[java-oidc-common] branch main updated: JOIDCRP-37 - Support the display authentication request parameter
Phil Smart
philip.smart at jisc.ac.uk
Tue Oct 3 13:53:43 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=17e0cc5a9e5bf11dbbacbc84c6fb57ae140c6bdf
The following commit(s) were added to refs/heads/main by this push:
new 17e0cc5 JOIDCRP-37 - Support the display authentication request parameter
17e0cc5 is described below
commit 17e0cc5a9e5bf11dbbacbc84c6fb57ae140c6bdf
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Oct 3 14:53:36 2023 +0100
JOIDCRP-37 - Support the display authentication request parameter
- Add support for the 'display' request parameter.
- Also fix some null cleanups
https://shibboleth.atlassian.net/browse/JOIDCRP-37
---
.../OIDCAuthenticationProfileConfiguration.java | 12 ++++
.../DefaultOIDCAuthorizationConfiguration.java | 84 +++++++++++++++-------
.../encoding/impl/AbstractOIDCMessageEncoder.java | 3 +
3 files changed, 72 insertions(+), 27 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
index 96eada3..8f2b807 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
@@ -96,6 +96,18 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
@ConfigurationSetting(name="maxAuthenticationAge")
@Nullable
public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the display parameter to use.
+ *
+ * @param profileRequestContext profile request context
+ * @return the display parameter value
+ *
+ * @since 3.1.0
+ */
+ @ConfigurationSetting(name="display")
+ @Nullable
+ public String getDisplay(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 8a85c03..2689d6f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -17,7 +17,6 @@ package net.shibboleth.oidc.profile.config.impl;
import java.security.Principal;
import java.time.Duration;
import java.util.Collection;
-import java.util.Collections;
import java.util.Map;
import java.util.Set;
import java.util.function.BiFunction;
@@ -29,8 +28,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
-
import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration;
import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
@@ -38,9 +35,11 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Positive;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -136,6 +135,9 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* signature should be validated (false). The default is false, the id_token signature should be validated.
*/
@Nonnull private Predicate<ProfileRequestContext> tlsServerValidationOnlyPredicate;
+
+ /** Lookup function to determine the optional display parameter value of an authentication request.*/
+ @Nonnull private Function<ProfileRequestContext,String> displayLookupStrategy;
/**
* Constructor.
@@ -155,26 +157,27 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
redirectUriOverrideLookupStrategy = FunctionSupport.constant(null);
responseTypeLookupStrategy = FunctionSupport.constant("code");
scopesLookupStrategy = FunctionSupport.constant(Set.of("openid"));
- signRequestObjectPredicate = Predicates.alwaysTrue();
- encryptRequestObjectPredicate = Predicates.alwaysFalse();
- retrieveUserInfoEndpointClaims = Predicates.alwaysTrue();
- proxiedAuthnInstantPredicate = Predicates.alwaysTrue();
+ signRequestObjectPredicate = PredicateSupport.alwaysTrue();
+ encryptRequestObjectPredicate = PredicateSupport.alwaysFalse();
+ retrieveUserInfoEndpointClaims = PredicateSupport.alwaysTrue();
+ proxiedAuthnInstantPredicate = PredicateSupport.alwaysTrue();
acrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
amrTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
- acrRequestAlwaysEssentialPredicate = Predicates.alwaysFalse();
- encodeConsentInTokensPredicate = Predicates.alwaysFalse();
- useRequestObjectPredicate = Predicates.alwaysFalse();
+ acrRequestAlwaysEssentialPredicate = PredicateSupport.alwaysFalse();
+ encodeConsentInTokensPredicate = PredicateSupport.alwaysFalse();
+ useRequestObjectPredicate = PredicateSupport.alwaysFalse();
authorizeCodeLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
encodedAttributesLookupStrategy = FunctionSupport.constant(null);
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
httpRequestMethodLookupStrategy = FunctionSupport.constant(HttpRequestMethod.GET.toString());
- includeIssuerInResponsePredicate = Predicates.alwaysFalse();
+ includeIssuerInResponsePredicate = PredicateSupport.alwaysFalse();
authorizationCodeClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
maxAuthenticationAgeLookupStrategy = FunctionSupport.constant(null);
loginHintLookupStrategy = FunctionSupport.constant(null);
userInfoHttpRequestMethodLookupStrategy = FunctionSupport.constant(HttpRequestMethod.GET.toString());
responseModeLookupStrategy = FunctionSupport.constant(null);
- tlsServerValidationOnlyPredicate = Predicates.alwaysFalse();
+ tlsServerValidationOnlyPredicate = PredicateSupport.alwaysFalse();
+ displayLookupStrategy = FunctionSupport.constant(null);
}
@Override
@@ -188,7 +191,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @param flag flag to set
*/
public void setAcrRequestAlwaysEssential(final boolean flag) {
- acrRequestAlwaysEssentialPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ acrRequestAlwaysEssentialPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -211,7 +214,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @param flag flag to set
*/
public void setUseRequestObject(final boolean flag) {
- useRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ useRequestObjectPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -236,7 +239,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @param flag flag to set
*/
public void setEncodeConsentInTokens(final boolean flag) {
- encodeConsentInTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ encodeConsentInTokensPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -261,7 +264,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @since 2.2.0
*/
public void setRetrieveUserInfoEndpointClaims(final boolean flag) {
- retrieveUserInfoEndpointClaims = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ retrieveUserInfoEndpointClaims = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -288,7 +291,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @since 2.2.0
*/
public void setSignRequestObject(final boolean flag) {
- signRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ signRequestObjectPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -315,7 +318,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @since 2.2.0
*/
public void setEncryptRequestObject(final boolean flag) {
- encryptRequestObjectPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ encryptRequestObjectPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -433,9 +436,9 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
final Set<String> attributes = encodedAttributesLookupStrategy.apply(profileRequestContext);
if (attributes != null) {
- return Set.copyOf(attributes);
+ return CollectionSupport.copyToSet(attributes);
}
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
/**
@@ -471,9 +474,9 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
final Set<String> attributes = deniedUserInfoAttributesLookupStrategy.apply(profileRequestContext);
if (attributes != null) {
- return Set.copyOf(attributes);
+ return CollectionSupport.copyToSet(attributes);
}
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
/**
@@ -517,7 +520,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @since 2.1.0
*/
public void setIncludeIssuerInResponse(final boolean flag) {
- includeIssuerInResponsePredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ includeIssuerInResponsePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -680,7 +683,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
*
*/
public void setProxiedAuthnInstant(final boolean flag) {
- proxiedAuthnInstantPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ proxiedAuthnInstantPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
@Override
@@ -733,7 +736,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
*
* @since 2.2.0
*/
- public void setLoginHint(final String fixedLoginHint) {
+ public void setLoginHint(@Nonnull @NotEmpty final String fixedLoginHint) {
Constraint.isNotEmpty(fixedLoginHint, "Fixed login hint can not be null or empty");
loginHintLookupStrategy = FunctionSupport.constant(fixedLoginHint);
}
@@ -819,7 +822,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @since 2.2.0
*/
public void setTlsServerValidationSufficient(final boolean flag) {
- tlsServerValidationOnlyPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ tlsServerValidationOnlyPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
/**
@@ -835,9 +838,36 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
}
@Override
- public boolean isTlsServerValidationSufficient(final ProfileRequestContext profileRequestContext) {
+ public boolean isTlsServerValidationSufficient(@Nullable final ProfileRequestContext profileRequestContext) {
return tlsServerValidationOnlyPredicate.test(profileRequestContext);
}
+ /**
+ * Set the display parameter value to use.
+ *
+ * @param display the display parameter value
+ *
+ * @since 3.1.0
+ */
+ public void setDisplay(@Nullable final String display){
+ displayLookupStrategy = FunctionSupport.constant(display);
+ }
+
+ /**
+ * Set the lookup strategy to determine the display parameter value for authorization requests.
+ *
+ * @param strategy the strategy to use
+ *
+ * @since 2.2.0
+ */
+ public void setDisplayLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
+ displayLookupStrategy = Constraint.isNotNull(strategy, "Display lookup strategy can not be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String getDisplay(@Nullable final ProfileRequestContext profileRequestContext) {
+ return displayLookupStrategy.apply(profileRequestContext);
+ }
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
index 88bc076..2e48004 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
@@ -223,6 +223,9 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
if (req.getMaxAge() != null) {
params.add(new Pair<>("max_age", Long.toString(req.getMaxAge().toSeconds())));
}
+ if (req.getDisplay() != null) {
+ params.add(new Pair<>("display", req.getDisplay().toString()));
+ }
if (req.getLoginHint() != null) {
params.add(new Pair<>("login_hint", req.getLoginHint()));
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list