlwaysIncludedAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
final Set<String> attributes = alwaysIncludedAttributesLookupStrategy.apply(profileRequestContext);
if (attributes != null) {
- return Set.copyOf(attributes);
+ return CollectionSupport.copyToSet(attributes);
}
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
/**
@@ -480,6 +493,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
alwaysIncludedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
@@ -512,6 +526,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
idTokenManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 2689d6f..91edae7 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -180,6 +180,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
displayLookupStrategy = FunctionSupport.constant(null);
}
+ /** {@inheritDoc} */
@Override
public boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext) {
return acrRequestAlwaysEssentialPredicate.test(profileRequestContext);
@@ -203,6 +204,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
acrRequestAlwaysEssentialPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
return useRequestObjectPredicate.test(profileRequestContext);
@@ -228,6 +230,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
useRequestObjectPredicate = Constraint.isNotNull(condition, "Use request object condition cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext) {
return encodeConsentInTokensPredicate.test(profileRequestContext);
@@ -251,6 +254,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
encodeConsentInTokensPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext) {
return retrieveUserInfoEndpointClaims.test(profileRequestContext);
@@ -278,6 +282,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
retrieveUserInfoEndpointClaims = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isSignRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
return signRequestObjectPredicate.test(profileRequestContext);
@@ -305,6 +310,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
signRequestObjectPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptRequestObjectPredicate.test(profileRequestContext);
@@ -359,11 +365,13 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
}
}
+ /** {@inheritDoc} */
@Override
public String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext) {
return redirectUriOverrideLookupStrategy.apply(profileRequestContext);
}
+ /** {@inheritDoc} */
@Override
@Positive @Nonnull
public Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -371,6 +379,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
"Authorization code lifetime must be greater than 0");
+ assert lifetime != null;
return lifetime;
}
@@ -416,6 +425,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
httpRequestMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
}
+ /** {@inheritDoc} */
@Override
public HttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext) {
final String method = httpRequestMethodLookupStrategy.apply(profileRequestContext);
@@ -430,6 +440,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
return null;
}
+ /** {@inheritDoc} */
@Override
@Nonnull @NonnullElements @NotLive public Set<String> getEncodedAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -468,6 +479,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
encodedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nonnull @NonnullElements @NotLive public Set<String> getDeniedUserInfoAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -507,6 +519,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
deniedUserInfoAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext) {
return includeIssuerInResponsePredicate.test(profileRequestContext);
@@ -556,12 +569,13 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
responseTypeLookupStrategy = FunctionSupport.constant(responseType);
}
-
+ /** {@inheritDoc} */
@Override
public String getResponseType(@Nullable final ProfileRequestContext profileRequestContext) {
return responseTypeLookupStrategy.apply(profileRequestContext);
}
+ /** {@inheritDoc} */
@Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
@@ -623,6 +637,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
}
}
+ /** {@inheritDoc} */
@Override
@Nullable public Set<String> getScopes(@Nullable final ProfileRequestContext profileRequestContext) {
return scopesLookupStrategy.apply(profileRequestContext);
@@ -642,6 +657,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
amrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nullable public Function<Collection<String>,Collection<Principal>>
getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc){
@@ -662,12 +678,14 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
acrTranslationStrategyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nullable public Function<Collection<String>,Collection<Principal>>
getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc){
return acrTranslationStrategyLookupStrategy.apply(prc);
}
+ /** {@inheritDoc} */
@Override
public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext) {
return proxiedAuthnInstantPredicate.test(profileRequestContext);
@@ -686,6 +704,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
proxiedAuthnInstantPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
+ /** {@inheritDoc} */
@Override
@Nullable
public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -741,6 +760,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
loginHintLookupStrategy = FunctionSupport.constant(fixedLoginHint);
}
+ /** {@inheritDoc} */
@Override
@Nullable public String getLoginHint(@Nullable final ProfileRequestContext profileRequestContext) {
return loginHintLookupStrategy.apply(profileRequestContext);
@@ -770,6 +790,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
}
+ /** {@inheritDoc} */
@Override
@Nullable public HttpRequestMethod getUserInfoHttpRequestMethod(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -808,6 +829,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
responseModeLookupStrategy = FunctionSupport.constant(responseMode);
}
+ /** {@inheritDoc} */
@Override
public String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext) {
return responseModeLookupStrategy.apply(profileRequestContext);
@@ -837,6 +859,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
tlsServerValidationOnlyPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isTlsServerValidationSufficient(@Nullable final ProfileRequestContext profileRequestContext) {
return tlsServerValidationOnlyPredicate.test(profileRequestContext);
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
index 465f1bf..34663ac 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
@@ -47,10 +47,10 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
@Nonnull private Function<ProfileRequestContext,Duration> registrationValidityPeriodLookupStrategy;
/** Lookup function to supply client secret expiration period. */
- @Nullable private Function<ProfileRequestContext,Duration> secretExpirationPeriodLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,Duration> secretExpirationPeriodLookupStrategy;
/** Lookup function to the default metadata policy. */
- @Nullable private Function<ProfileRequestContext,Map<String,MetadataPolicy>> metadataPolicyLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,Map<String,MetadataPolicy>> metadataPolicyLookupStrategy;
/**
* Constructor.
@@ -67,8 +67,8 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
public DefaultOIDCDynamicRegistrationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
issuerLookupStrategy = FunctionSupport.constant(null);
- setRegistrationValidityPeriod(Duration.ofHours(24));
- setSecretExpirationPeriod(Duration.ofDays(365));
+ registrationValidityPeriodLookupStrategy = FunctionSupport.constant(Duration.ofHours(24));
+ secretExpirationPeriodLookupStrategy = FunctionSupport.constant(Duration.ofDays(365));
metadataPolicyLookupStrategy = FunctionSupport.constant(null);
registrationValidityPeriodLookupStrategy = FunctionSupport.constant(null);
}
@@ -97,6 +97,7 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nullable @NonNegative
public Duration getRegistrationValidityPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -132,6 +133,7 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
registrationValidityPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nullable @NonNegative
public Duration getSecretExpirationPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -166,6 +168,7 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
secretExpirationPeriodLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nullable
public Map<String,MetadataPolicy> getMetadataPolicy(@Nullable final ProfileRequestContext profileRequestContext) {
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCUserInfoConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCUserInfoConfiguration.java
index 6099354..e4a4cd3 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCUserInfoConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCUserInfoConfiguration.java
@@ -15,7 +15,6 @@
package net.shibboleth.oidc.profile.config.impl;
import java.util.Collection;
-import java.util.Collections;
import java.util.Set;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -25,15 +24,15 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
-
import net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2TokenValidatingConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -43,6 +42,9 @@ import net.shibboleth.shared.primitive.StringSupport;
public class DefaultOIDCUserInfoConfiguration extends AbstractOAuth2TokenValidatingConfiguration
implements OIDCUserInfoConfiguration {
+ /** OIDC UserInfo profile counter name. */
+ @Nonnull @NotEmpty public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.oidc.userinfo";
+
/** Whether attributes should be resolved in the course of the profile. */
@Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
@@ -52,9 +54,6 @@ public class DefaultOIDCUserInfoConfiguration extends AbstractOAuth2TokenValidat
/** Lookup function to supply attribute IDs to omit from UserInfo token. */
@Nonnull private Function<ProfileRequestContext,Set<String>> deniedUserInfoAttributesLookupStrategy;
- /** OIDC UserInfo profile counter name. */
- @Nonnull @NotEmpty public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.oidc.userinfo";
-
/**
* Constructor.
*/
@@ -70,8 +69,8 @@ public class DefaultOIDCUserInfoConfiguration extends AbstractOAuth2TokenValidat
public DefaultOIDCUserInfoConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- resolveAttributesPredicate = Predicates.alwaysTrue();
- encryptionOptionalPredicate = Predicates.alwaysTrue();
+ resolveAttributesPredicate = PredicateSupport.alwaysTrue();
+ encryptionOptionalPredicate = PredicateSupport.alwaysTrue();
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
}
@@ -87,7 +86,7 @@ public class DefaultOIDCUserInfoConfiguration extends AbstractOAuth2TokenValidat
* @param flag flag to set
*/
public void setResolveAttributes(final boolean flag) {
- resolveAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ resolveAttributesPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -110,7 +109,7 @@ public class DefaultOIDCUserInfoConfiguration extends AbstractOAuth2TokenValidat
* @param flag flag to set
*/
public void setEncryptionOptional(final boolean flag) {
- encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ encryptionOptionalPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -128,9 +127,9 @@ public class DefaultOIDCUserInfoConfiguration extends AbstractOAuth2TokenValidat
final Set<String> attributes = deniedUserInfoAttributesLookupStrategy.apply(profileRequestContext);
if (attributes != null) {
- return Set.copyOf(attributes);
+ return CollectionSupport.copyToSet(attributes);
}
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
/**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoder.java
index 4f5bf86..708436f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoder.java
@@ -24,7 +24,6 @@ import org.opensaml.messaging.decoder.MessageDecoder;
import org.opensaml.messaging.decoder.MessageDecodingException;
import org.opensaml.messaging.decoder.servlet.AbstractHttpServletRequestMessageDecoder;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.http.JakartaServletUtils;
@@ -33,6 +32,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationResponseParser;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.oidc.profile.decoding.OIDCMessageDecoder;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A {@link MessageDecoder message decoder} that decodes an incoming {@link AuthenticationResponse}
@@ -70,8 +70,9 @@ public class HTTPPostAuthnResponseDecoder extends AbstractHttpServletRequestMess
/** {@inheritDoc} */
@Override
@Nullable
- protected String serializeMessageForLogging(@Nullable Object message) {
+ protected String serializeMessageForLogging(@Nullable final Object message) {
// Returning null disables log output. If want protocol message logging, need to implement this.
return null;
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/HTTPRedirectAuthnResponseDecoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/HTTPRedirectAuthnResponseDecoder.java
index 77db683..c3e0ae6 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/HTTPRedirectAuthnResponseDecoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/HTTPRedirectAuthnResponseDecoder.java
@@ -24,7 +24,6 @@ import org.opensaml.messaging.decoder.MessageDecoder;
import org.opensaml.messaging.decoder.MessageDecodingException;
import org.opensaml.messaging.decoder.servlet.AbstractHttpServletRequestMessageDecoder;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.http.JakartaServletUtils;
@@ -33,6 +32,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationResponseParser;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.oidc.profile.decoding.OIDCMessageDecoder;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -71,7 +71,7 @@ public class HTTPRedirectAuthnResponseDecoder extends AbstractHttpServletRequest
/** {@inheritDoc} */
@Override
@Nullable
- protected String serializeMessageForLogging(@Nullable Object message) {
+ protected String serializeMessageForLogging(@Nullable final Object message) {
// Returning null disables log output. If want protocol message logging, need to implement this.
return null;
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
index 2e48004..4c7773f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
@@ -14,6 +14,8 @@
package net.shibboleth.oidc.profile.encoding.impl;
+import java.net.URI;
+import java.time.Duration;
import java.util.ArrayList;
import java.util.List;
import java.util.Optional;
@@ -26,8 +28,15 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.encoder.MessageEncodingException;
import org.opensaml.messaging.encoder.servlet.AbstractHttpServletResponseMessageEncoder;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.ResponseMode;
+import com.nimbusds.oauth2.sdk.ResponseType;
+import com.nimbusds.oauth2.sdk.id.State;
+import com.nimbusds.openid.connect.sdk.Display;
+import com.nimbusds.openid.connect.sdk.Nonce;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.Prompt;
import com.nimbusds.openid.connect.sdk.claims.ACR;
import net.shibboleth.oidc.profile.core.OAuthAuthorizationRequest.CodeChallengeMethod;
@@ -37,6 +46,7 @@ import net.shibboleth.oidc.profile.encoding.OIDCMessageEncoder;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.net.URLBuilder;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Base class for OIDC message encoders.
@@ -75,7 +85,6 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
}
}
-
/**
* Serialize OAuth 2.0 authorization parameters from the authentication request to the query string
* of the URL.
@@ -147,17 +156,20 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
private void createStandardOAuthParameters(@Nonnull final List<Pair<String, String>> params,
@Nonnull final OIDCAuthenticationRequest req) {
// The following three parameters are *always* required, even if a request object is used.
- params.add(new Pair<>("client_id", req.getClientID().getValue()));
- if (req.getResponseType() != null) {
- params.add(new Pair<>("response_type", req.getResponseType().toString()));
+ params.add(new Pair<>("client_id", req.getClientID().getValue()));
+
+ final ResponseType type = req.getResponseType();
+ if (type != null) {
+ params.add(new Pair<>("response_type", type.toString()));
}
// Must contain openid so the OAuth AuthZ server knows it is an OIDC request
params.add(new Pair<>("scope", req.getScope().toString()));
// Only set the response_mode if not equal to the default for that response_type
- if (req.getDefaultResponseMode() != null &&
- !req.getDefaultResponseMode().equals(req.getResponseMode())){
- params.add(new Pair<>("response_mode", req.getResponseMode().getValue()));
+ final ResponseMode mode = req.getResponseMode();
+ if (mode != null && !mode.equals(req.getDefaultResponseMode())) {
+ params.add(new Pair<>("response_mode", mode.getValue()));
}
+
final CodeChallengeMethod codeChallengedMethod = req.getCodeChallengeMethod();
if (req.getCodeChallenge() != null && codeChallengedMethod != null) {
params.add(new Pair<>("code_challenge", req.getCodeChallenge()));
@@ -179,9 +191,10 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
createStandardOAuthParameters(params, req);
- if (req.getRequestObject() != null) {
+ final JWT reqObject = req.getRequestObject();
+ if (reqObject != null) {
try {
- params.add(new Pair<>("request", req.getRequestObject().serialize()));
+ params.add(new Pair<>("request", reqObject.serialize()));
} catch (final IllegalStateException e) {
throw new MessageEncodingException("Couldn't serialize request object to JWT: " + e.getMessage(), e);
}
@@ -208,33 +221,46 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
createStandardOAuthParameters(params, req);
- if (req.getRedirectURI() != null) {
- params.add(new Pair<>("redirect_uri", req.getRedirectURI().toString()));
- }
- if (req.getState() != null) {
- params.add(new Pair<>("state", req.getState().getValue()));
+ final URI redirectURI = req.getRedirectURI();
+ if (redirectURI != null) {
+ params.add(new Pair<>("redirect_uri", redirectURI.toString()));
+ }
+
+ final State state = req.getState();
+ if (state != null) {
+ params.add(new Pair<>("state", state.getValue()));
+ }
+
+ final Prompt prompt = req.getPrompt();
+ if (prompt != null) {
+ params.add(new Pair<>("prompt", prompt.toString()));
}
- if (req.getPrompt() != null) {
- params.add(new Pair<>("prompt", req.getPrompt().toString()));
- }
- if (req.getNonce() != null) {
- params.add(new Pair<>("nonce", req.getNonce().getValue()));
+
+ final Nonce nonce = req.getNonce();
+ if (nonce != null) {
+ params.add(new Pair<>("nonce", nonce.getValue()));
}
- if (req.getMaxAge() != null) {
- params.add(new Pair<>("max_age", Long.toString(req.getMaxAge().toSeconds())));
+
+ final Duration maxage = req.getMaxAge();
+ if (maxage != null) {
+ params.add(new Pair<>("max_age", Long.toString(maxage.toSeconds())));
}
- if (req.getDisplay() != null) {
- params.add(new Pair<>("display", req.getDisplay().toString()));
+
+ final Display display = req.getDisplay();
+ if (display != null) {
+ params.add(new Pair<>("display", display.toString()));
}
+
if (req.getLoginHint() != null) {
params.add(new Pair<>("login_hint", req.getLoginHint()));
}
if (req.providerSupportsClaimsParameter()) {
// Add ACRs to claims if any before the claims are serialised
- AuthenticationContextClassReferenceSupport.buildACRClaimsRequest(req);
- if (req.getRequestedClaims() != null) {
- params.add(new Pair<>("claims", req.getRequestedClaims().toJSONString()));
+ AuthenticationContextClassReferenceSupport.buildACRClaimsRequest(req);
+ final OIDCClaimsRequest claimsReq = req.getRequestedClaims();
+ if (claimsReq != null) {
+ params.add(new Pair<>("claims", claimsReq.toJSONString()));
}
}
// Only add ACR values as acr_values if the provider does not support the 'claims' claim.
@@ -261,7 +287,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
*
* @return true if the authorization parameters are valid, false otherwise
*/
- protected boolean validateParams(final List<Pair<String, String>> params) {
+ protected boolean validateParams(@Nonnull final List<Pair<String, String>> params) {
if (!authorizationParamsAreValidPredicate.test(params)) {
return false;
@@ -295,7 +321,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
*
* @return true iff the value exists as the first item of any pair, false otherwise
*/
- private boolean pairFirstEquals(@Nonnull final String value, final List<Pair<String, String>> params) {
+ private boolean pairFirstEquals(@Nonnull final String value, @Nonnull final List<Pair<String, String>> params) {
return params.stream().map(Pair::getFirst).anyMatch(key -> key.equals(value));
}
@@ -315,31 +341,34 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
@Nonnull final String value, final List<Pair<String, String>> params) {
final Optional<Pair<String, String>> pairByKey =
- params.stream().filter(p -> p.getFirst().equals(key)).findFirst();
+ params.stream().filter(p -> key.equals(p.getFirst())).findFirst();
+
+ if (pairByKey.isEmpty()) {
+ return false;
+ }
- if (pairByKey.isEmpty() || pairByKey.get().getSecond() == null) {
+ final String second = pairByKey.get().getSecond();
+ if (second == null) {
return false;
}
- return pairByKey.get().getSecond().contains(value);
+ return second.contains(value);
}
/** {@inheritDoc} */
@Override
- @Nullable
- protected String serializeMessageForLogging(@Nullable final Object message) {
+ @Nullable protected String serializeMessageForLogging(@Nullable final Object message) {
if (message instanceof final OIDCAuthenticationRequest authnRequest) {
- try {
- final List<Pair<String, String>> params = createParametersFromRequest(authnRequest);
- final String paramsSerialized =
- params.stream().map(p -> p.getFirst()+"="+p.getSecond()).collect(Collectors.joining(", "));
- return "OIDCAuthenticationRequest{" + paramsSerialized + "}";
-
- } catch (final MessageEncodingException e) {
- log.trace("Unable to generate serialized message for logging '{}'", e.getMessage());
- }
+ try {
+ final List<Pair<String, String>> params = createParametersFromRequest(authnRequest);
+ final String paramsSerialized =
+ params.stream().map(p -> p.getFirst()+"="+p.getSecond()).collect(Collectors.joining(", "));
+ return "OIDCAuthenticationRequest{" + paramsSerialized + "}";
+ } catch (final MessageEncodingException e) {
+ log.trace("Unable to generate serialized message for logging '{}'", e.getMessage());
+ }
}
return null;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java
index 0a2c899..c11adf4 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoder.java
@@ -16,6 +16,7 @@ package net.shibboleth.oidc.profile.encoding.impl;
import java.io.OutputStreamWriter;
import java.io.Writer;
+import java.net.URI;
import java.nio.charset.StandardCharsets;
import java.util.List;
@@ -28,7 +29,6 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.encoder.MessageEncoder;
import org.opensaml.messaging.encoder.MessageEncodingException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletResponse;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
@@ -37,6 +37,7 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.codec.HTMLEncoder;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.servlet.HttpServletSupport;
/**
@@ -83,11 +84,10 @@ public class HTTPPostAuthnRequestEncoder extends AbstractOIDCMessageEncoder {
ifDestroyedThrowDestroyedComponentException();
velocityEngine = Constraint.isNotNull(newVelocityEngine, "Velocity engine can not be null");
}
-
- @Override
- public boolean test(@Nonnull final HttpRequestMethod requestMethod) {
- return requestMethod == HttpRequestMethod.POST;
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final HttpRequestMethod requestMethod) {
+ return HttpRequestMethod.POST.equals(requestMethod);
}
/**
@@ -103,16 +103,20 @@ public class HTTPPostAuthnRequestEncoder extends AbstractOIDCMessageEncoder {
final VelocityContext context = new VelocityContext();
final List<Pair<String, String>> params = createParametersFromRequest(request);
params.forEach(param -> context.put(param.getFirst(),HTMLEncoder.encodeForHTML(param.getSecond())));
- context.put("action", HTMLEncoder.encodeForHTMLAttribute(request.getEndpointURI().toString()));
+ final URI uri = request.getEndpointURI();
+ if (uri != null) {
+ context.put("action", HTMLEncoder.encodeForHTMLAttribute(uri.toString()));
+ }
log.trace("Velocity context {}", params);
return context;
}
+ /** {@inheritDoc} */
@Override
protected void doEncode() throws MessageEncodingException {
if (velocityEngine == null) {
- throw new MessageEncodingException("VelocityEngine must be supplied for form post request mode");
+ throw new MessageEncodingException("VelocityEngine must be supplied for form post request mode.");
}
log.debug("Encoding OIDC authentication request using HTTP Form Post Serialization");
@@ -120,25 +124,28 @@ public class HTTPPostAuthnRequestEncoder extends AbstractOIDCMessageEncoder {
final Object outboundMessage = messageContext.getMessage();
if (!(outboundMessage instanceof OIDCAuthenticationRequest)) {
throw new MessageEncodingException("No outbound OIDC authentication request message "
- + "contained in message context");
+ + "contained in message context.");
+ }
+
+ final HttpServletResponse response = getHttpServletResponse();
+ if (response == null) {
+ throw new MessageEncodingException("No HttpServletResponse available.");
}
+
try {
- final HttpServletResponse response = getHttpServletResponse();
HttpServletSupport.addNoCacheHeaders(response);
HttpServletSupport.setUTF8Encoding(response);
HttpServletSupport.setContentType(response, "text/html");
final VelocityContext context = doPostEncode((OIDCAuthenticationRequest) outboundMessage);
try (final Writer out = new OutputStreamWriter(response.getOutputStream(), StandardCharsets.UTF_8)) {
+ assert velocityEngine != null;
velocityEngine.mergeTemplate(velocityTemplateId, "UTF-8", context, out);
out.flush();
}
} catch (final Exception e) {
log.error("Error creating authorization POST request: {}", e.getMessage());
- throw new MessageEncodingException("Error creating authorization POST request", e);
+ throw new MessageEncodingException("Error creating authorization POST request.", e);
}
-
-
}
-
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java
index 8918633..2658da9 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoder.java
@@ -16,19 +16,21 @@ package net.shibboleth.oidc.profile.encoding.impl;
import java.io.IOException;
import java.net.MalformedURLException;
+import java.net.URI;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.encoder.MessageEncoder;
import org.opensaml.messaging.encoder.MessageEncodingException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletResponse;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration.HttpRequestMethod;
import net.shibboleth.shared.net.URLBuilder;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.servlet.HttpServletSupport;
/**
@@ -41,11 +43,12 @@ public class HTTPRedirectAuthnRequestEncoder extends AbstractOIDCMessageEncoder
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(HTTPRedirectAuthnRequestEncoder.class);
- @Override
- public boolean test(@Nonnull final HttpRequestMethod requestMethod) {
- return requestMethod == HttpRequestMethod.GET;
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final HttpRequestMethod requestMethod) {
+ return HttpRequestMethod.GET.equals(requestMethod);
}
+ /** {@inheritDoc} */
@Override
protected void doEncode() throws MessageEncodingException {
@@ -60,6 +63,10 @@ public class HTTPRedirectAuthnRequestEncoder extends AbstractOIDCMessageEncoder
final String redirectURL = buildRedirectURL(messageContext, (OIDCAuthenticationRequest)outboundMessage);
final HttpServletResponse response = getHttpServletResponse();
+ if (response == null) {
+ throw new MessageEncodingException("No HttpServletResponse available.");
+ }
+
HttpServletSupport.addNoCacheHeaders(response);
HttpServletSupport.setUTF8Encoding(response);
HttpServletSupport.setContentType(response, "application/x-www-form-urlencoded");
@@ -68,7 +75,7 @@ public class HTTPRedirectAuthnRequestEncoder extends AbstractOIDCMessageEncoder
log.trace("Redirecting user-agent to '{}'",redirectURL);
response.sendRedirect(redirectURL);
} catch (final IOException e) {
- throw new MessageEncodingException("Problem sending HTTP redirect", e);
+ throw new MessageEncodingException("Problem sending HTTP redirect.", e);
}
}
@@ -87,7 +94,7 @@ public class HTTPRedirectAuthnRequestEncoder extends AbstractOIDCMessageEncoder
throws MessageEncodingException {
if (request.getEndpointURI() == null) {
- throw new MessageEncodingException("No endpoint URI specified, URL can not be built");
+ throw new MessageEncodingException("No endpoint URI specified, URL can not be built.");
}
URLBuilder urlBuilder = null;
try {
@@ -95,16 +102,17 @@ public class HTTPRedirectAuthnRequestEncoder extends AbstractOIDCMessageEncoder
throw new MessageEncodingException("Endpoint URL is null");
}
//TODO check the endpoint is always the baseURL, otherwise this may go wrong.
- urlBuilder = new URLBuilder(request.getEndpointURI().toString());
+ final URI uri = request.getEndpointURI();
+ if (uri == null) {
+ throw new MessageEncodingException("No Endpoint URI available.");
+ }
+ urlBuilder = new URLBuilder(uri.toString());
} catch (final MalformedURLException e) {
throw new MessageEncodingException("Endpoint URL " + request.getEndpointURI() + " is not a valid URL", e);
}
serializeAuthorizationParamsToUrl(request, urlBuilder);
return urlBuilder.buildURL();
-
}
-
-
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/OIDCResponseEncoderFactory.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/OIDCResponseEncoderFactory.java
index 7eb15ca..0fdefc4 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/OIDCResponseEncoderFactory.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/OIDCResponseEncoderFactory.java
@@ -23,7 +23,6 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.encoder.MessageEncoder;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.Response;
@@ -31,6 +30,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A source of encoders that first verifies a message being an instance of Nimbus
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoder.java
index a9ab9f9..7cc18bc 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoder.java
@@ -16,13 +16,10 @@ package net.shibboleth.oidc.profile.encoding.impl;
import java.io.IOException;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.encoder.MessageEncodingException;
import org.opensaml.messaging.encoder.servlet.AbstractHttpServletResponseMessageEncoder;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.Response;
import com.nimbusds.oauth2.sdk.http.HTTPResponse;
@@ -35,13 +32,10 @@ import jakarta.servlet.http.HttpServletResponse;
* {@link HttpServletResponse} by calling its {@link Response#toHTTPResponse()} method.
*/
public class SimpleNimbusResponseEncoder extends AbstractHttpServletResponseMessageEncoder {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(SimpleNimbusResponseEncoder.class);
/** Constructor. */
public SimpleNimbusResponseEncoder() {
- setProtocolMessageLoggerSubCategory("OAUTH2");
+ setProtocolMessageLoggerSubCategory("OAUTH2");
}
/** {@inheritDoc} */
@@ -54,7 +48,7 @@ public class SimpleNimbusResponseEncoder extends AbstractHttpServletResponseMess
try {
final HttpServletResponse response = getHttpServletResponse();
- final HTTPResponse resp = ((Response) getMessageContext().getMessage()).toHTTPResponse();
+ final HTTPResponse resp = ((Response) getMessageContext().ensureMessage()).toHTTPResponse();
JakartaServletUtils.applyHTTPResponse(resp, response);
} catch (final IOException e) {
throw new MessageEncodingException("Problem encoding response", e);
@@ -64,11 +58,11 @@ public class SimpleNimbusResponseEncoder extends AbstractHttpServletResponseMess
/** {@inheritDoc} */
@Override
@Nullable
- protected String serializeMessageForLogging(@Nullable Object message) {
+ protected String serializeMessageForLogging(@Nullable final Object message) {
if (message instanceof Response response) {
- return response.toString();
+ return response.toString();
}
return null;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AbstractBuildErrorResponseFromEvent.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AbstractBuildErrorResponseFromEvent.java
index c5cdbf1..6b915b3 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AbstractBuildErrorResponseFromEvent.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AbstractBuildErrorResponseFromEvent.java
@@ -19,12 +19,12 @@ import java.util.Map;
import java.util.function.Function;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.context.EventContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.CurrentOrPreviousEventLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ErrorObject;
import com.nimbusds.oauth2.sdk.ErrorResponse;
@@ -32,6 +32,7 @@ import com.nimbusds.oauth2.sdk.http.HTTPResponse;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* This action is extended by error response actions. Action reads an event from the configured {@link EventContext}
@@ -51,12 +52,10 @@ public abstract class AbstractBuildErrorResponseFromEvent<T extends ErrorRespons
public static final int DEFAULT_HTTP_STATUS_CODE = HTTPResponse.SC_BAD_REQUEST;
/** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(AbstractBuildErrorResponseFromEvent.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractBuildErrorResponseFromEvent.class);
/** Strategy function for access to {@link EventContext} to check. */
- @Nonnull
- private Function<ProfileRequestContext, EventContext> eventContextLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext, EventContext> eventContextLookupStrategy;
/** Map of eventIds to pre-configured error objects. */
private Map<String, ErrorObject> mappedErrors;
@@ -122,7 +121,8 @@ public abstract class AbstractBuildErrorResponseFromEvent<T extends ErrorRespons
* @param profileRequestContext profile request context.
* @return ErrorResponse
*/
- protected abstract T buildErrorResponse(ErrorObject error, ProfileRequestContext profileRequestContext);
+ @Nullable protected abstract T buildErrorResponse(@Nonnull ErrorObject error,
+ @Nonnull ProfileRequestContext profileRequestContext);
/** {@inheritDoc} */
@Override
@@ -144,26 +144,29 @@ public abstract class AbstractBuildErrorResponseFromEvent<T extends ErrorRespons
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final EventContext eventCtx = eventContextLookupStrategy.apply(profileRequestContext);
- if (eventCtx == null || eventCtx.getEvent() == null) {
+ final Object obj = eventCtx != null ? eventCtx.getEvent() : null;
+
+ if (obj == null) {
log.error("{} No event to be included in the response, nothing to do", getLogPrefix());
return;
}
- final String event = eventCtx.getEvent().toString();
+ final String event = obj.toString();
final ErrorObject error;
if (mappedErrors.containsKey(event)) {
log.debug("{} Found mapped event for {}", getLogPrefix(), event);
error = mappedErrors.get(event);
} else {
log.debug("{} No mapped event found for {}, creating general {}", getLogPrefix(), event, defaultCode);
- error = new ErrorObject(defaultCode, eventCtx.getEvent().toString(), defaultStatusCode);
+ error = new ErrorObject(defaultCode, event, defaultStatusCode);
}
final ErrorResponse errorResponse = buildErrorResponse(error, profileRequestContext);
if (errorResponse != null) {
- profileRequestContext.getOutboundMessageContext()
+ profileRequestContext.ensureOutboundMessageContext()
.setMessage(buildErrorResponse(error, profileRequestContext));
log.debug("{} ErrorResponse successfully set as the outbound message", getLogPrefix());
} else {
log.debug("{} Error response not formed", getLogPrefix());
}
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java
index 2fd5273..1462da5 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactory.java
@@ -14,7 +14,6 @@
package net.shibboleth.oidc.profile.impl;
-import java.util.Collections;
import java.util.List;
import java.util.Optional;
import java.util.function.Function;
@@ -26,7 +25,6 @@ import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.messaging.encoder.MessageEncoder;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.encoding.OIDCMessageEncoder;
@@ -35,7 +33,9 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractInitializableComponent;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Message encoder factory function that returns the first encoder suitable for the given request method found in the
@@ -63,20 +63,20 @@ public class AuthenticationRequestMessageEncoderFactory extends AbstractInitiali
public AuthenticationRequestMessageEncoderFactory(
@Nullable @ParameterName(name = "encoders") final List<OIDCMessageEncoder> encodersToUse) {
if (encodersToUse == null) {
- encoders = Collections.emptyList();
+ encoders = CollectionSupport.emptyList();
} else {
- encoders = Collections.unmodifiableList(encodersToUse);
+ encoders = CollectionSupport.copyToList(encodersToUse);
}
}
- @Override
- @Nullable public MessageEncoder apply(@Nonnull final ProfileRequestContext profileRequestContext) {
+ /** {@inheritDoc} */
+ @Nullable public MessageEncoder apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpCtx = profileRequestContext.getSubcontext(RelyingPartyContext.class);
+ final RelyingPartyContext rpCtx = input != null ? input.getSubcontext(RelyingPartyContext.class) : null;
+
OIDCAuthorizationConfiguration profileConfiguration = null;
-
- if (rpCtx != null && rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration) {
- profileConfiguration = (OIDCAuthorizationConfiguration) rpCtx.getProfileConfig();
+ if (rpCtx != null && rpCtx.getProfileConfig() instanceof OIDCAuthorizationConfiguration downcast) {
+ profileConfiguration = downcast;
}
if (profileConfiguration == null) {
log.warn("OIDCAuthorizationConfiguration not found, no encoders to lookup");
@@ -84,7 +84,7 @@ public class AuthenticationRequestMessageEncoderFactory extends AbstractInitiali
}
final HttpRequestMethod requestMethodFromConfig =
- profileConfiguration.getHttpRequestMethod(profileRequestContext);
+ profileConfiguration.getHttpRequestMethod(input);
if (requestMethodFromConfig == null) {
log.warn("Authentication request method not found on profile, no encoders to lookup");
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/BuildJSONErrorResponseFromEvent.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/BuildJSONErrorResponseFromEvent.java
index fe03d55..cf6f9f8 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/BuildJSONErrorResponseFromEvent.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/BuildJSONErrorResponseFromEvent.java
@@ -14,6 +14,9 @@
package net.shibboleth.oidc.profile.impl;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.opensaml.profile.context.EventContext;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -29,9 +32,9 @@ public class BuildJSONErrorResponseFromEvent extends AbstractBuildErrorResponseF
/** {@inheritDoc} */
@Override
- protected JSONErrorResponse buildErrorResponse(final ErrorObject error,
- final ProfileRequestContext profileRequestContext) {
+ @Nullable protected JSONErrorResponse buildErrorResponse(@Nonnull final ErrorObject error,
+ @Nonnull final ProfileRequestContext profileRequestContext) {
return new JSONErrorResponse(error);
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessage.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessage.java
index 928875b..4fd891f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessage.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessage.java
@@ -29,7 +29,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.security.config.SecurityConfiguration;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSet;
@@ -40,8 +39,10 @@ import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
import net.shibboleth.oidc.profile.messaging.JSONSuccessResponse;
import net.shibboleth.oidc.security.CredentialConversionUtil;
+import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that forms outbound message containing keyset. Keys of the keyset are located from security configuration
@@ -116,14 +117,15 @@ public class FormOutboundKeySetResponseMessage extends AbstractProfileAction {
return false;
}
- if (rpCtx.getProfileConfig() == null) {
+ final ProfileConfiguration profileConfig = rpCtx.getProfileConfig();
+ if (profileConfig == null) {
log.debug("{} No profile configuration associated with this profile request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
return false;
}
final SecurityConfiguration securityConfig =
- rpCtx.getProfileConfig().getSecurityConfiguration(profileRequestContext);
+ profileConfig.getSecurityConfiguration(profileRequestContext);
if (!(securityConfig instanceof JSONSecurityConfiguration)) {
log.debug("{} No security configuration associated with the profile configuration of the profile request",
@@ -146,7 +148,7 @@ public class FormOutboundKeySetResponseMessage extends AbstractProfileAction {
final JWKSet keySet = new JWKSet(publishList);
final JSONObject keySetJson = new JSONObject(keySet.toJSONObject());
- profileRequestContext.getOutboundMessageContext().setMessage(new JSONSuccessResponse(keySetJson));
+ profileRequestContext.ensureOutboundMessageContext().setMessage(new JSONSuccessResponse(keySetJson));
}
/**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
index 09dbef5..d46474c 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTDecryptionParameters.java
@@ -26,7 +26,8 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
@@ -44,6 +45,7 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -215,19 +217,22 @@ public class PopulateJWTDecryptionParameters extends AbstractProfileAction {
*/
@Nonnull
private CriteriaSet buildCriteriaSet(@Nonnull final ProfileRequestContext profileRequestContext,
- final List<DecryptionConfiguration> configs) {
+ @Nonnull final List<DecryptionConfiguration> configs) {
final CriteriaSet criteria = new CriteriaSet();
criteria.add(new DecryptionConfigurationCriterion(configs));
// Add client metadata criterion
- final OIDCMetadataContext oidcMetadataCtx =
- oidcClientMetadataContextLookupStrategy.apply(profileRequestContext);
- if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
+ final OIDCMetadataContext oidcMetadataCtx =
+ oidcClientMetadataContextLookupStrategy != null
+ ? oidcClientMetadataContextLookupStrategy.apply(profileRequestContext)
+ : null;
+ final OIDCClientInformation info = oidcMetadataCtx != null ? oidcMetadataCtx.getClientInformation() : null;
+ if (info != null) {
log.debug(
"{} Adding OIDC client information to resolution criteria for encryption algorithms",
getLogPrefix());
- criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
+ criteria.add(new ClientInformationCriterion(info));
} else {
log.debug("{} No OIDC client information available", getLogPrefix());
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java
index 544dc58..c2c46ca 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTEncryptionParameters.java
@@ -30,9 +30,9 @@ import org.opensaml.security.credential.UsageType;
import org.opensaml.security.criteria.UsageCriterion;
import org.opensaml.xmlsec.criterion.EncryptionOptionalCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import com.google.common.base.Predicates;
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
@@ -50,10 +50,11 @@ import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriter
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -97,9 +98,6 @@ public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
/** Resolver for parameters to store into context. */
@NonnullAfterInit private EncryptionParametersResolver encParamsresolver;
- /** Active configurations to feed into resolver. */
- @Nullable @NonnullElements private List<EncryptionConfiguration> encryptionConfigurations;
-
/** Strategy used to look up a OIDC client metadata context. */
@Nullable private Function<ProfileRequestContext, OIDCMetadataContext> oidcClientMetadataContextLookupStrategy;
@@ -234,7 +232,7 @@ public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
*/
public void setEncryptionOptional(final boolean flag) {
ifInitializedThrowUnmodifiabledComponentException();
- encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ encryptionOptionalPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
@Override
@@ -266,18 +264,19 @@ public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
}
- // Checkstyle: CyclomaticComplexity OFF
+// Checkstyle: CyclomaticComplexity OFF
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
log.debug("{} Resolving EncryptionParameters for '{}' encryption", getLogPrefix(),forFriendlyName);
try {
- encryptionConfigurations = configurationLookupStrategy.apply(profileRequestContext);
+ final List<EncryptionConfiguration> encryptionConfigurations =
+ configurationLookupStrategy.apply(profileRequestContext);
if (encryptionConfigurations == null || encryptionConfigurations.isEmpty()) {
throw new ResolverException("No EncryptionConfigurations returned by lookup strategy");
}
- final CriteriaSet criteria = buildCriteriaSet(profileRequestContext);
+ final CriteriaSet criteria = buildCriteriaSet(profileRequestContext, encryptionConfigurations);
final EncryptionParameters params = encParamsresolver.resolveSingle(criteria);
if (params != null) {
@@ -299,17 +298,17 @@ public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
}
}
}
-// Checkstyle: CyclomaticComplexity ON
/**
* Build the criteria used as input to the {@link EncryptionParametersResolver}.
*
* @param profileRequestContext current profile request context
+ * @param encryptionConfigurations active configurations
*
* @return the criteria set to use
*/
- @Nonnull
- private CriteriaSet buildCriteriaSet(@Nonnull final ProfileRequestContext profileRequestContext) {
+ @Nonnull private CriteriaSet buildCriteriaSet(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final List<EncryptionConfiguration> encryptionConfigurations) {
final CriteriaSet criteria = new CriteriaSet(
new EncryptionConfigurationCriterion(encryptionConfigurations));
@@ -318,24 +317,29 @@ public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
criteria.add(new EncryptionOptionalCriterion(encryptionOptional));
// Add client metadata criterion
- final OIDCMetadataContext oidcMetadataCtx =
- oidcClientMetadataContextLookupStrategy.apply(profileRequestContext);
- if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
- log.debug(
- "{} Adding OIDC client information to resolution criteria for encryption algorithms",
+ final OIDCMetadataContext oidcMetadataCtx =
+ oidcClientMetadataContextLookupStrategy != null
+ ? oidcClientMetadataContextLookupStrategy.apply(profileRequestContext)
+ : null;
+ final OIDCClientInformation info = oidcMetadataCtx != null ? oidcMetadataCtx.getClientInformation() : null;
+ if (info != null) {
+ log.debug("{} Adding OIDC client information to resolution criteria for encryption algorithms",
getLogPrefix());
- criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
+ criteria.add(new ClientInformationCriterion(info));
} else {
log.debug("{} No OIDC client information available", getLogPrefix());
}
// Add OP metadata criterion
- final OIDCProviderMetadataContext oidcProviderMetadataCtx =
- oidcProviderMetadataContextLookupStrategy.apply(profileRequestContext);
- if (oidcProviderMetadataCtx != null && oidcProviderMetadataCtx.getProviderInformation() != null) {
- log.debug("{} Adding OIDC provider information to resolution criteria",
- getLogPrefix());
- criteria.add(new ProviderMetadataCriterion(oidcProviderMetadataCtx.getProviderInformation()));
+ final OIDCProviderMetadataContext oidcProviderMetadataCtx =
+ oidcProviderMetadataContextLookupStrategy != null
+ ? oidcProviderMetadataContextLookupStrategy.apply(profileRequestContext)
+ : null;
+ final OIDCProviderMetadata metadata =
+ oidcProviderMetadataCtx != null ? oidcProviderMetadataCtx.getProviderInformation() : null;
+ if (metadata != null) {
+ log.debug("{} Adding OIDC provider information to resolution criteria", getLogPrefix());
+ criteria.add(new ProviderMetadataCriterion(metadata));
} else {
log.debug("{} OIDCProviderMetadataContext is absent", getLogPrefix());
}
@@ -365,5 +369,6 @@ public class PopulateJWTEncryptionParameters extends AbstractProfileAction {
}
return criteria;
}
+// Checkstyle: CyclomaticComplexity ON
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParameters.java
index 5bb5e5a..e426a43 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParameters.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParameters.java
@@ -28,7 +28,6 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
@@ -40,6 +39,7 @@ import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -89,7 +89,7 @@ public class PopulateJWTSignatureSigningParameters
* @param strategy lookup strategy for message context
*/
public PopulateJWTSignatureSigningParameters(@ParameterName(name = "strategy")
- final ContextDataLookupFunction<ProfileRequestContext, MessageContext> strategy) {
+ @Nonnull final ContextDataLookupFunction<ProfileRequestContext, MessageContext> strategy) {
super(PopulateJWTSignatureSigningParametersHandler.class, strategy);
setErrorEvent(EventIds.INVALID_SEC_CFG);
@@ -197,23 +197,28 @@ public class PopulateJWTSignatureSigningParameters
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
- if (resolver == null) {
- throw new ComponentInitializationException("SignatureSigningParametersResolver cannot be null");
+ if (resolver == null || configurationLookupStrategy == null) {
+ throw new ComponentInitializationException(
+ "SignatureSigningParametersResolver and configuration lookup strategy cannot be null");
}
final PopulateJWTSignatureSigningParametersHandler delegate = getDelegate();
delegate.setNoResultIsError(noResultIsError);
+ assert resolver != null;
delegate.setSignatureSigningParametersResolver(resolver);
- delegate.setConfigurationLookupStrategy(adapt(configurationLookupStrategy));
+
+ assert configurationLookupStrategy != null;
+ delegate.setConfigurationLookupStrategy(adaptRequired(configurationLookupStrategy));
+
if (securityParametersContextLookupStrategy != null) {
- delegate.setSecurityParametersContextLookupStrategy(adapt(securityParametersContextLookupStrategy));
+ delegate.setSecurityParametersContextLookupStrategy(adaptRequired(securityParametersContextLookupStrategy));
}
delegate.setExistingParametersContextLookupStrategy(adapt(existingParametersContextLookupStrategy));
if (oidcClientMetadataContextLookupStrategy != null) {
- delegate.setClientMetadataContextLookupStrategy(adapt(oidcClientMetadataContextLookupStrategy));
+ delegate.setClientMetadataContextLookupStrategy(adaptRequired(oidcClientMetadataContextLookupStrategy));
}
if (oidcProviderMetadataContextLookupStrategy != null) {
- delegate.setProviderMetadataContextLookupStrategy(adapt(oidcProviderMetadataContextLookupStrategy));
+ delegate.setProviderMetadataContextLookupStrategy(adaptRequired(oidcProviderMetadataContextLookupStrategy));
}
delegate.initialize();
}
@@ -230,5 +235,4 @@ public class PopulateJWTSignatureSigningParameters
return false;
}
-
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java
index bf2ad65..f37e37e 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureSigningParametersHandler.java
@@ -29,8 +29,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.criterion.RoleDescriptorCriterion;
+import org.opensaml.saml.saml2.metadata.RoleDescriptor;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.context.OIDCProviderMetadataContext;
@@ -49,6 +52,7 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -257,9 +261,10 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
}
}
- // Checkstyle: CyclomaticComplexity|MethodLength OFF
+// Checkstyle: CyclomaticComplexity|MethodLength OFF
+ /** {@inheritDoc} */
@Override
- protected void doInvoke(final MessageContext messageContext) throws MessageHandlerException {
+ protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
log.debug("{} Resolving SignatureSigningParameters for request", getLogPrefix());
final SecurityParametersContext paramsCtx = securityParametersContextLookupStrategy.apply(messageContext);
@@ -287,17 +292,19 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
final CriteriaSet criteria = new CriteriaSet(new SignatureSigningConfigurationCriterion(configs));
final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(messageContext);
- if (metadataCtx != null && metadataCtx.getRoleDescriptor() != null) {
+ final RoleDescriptor role = metadataCtx != null ? metadataCtx.getRoleDescriptor() : null;
+ if (role != null) {
log.debug("{} Adding metadata to resolution criteria for signing/digest algorithms", getLogPrefix());
- criteria.add(new RoleDescriptorCriterion(metadataCtx.getRoleDescriptor()));
+ criteria.add(new RoleDescriptorCriterion(role));
}
// Add client metadata criterion
final OIDCMetadataContext oidcMetadataCtx = oidcClientMetadataContextLookupStrategy.apply(messageContext);
- if (oidcMetadataCtx != null && oidcMetadataCtx.getClientInformation() != null) {
+ final OIDCClientInformation info = oidcMetadataCtx != null ? oidcMetadataCtx.getClientInformation() : null;
+ if (info != null) {
log.debug("{} Adding OIDC client information to resolution criteria for signing/digest algorithms",
getLogPrefix());
- criteria.add(new ClientInformationCriterion(oidcMetadataCtx.getClientInformation()));
+ criteria.add(new ClientInformationCriterion(info));
} else {
log.debug("{} OIDCMetadataContext is absent", getLogPrefix());
}
@@ -305,10 +312,12 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
// Add OP metadata criterion
final OIDCProviderMetadataContext oidcProviderMetadataCtx =
oidcProviderMetadataContextLookupStrategy.apply(messageContext);
- if (oidcProviderMetadataCtx != null && oidcProviderMetadataCtx.getProviderInformation() != null) {
+ final OIDCProviderMetadata metadata =
+ oidcProviderMetadataCtx != null ? oidcProviderMetadataCtx.getProviderInformation() : null;
+ if (metadata != null) {
log.debug("{} Adding OIDC provider information to resolution criteria for signing/digest algorithms",
getLogPrefix());
- criteria.add(new ProviderMetadataCriterion(oidcProviderMetadataCtx.getProviderInformation()));
+ criteria.add(new ProviderMetadataCriterion(metadata));
} else {
log.debug("{} OIDCProviderMetadataContext is absent", getLogPrefix());
}
@@ -352,5 +361,6 @@ public class PopulateJWTSignatureSigningParametersHandler extends AbstractMessag
}
}
- // Checkstyle: CyclomaticComplexity|MethodLength ON
-}
+// Checkstyle: CyclomaticComplexity|MethodLength ON
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureValidationParameters.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureValidationParameters.java
index 23b3362..31c6412 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureValidationParameters.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureValidationParameters.java
@@ -26,8 +26,6 @@ import org.opensaml.profile.action.AbstractHandlerDelegatingProfileAction;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
import net.shibboleth.oidc.security.jose.SignatureValidationParameters;
@@ -50,9 +48,6 @@ import net.shibboleth.shared.logic.Constraint;
*/
public class PopulateJWTSignatureValidationParameters
extends AbstractHandlerDelegatingProfileAction<PopulateJWTSignatureValidationParametersHandler> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateJWTSignatureValidationParameters.class);
/** Strategy used to look up the {@link SecurityParametersContext} to set the parameters for. */
@Nonnull
@@ -71,7 +66,7 @@ public class PopulateJWTSignatureValidationParameters
* @param strategy lookup strategy for message context
*/
public PopulateJWTSignatureValidationParameters(@ParameterName(name="strategy")
- final ContextDataLookupFunction<ProfileRequestContext, MessageContext> strategy) {
+ @Nonnull final ContextDataLookupFunction<ProfileRequestContext, MessageContext> strategy) {
super(PopulateJWTSignatureValidationParametersHandler.class, strategy);
// Create context by default.
@@ -132,9 +127,11 @@ public class PopulateJWTSignatureValidationParameters
}
final PopulateJWTSignatureValidationParametersHandler delegate = getDelegate();
+ assert resolver != null;
delegate.setSignatureValidationParametersResolver(resolver);
- delegate.setConfigurationLookupStrategy(adapt(configurationLookupStrategy));
- delegate.setSecurityParametersContextLookupStrategy(adapt(securityParametersContextLookupStrategy));
+ assert configurationLookupStrategy != null;
+ delegate.setConfigurationLookupStrategy(adaptRequired(configurationLookupStrategy));
+ delegate.setSecurityParametersContextLookupStrategy(adaptRequired(securityParametersContextLookupStrategy));
delegate.initialize();
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureValidationParametersHandler.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureValidationParametersHandler.java
index 5af3390..1fc09ec 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureValidationParametersHandler.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/impl/PopulateJWTSignatureValidationParametersHandler.java
@@ -24,7 +24,6 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.messaging.handler.AbstractMessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
import net.shibboleth.oidc.security.jose.SignatureValidationParameters;
@@ -34,6 +33,7 @@ import net.shibboleth.oidc.security.jose.criterion.SignatureValidationConfigurat
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -151,5 +151,4 @@ public class PopulateJWTSignatureValidationParametersHandler extends AbstractMes
}
}
-}
-
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/logic/ClientIDFromOIDCMetadataContextLookupFunction.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/logic/ClientIDFromOIDCMetadataContextLookupFunction.java
index 2762d2b..103c952 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/logic/ClientIDFromOIDCMetadataContextLookupFunction.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/logic/ClientIDFromOIDCMetadataContextLookupFunction.java
@@ -59,8 +59,7 @@ public class ClientIDFromOIDCMetadataContextLookupFunction
}
/** {@inheritDoc} */
- @Override @Nullable
- public String apply(@Nonnull final ProfileRequestContext prc, @Nullable final JWTClaimsSet claimsSet) {
+ @Nullable public String apply(@Nullable final ProfileRequestContext prc, @Nullable final JWTClaimsSet claimsSet) {
final OIDCMetadataContext oidcMetadataContext = oidcMetadataContextLookupStrategy.apply(prc);
if (oidcMetadataContext == null) {
return null;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/logic/IssuerIDFromOIDCProviderMetadataContextLookupFunction.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/logic/IssuerIDFromOIDCProviderMetadataContextLookupFunction.java
index 087c8d7..7dc1be5 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/logic/IssuerIDFromOIDCProviderMetadataContextLookupFunction.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/logic/IssuerIDFromOIDCProviderMetadataContextLookupFunction.java
@@ -58,8 +58,8 @@ public class IssuerIDFromOIDCProviderMetadataContextLookupFunction
Constraint.isNotNull(strategy, "OIDCMetadataContext lookup strategy cannot be null");
}
- @Override @Nullable
- public String apply(@Nonnull final ProfileRequestContext prc, @Nullable final JWTClaimsSet claimsSet) {
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final ProfileRequestContext prc, @Nullable final JWTClaimsSet claimsSet) {
final OIDCProviderMetadataContext oidcMetadataContext = oidcMetadataContextLookupStrategy.apply(prc);
if (oidcMetadataContext == null) {
return null;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index 5d28f85..a24d5a6 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -16,7 +16,6 @@ package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.security.Principal;
import java.util.Collection;
-import java.util.Collections;
import java.util.List;
import java.util.Map;
import java.util.Set;
@@ -28,7 +27,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
@@ -43,8 +41,10 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -98,8 +98,8 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
protected AbstractOAuth2ClientAuthenticableProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- setTokenEndpointAuthMethods(
- Set.of(
+ tokenEndpointAuthMethodsLookupStrategy = FunctionSupport.constant(
+ CollectionSupport.setOf(
ClientAuthenticationMethod.CLIENT_SECRET_BASIC.toString(),
ClientAuthenticationMethod.CLIENT_SECRET_POST.toString(),
ClientAuthenticationMethod.CLIENT_SECRET_JWT.toString(),
@@ -107,7 +107,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
tokenEndpointAuthMethodLookupStrategy =
FunctionSupport.constant(ClientAuthenticationMethod.CLIENT_SECRET_BASIC.toString());
claimsValidatorLookupStrategy = FunctionSupport.constant(null);
- forceAuthnPredicate = Predicates.alwaysFalse();
+ forceAuthnPredicate = PredicateSupport.alwaysFalse();
proxyCountLookupStrategy = FunctionSupport.constant(null);
defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(null);
authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
@@ -117,15 +117,16 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
unregisteredClientPolicyLookupStrategy = FunctionSupport.constant(null);
}
+ /** {@inheritDoc} */
@Override
@Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getTokenEndpointAuthMethods(
@Nullable final ProfileRequestContext profileRequestContext) {
final Collection<String> methods = tokenEndpointAuthMethodsLookupStrategy.apply(profileRequestContext);
if (methods != null) {
- return Set.copyOf(methods);
+ return CollectionSupport.copyToSet(methods);
}
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
/**
@@ -136,12 +137,8 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
public void setTokenEndpointAuthMethods(@Nonnull @NonnullElements final Collection<String> methods) {
Constraint.isNotNull(methods, "Collection of methods cannot be null");
- if (methods != null) {
- tokenEndpointAuthMethodsLookupStrategy =
- FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(methods)));
- } else {
- tokenEndpointAuthMethodsLookupStrategy = FunctionSupport.constant(null);
- }
+ tokenEndpointAuthMethodsLookupStrategy =
+ FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(methods)));
}
/**
@@ -154,6 +151,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
tokenEndpointAuthMethodsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nonnull public String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext) {
return tokenEndpointAuthMethodLookupStrategy.apply(profileRequestContext);
@@ -234,7 +232,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
* @param flag flag to set
*/
public void setForceAuthn(final boolean flag) {
- forceAuthnPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ forceAuthnPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -286,9 +284,9 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
@Nullable final ProfileRequestContext profileRequestContext) {
final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
if (flows != null) {
- return Set.copyOf(flows);
+ return CollectionSupport.copyToSet(flows);
}
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
/**
@@ -321,9 +319,9 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
@Nullable final ProfileRequestContext profileRequestContext) {
final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
if (flows != null) {
- return List.copyOf(flows);
+ return CollectionSupport.copyToList(flows);
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
/**
@@ -357,9 +355,9 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
final Collection<AuthenticationContextClassReferencePrincipal> methods =
defaultAuthenticationContextsLookupStrategy.apply(profileRequestContext);
if (methods != null) {
- return List.copyOf(methods);
+ return CollectionSupport.copyToList(methods);
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
/**
@@ -411,6 +409,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
clientCredentialLookupStrategy = FunctionSupport.constant(clientCredential);
}
+ /** {@inheritDoc} */
@Override
public ClientSecretCredential getClientCredential(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -439,11 +438,13 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
clientIdLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(clientId));
}
+ /** {@inheritDoc} */
@Override
@Nullable public String getClientId(@Nullable final ProfileRequestContext profileRequestContext) {
return clientIdLookupStrategy.apply(profileRequestContext);
}
+ /** {@inheritDoc} */
@Override
@Nullable @Unmodifiable
public Map<String,UnregisteredClientPolicy> getUnregisteredClientPolicy(
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2FlowAwareProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2FlowAwareProfileConfiguration.java
index 9b7e71f..f913bef 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2FlowAwareProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2FlowAwareProfileConfiguration.java
@@ -21,11 +21,11 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
-
import net.shibboleth.oidc.profile.config.OIDCFlowAwareProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
/**
* Base class for OIDC protocol configuration, containing configuration bits shared by all flow aware OIDC protocol
@@ -52,14 +52,15 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
*
* @param profileId Unique profile identifier.
*/
- protected AbstractOAuth2FlowAwareProfileConfiguration(final String profileId) {
+ protected AbstractOAuth2FlowAwareProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- authorizationCodeFlowPredicate = Predicates.alwaysTrue();
- implicitFlowPredicate = Predicates.alwaysTrue();
- hybridFlowPredicate = Predicates.alwaysTrue();
- refreshTokensPredicate = Predicates.alwaysTrue();
+ authorizationCodeFlowPredicate = PredicateSupport.alwaysTrue();
+ implicitFlowPredicate = PredicateSupport.alwaysTrue();
+ hybridFlowPredicate = PredicateSupport.alwaysTrue();
+ refreshTokensPredicate = PredicateSupport.alwaysTrue();
}
+ /** {@inheritDoc} */
@Override
public boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return authorizationCodeFlowPredicate.test(profileRequestContext);
@@ -71,7 +72,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
* @param flag flag to set
*/
public void setAuthorizationCodeFlowEnabled(final boolean flag) {
- authorizationCodeFlowPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ authorizationCodeFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -84,6 +85,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
"Condition used to indicate whether authorization code flow is supported cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return hybridFlowPredicate.test(profileRequestContext);
@@ -95,7 +97,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
* @param flag flag to set
*/
public void setHybridFlowEnabled(final boolean flag) {
- hybridFlowPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ hybridFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -108,6 +110,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
"Condition used to indicate whether implicit flow is supported cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return implicitFlowPredicate.test(profileRequestContext);
@@ -119,7 +122,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
* @param flag flag to set
*/
public void setImplicitFlowEnabled(final boolean flag) {
- implicitFlowPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ implicitFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -132,6 +135,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
"Condition used to indicate whether hybrid flow is supported cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
return refreshTokensPredicate.test(profileRequestContext);
@@ -143,7 +147,7 @@ public abstract class AbstractOAuth2FlowAwareProfileConfiguration
* @param flag flag to set
*/
public void setRefreshTokensEnabled(final boolean flag) {
- refreshTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ refreshTokensPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
index 9a60a39..72d9cff 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
@@ -25,14 +25,13 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
-
import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.Positive;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -76,8 +75,8 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractInterceptor
issuerLookupStrategy = FunctionSupport.constant(null);
- resolveAttributesPredicate = Predicates.alwaysTrue();
- encryptionOptionalPredicate = Predicates.alwaysFalse();
+ resolveAttributesPredicate = PredicateSupport.alwaysTrue();
+ encryptionOptionalPredicate = PredicateSupport.alwaysFalse();
accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
@@ -120,7 +119,7 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractInterceptor
* @param flag flag to set
*/
public void setResolveAttributes(final boolean flag) {
- resolveAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ resolveAttributesPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -150,7 +149,7 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractInterceptor
* @param flag flag to set
*/
public void setEncryptionOptional(final boolean flag) {
- encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ encryptionOptionalPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -208,6 +207,7 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractInterceptor
Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
"Access token lifetime must be greater than 0");
+ assert lifetime != null;
return lifetime;
}
@@ -233,12 +233,11 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractInterceptor
accessTokenLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
// TODO: This was added in 2.2.0 to be compatible with the access token interface
@Override
- @Nonnull
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getAccessTokenClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
+ @Nonnull public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAccessTokenClaimsSetManipulationStrategy(@Nullable final ProfileRequestContext profileRequestContext) {
return accessTokenClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
index 711b6a7..21ece91 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
@@ -15,7 +15,6 @@
package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.util.Collection;
-import java.util.Collections;
import java.util.Map;
import java.util.Set;
import java.util.function.BiFunction;
@@ -27,7 +26,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
import com.nimbusds.oauth2.sdk.GrantType;
import net.shibboleth.oidc.profile.config.impl.AbstractOIDCSSOConfiguration;
@@ -36,8 +34,10 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -67,12 +67,6 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
*/
public DefaultOAuth2TokenConfiguration() {
this(OAuth2TokenConfiguration.PROFILE_ID);
-
- grantTypesLookupStrategy = FunctionSupport.constant(
- Set.of(GrantType.AUTHORIZATION_CODE.toString(), GrantType.REFRESH_TOKEN.toString()));
- refreshTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- enforceRefreshTokenRotationPredicate = Predicates.alwaysFalse();
- issueIdTokenViaRefreshTokenPredicate = Predicates.alwaysTrue();
}
/**
@@ -82,6 +76,11 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
*/
public DefaultOAuth2TokenConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
+ grantTypesLookupStrategy = FunctionSupport.constant(
+ Set.of(GrantType.AUTHORIZATION_CODE.toString(), GrantType.REFRESH_TOKEN.toString()));
+ refreshTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
+ enforceRefreshTokenRotationPredicate = PredicateSupport.alwaysFalse();
+ issueIdTokenViaRefreshTokenPredicate = PredicateSupport.alwaysTrue();
}
@Override
@@ -90,9 +89,9 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
final Collection<String> types = grantTypesLookupStrategy.apply(profileRequestContext);
if (types != null) {
- return Set.copyOf(types);
+ return CollectionSupport.copyToSet(types);
}
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
/**
@@ -102,13 +101,8 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
*/
public void setGrantTypes(@Nonnull @NonnullElements final Collection<String> types) {
Constraint.isNotNull(types, "Collection of types cannot be null");
-
- if (types != null) {
- grantTypesLookupStrategy =
- FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(types)));
- } else {
- grantTypesLookupStrategy = FunctionSupport.constant(null);
- }
+ grantTypesLookupStrategy =
+ FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(types)));
}
/**
@@ -121,6 +115,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
grantTypesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Nonnull
public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
@@ -155,6 +150,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
"Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
public boolean isEnforceRefreshTokenRotation(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -169,7 +165,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
* @since 2.1.0
*/
public void setEnforceRefreshTokenRotation(final boolean flag) {
- enforceRefreshTokenRotationPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ enforceRefreshTokenRotationPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -198,7 +194,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
* @since 2.2.0
*/
public void setIssueIdTokenViaRefreshToken(final boolean flag) {
- issueIdTokenViaRefreshTokenPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ issueIdTokenViaRefreshTokenPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenRevocationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenRevocationConfiguration.java
index 5ea2299..755ae0d 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenRevocationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenRevocationConfiguration.java
@@ -52,8 +52,6 @@ public class DefaultOAuth2TokenRevocationConfiguration extends AbstractOAuth2Tok
*/
public DefaultOAuth2TokenRevocationConfiguration() {
this(PROFILE_ID);
- revocationMethodLookupStrategy = FunctionSupport.constant(OAuth2TokenRevocationMethod.CHAIN.toString());
- revocationLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(6));
}
/**
@@ -63,6 +61,8 @@ public class DefaultOAuth2TokenRevocationConfiguration extends AbstractOAuth2Tok
*/
public DefaultOAuth2TokenRevocationConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
+ revocationMethodLookupStrategy = FunctionSupport.constant(OAuth2TokenRevocationMethod.CHAIN.toString());
+ revocationLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(6));
}
/**
@@ -88,6 +88,7 @@ public class DefaultOAuth2TokenRevocationConfiguration extends AbstractOAuth2Tok
revocationMethodLookupStrategy = FunctionSupport.constant(method != null ? method.toString() : null);
}
+ /** {@inheritDoc} */
@Override
public OAuth2TokenRevocationMethod getRevocationMethod(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -115,6 +116,7 @@ public class DefaultOAuth2TokenRevocationConfiguration extends AbstractOAuth2Tok
revocationLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
@Positive @Nonnull
public Duration getRevocationLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
@@ -122,6 +124,7 @@ public class DefaultOAuth2TokenRevocationConfiguration extends AbstractOAuth2Tok
Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
"Revocation lifetime must be greater than 0");
+ assert lifetime != null;
return lifetime;
}
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractorTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractorTest.java
index 74b15f0..412f7b3 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractorTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/audit/impl/ForceAuthnAuditExtractorTest.java
@@ -17,6 +17,8 @@ package net.shibboleth.oidc.profile.audit.impl;
import java.net.URI;
import java.net.URISyntaxException;
+import javax.annotation.Nullable;
+
import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -33,6 +35,7 @@ import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
/**
* Unit tests for {@link ForceAuthnAuditExtractor}.
*/
+ at SuppressWarnings("javadoc")
public class ForceAuthnAuditExtractorTest {
private ForceAuthnAuditExtractor extractor;
@@ -46,7 +49,7 @@ public class ForceAuthnAuditExtractorTest {
@Test
public void apply_oidcAuthenticationRequestWithoutPromptReturnsFalse() {
extractor = new ForceAuthnAuditExtractor(prc -> new OIDCAuthenticationRequest(new ClientID("mockId")));
- Assert.assertFalse(extractor.apply(new ProfileRequestContext()));
+ assertFalse(extractor.apply(new ProfileRequestContext()));
}
@Test
@@ -54,7 +57,7 @@ public class ForceAuthnAuditExtractorTest {
final AuthenticationRequest request = new AuthenticationRequest.Builder(ResponseType.CODE, Scope.parse("openid"),
new ClientID("mockId"), new URI("http://localhost/cb")).build();
extractor = new ForceAuthnAuditExtractor(prc -> request);
- Assert.assertFalse(extractor.apply(new ProfileRequestContext()));
+ assertFalse(extractor.apply(new ProfileRequestContext()));
}
@Test
@@ -62,7 +65,7 @@ public class ForceAuthnAuditExtractorTest {
final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mockId"));
request.setPrompt(Prompt.parse("none"));
extractor = new ForceAuthnAuditExtractor(prc -> request);
- Assert.assertFalse(extractor.apply(new ProfileRequestContext()));
+ assertFalse(extractor.apply(new ProfileRequestContext()));
}
@Test
@@ -70,7 +73,7 @@ public class ForceAuthnAuditExtractorTest {
final AuthenticationRequest request = new AuthenticationRequest.Builder(ResponseType.CODE, Scope.parse("openid"),
new ClientID("mockId"), new URI("http://localhost/cb")).prompt(Prompt.parse("none")).build();
extractor = new ForceAuthnAuditExtractor(prc -> request);
- Assert.assertFalse(extractor.apply(new ProfileRequestContext()));
+ assertFalse(extractor.apply(new ProfileRequestContext()));
}
@Test
@@ -78,7 +81,7 @@ public class ForceAuthnAuditExtractorTest {
final OIDCAuthenticationRequest request = new OIDCAuthenticationRequest(new ClientID("mockId"));
request.setPrompt(Prompt.parse("login"));
extractor = new ForceAuthnAuditExtractor(prc -> request);
- Assert.assertTrue(extractor.apply(new ProfileRequestContext()));
+ assertTrue(extractor.apply(new ProfileRequestContext()));
}
@Test
@@ -86,7 +89,15 @@ public class ForceAuthnAuditExtractorTest {
final AuthenticationRequest request = new AuthenticationRequest.Builder(ResponseType.CODE, Scope.parse("openid"),
new ClientID("mockId"), new URI("http://localhost/cb")).prompt(Prompt.parse("login")).build();
extractor = new ForceAuthnAuditExtractor(prc -> request);
- Assert.assertTrue(extractor.apply(new ProfileRequestContext()));
+ assertTrue(extractor.apply(new ProfileRequestContext()));
+ }
+
+ private void assertTrue(@Nullable final Boolean bool) {
+ Assert.assertTrue(bool != null && bool);
+ }
+
+ private void assertFalse(@Nullable final Boolean bool) {
+ Assert.assertTrue(bool != null && !bool);
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java
index cd5d48c..1f121a4 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/config/impl/OIDCCoreProtocolConfigurationTest.java
@@ -15,7 +15,6 @@
package net.shibboleth.oidc.profile.config.impl;
import java.time.Duration;
-import java.util.Collections;
import org.opensaml.security.config.BasicSecurityConfiguration;
import org.testng.Assert;
@@ -24,11 +23,13 @@ import org.testng.annotations.Test;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
/**
* Unit tests for {@link DefaultOIDCAuthorizationConfiguration}.
*/
+ at SuppressWarnings("javadoc")
public class OIDCCoreProtocolConfigurationTest {
private DefaultOIDCAuthorizationConfiguration config;
@@ -68,7 +69,7 @@ public class OIDCCoreProtocolConfigurationTest {
void testsetDefaultAuthenticationMethods() {
Assert.assertTrue(config.getDefaultAuthenticationMethods(null).isEmpty());
config.setDefaultAuthenticationMethods(
- Collections.singletonList(new AuthenticationContextClassReferencePrincipal("value")));
+ CollectionSupport.singletonList(new AuthenticationContextClassReferencePrincipal("value")));
Assert.assertTrue(
config.getDefaultAuthenticationMethods(null).contains(
new AuthenticationContextClassReferencePrincipal("value")));
@@ -122,21 +123,21 @@ public class OIDCCoreProtocolConfigurationTest {
@Test
void testsetAdditionalAudiencesForIdToken() {
Assert.assertTrue(config.getAdditionalAudiencesForIdToken(null).isEmpty());
- config.setAdditionalAudiencesForIdToken(Collections.singletonList("value"));
+ config.setAdditionalAudiencesForIdToken(CollectionSupport.singletonList("value"));
Assert.assertTrue(config.getAdditionalAudiencesForIdToken(null).contains("value"));
}
@Test
void testsetAuthenticationFlows() {
Assert.assertTrue(config.getAuthenticationFlows(null).isEmpty());
- config.setAuthenticationFlows(Collections.singletonList("value"));
+ config.setAuthenticationFlows(CollectionSupport.singletonList("value"));
Assert.assertTrue(config.getAuthenticationFlows(null).contains("value"));
}
@Test
void testsetPostAuthenticationFlows() {
Assert.assertTrue(config.getPostAuthenticationFlows(null).isEmpty());
- config.setPostAuthenticationFlows(Collections.singletonList("value"));
+ config.setPostAuthenticationFlows(CollectionSupport.singletonList("value"));
Assert.assertTrue(config.getPostAuthenticationFlows(null).contains("value"));
}
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoderTest.java
index 07bd319..1348e3f 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoderTest.java
@@ -14,9 +14,9 @@
package net.shibboleth.oidc.profile.decoding.impl;
-import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertTrue;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.decoder.MessageDecodingException;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
@@ -29,6 +29,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestSupplier;
+ at SuppressWarnings("javadoc")
public class HTTPPostAuthnResponseDecoderTest {
/** Mock servlet response.*/
@@ -53,15 +54,15 @@ public class HTTPPostAuthnResponseDecoderTest {
decoder.setHttpServletRequestSupplier(new ThreadLocalHttpServletRequestSupplier());
decoder.initialize();
decoder.decode();
- assertNotNull(decoder.getMessageContext());
- assertNotNull(decoder.getMessageContext().getMessage());
- assertTrue(decoder.getMessageContext().getMessage() instanceof AuthenticationSuccessResponse);
- assertTrue(((AuthenticationResponse)
- decoder.getMessageContext().getMessage()).getState()
- .getValue().equals("91c28622815dd9a92ef7c984c74c9e39.65317332"));
- assertTrue(((AuthenticationSuccessResponse)
- decoder.getMessageContext().getMessage()).getAuthorizationCode()
- .getValue().equals("XSpej7DkB2WYcF1Gzth5CCHw6Oxf3gxR"));
+
+ final MessageContext mc = decoder.getMessageContext();
+ assert mc != null;
+
+ final Object msg = mc.getMessage();
+ assertTrue(msg instanceof AuthenticationSuccessResponse);
+ assert msg != null;
+ assertTrue(((AuthenticationResponse) msg).getState().getValue().equals("91c28622815dd9a92ef7c984c74c9e39.65317332"));
+ assertTrue(((AuthenticationSuccessResponse) msg).getAuthorizationCode().getValue().equals("XSpej7DkB2WYcF1Gzth5CCHw6Oxf3gxR"));
}
@Test(expectedExceptions = MessageDecodingException.class)
@@ -72,5 +73,4 @@ public class HTTPPostAuthnResponseDecoderTest {
decoder.decode();
}
-
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPRedirectAuthnResponseDecoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPRedirectAuthnResponseDecoderTest.java
index 31a8aa3..379ec40 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPRedirectAuthnResponseDecoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPRedirectAuthnResponseDecoderTest.java
@@ -14,9 +14,9 @@
package net.shibboleth.oidc.profile.decoding.impl;
-import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertTrue;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.decoder.MessageDecodingException;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
@@ -29,6 +29,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestSupplier;
+ at SuppressWarnings("javadoc")
public class HTTPRedirectAuthnResponseDecoderTest {
/** Mock servlet response.*/
@@ -54,15 +55,17 @@ public class HTTPRedirectAuthnResponseDecoderTest {
decoder.setHttpServletRequestSupplier(new ThreadLocalHttpServletRequestSupplier());
decoder.initialize();
decoder.decode();
- assertNotNull(decoder.getMessageContext());
- assertNotNull(decoder.getMessageContext().getMessage());
- assertTrue(decoder.getMessageContext().getMessage() instanceof AuthenticationSuccessResponse);
- assertTrue(((AuthenticationResponse)
- decoder.getMessageContext().getMessage()).getState()
- .getValue().equals("91c28622815dd9a92ef7c984c74c9e39.65317332"));
- assertTrue(((AuthenticationSuccessResponse)
- decoder.getMessageContext().getMessage()).getAuthorizationCode()
- .getValue().equals("XSpej7DkB2WYcF1Gzth5CCHw6Oxf3gxR"));
+
+
+ final MessageContext mc = decoder.getMessageContext();
+ assert mc != null;
+
+ final Object msg = mc.getMessage();
+ assertTrue(msg instanceof AuthenticationSuccessResponse);
+ assert msg != null;
+
+ assertTrue(((AuthenticationResponse) msg).getState().getValue().equals("91c28622815dd9a92ef7c984c74c9e39.65317332"));
+ assertTrue(((AuthenticationSuccessResponse) msg).getAuthorizationCode().getValue().equals("XSpej7DkB2WYcF1Gzth5CCHw6Oxf3gxR"));
}
@Test(expectedExceptions = MessageDecodingException.class)
@@ -73,5 +76,4 @@ public class HTTPRedirectAuthnResponseDecoderTest {
decoder.decode();
}
-
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoderTest.java
index bf06347..f657928 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPPostAuthnRequestEncoderTest.java
@@ -26,7 +26,6 @@ import org.springframework.mock.web.MockHttpServletResponse;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import com.nimbusds.jwt.JWT;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.oauth2.sdk.ResponseType;
@@ -41,6 +40,7 @@ import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseSupplier
import net.shibboleth.shared.testing.VelocityEngine;
/** Test for the HTTPPostAuthnRequestEncoder.*/
+ at SuppressWarnings("javadoc")
public class HTTPPostAuthnRequestEncoderTest {
/** Mock servlet response.*/
@@ -141,4 +141,4 @@ public class HTTPPostAuthnRequestEncoderTest {
encoder.encode();
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoderTest.java
index 5d47807..5c1739b 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/HTTPRedirectAuthnRequestEncoderTest.java
@@ -39,6 +39,7 @@ import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseSupplier;
/** Test for the HTTPRedirectAuthnRequestEncoder.*/
+ at SuppressWarnings("javadoc")
public class HTTPRedirectAuthnRequestEncoderTest {
/** The encoder to test.*/
@@ -75,7 +76,7 @@ public class HTTPRedirectAuthnRequestEncoderTest {
encoder.initialize();
encoder.encode();
final String response = mockResponse.getRedirectedUrl();
- assertNotNull(response);
+ assert response != null;
// These are all required
assertTrue(response.contains("client_id"));
assertTrue(response.contains("response_type"));
@@ -96,7 +97,7 @@ public class HTTPRedirectAuthnRequestEncoderTest {
encoder.initialize();
encoder.encode();
final String response = mockResponse.getRedirectedUrl();
- assertNotNull(response);
+ assert response != null;
// These are all required
assertTrue(response.contains("client_id"));
assertTrue(response.contains("response_type"));
@@ -119,7 +120,7 @@ public class HTTPRedirectAuthnRequestEncoderTest {
encoder.initialize();
encoder.encode();
final String response = mockResponse.getRedirectedUrl();
- assertNotNull(response);
+ assert response != null;
// These are all required
assertTrue(response.contains("client_id"));
assertTrue(response.contains("response_type"));
@@ -140,4 +141,4 @@ public class HTTPRedirectAuthnRequestEncoderTest {
encoder.encode();
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoderTest.java
index f2c945d..35a4f1f 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/encoding/impl/SimpleNimbusResponseEncoderTest.java
@@ -40,6 +40,7 @@ import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseSupplier
/**
* Tests for {@link SimpleNimbusResponseEncoder}.
*/
+ at SuppressWarnings("javadoc")
public class SimpleNimbusResponseEncoderTest {
/** Mock servlet response.*/
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java
index f1eaa1f..bde49e9 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/AuthenticationRequestMessageEncoderFactoryTest.java
@@ -32,6 +32,7 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfi
import net.shibboleth.profile.context.RelyingPartyContext;
/** Test of the AuthenticationRequestMessageEncoderFactory class.*/
+ at SuppressWarnings("javadoc")
public class AuthenticationRequestMessageEncoderFactoryTest {
/** The factory to test.*/
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessageTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessageTest.java
index a3ce171..d1343b6 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessageTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/impl/FormOutboundKeySetResponseMessageTest.java
@@ -19,6 +19,7 @@ import java.util.ArrayList;
import java.util.List;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.mockito.Mockito;
import org.opensaml.messaging.context.MessageContext;
@@ -57,6 +58,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
/** {@link FormOutboundKeySetResponseMessage} unit test. */
+ at SuppressWarnings("javadoc")
public class FormOutboundKeySetResponseMessageTest {
private ProfileRequestContext profileRequestCtx;
@@ -125,9 +127,9 @@ public class FormOutboundKeySetResponseMessageTest {
JOSEException, java.text.ParseException {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
- Assert.assertTrue(profileRequestCtx.getOutboundMessageContext().getMessage() instanceof JSONSuccessResponse);
+ Assert.assertTrue(profileRequestCtx.ensureOutboundMessageContext().getMessage() instanceof JSONSuccessResponse);
final JSONSuccessResponse resp =
- (JSONSuccessResponse) profileRequestCtx.getOutboundMessageContext().getMessage();
+ (JSONSuccessResponse) profileRequestCtx.ensureOutboundMessageContext().ensureMessage();
Assert.assertTrue(resp.indicatesSuccess());
final JSONObject keyset = resp.toHTTPResponse().getContentAsJSONObject();
final JSONArray keys = (JSONArray) keyset.get("keys");
@@ -201,13 +203,11 @@ public class FormOutboundKeySetResponseMessageTest {
collection = new ArrayList<>(credentials);
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
return collection;
}
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
final Iterable<Credential> creds = resolve(criteria);
if (creds.iterator().hasNext()) {
return creds.iterator().next();
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfigurationTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfigurationTest.java
index 4c62e4a..f470f99 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfigurationTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/oauth2/config/impl/OAuth2TokenRevocationConfigurationTest.java
@@ -21,6 +21,7 @@ import org.testng.Assert;
/**
* Tests for {@link DefaultOAuth2TokenRevocationConfiguration}, tests only constructors.
*/
+ at SuppressWarnings("javadoc")
public class OAuth2TokenRevocationConfigurationTest {
private DefaultOAuth2TokenRevocationConfiguration conf;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list