[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-37 - Support the display authentication request parameter

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=d41c2691a09b7631dad3d4ad9bdfa53eaee02efe

The following commit(s) were added to refs/heads/main by this push:
     new d41c269  JOIDCRP-37 - Support the display authentication request parameter
d41c269 is described below

commit d41c2691a09b7631dad3d4ad9bdfa53eaee02efe
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Oct 3 14:54:12 2023 +0100

    JOIDCRP-37 - Support the display authentication request parameter
    
    https://shibboleth.atlassian.net/browse/JOIDCRP-37
---
 .../authn/oidc/rp/impl/BuildRequestObject.java     |  6 ++-
 .../oidc/rp/messaging/impl/AddDisplayHandler.java  | 53 ++++++++++++++++++++++
 .../oidc-relying-party-authn-beans.xml             |  2 +
 3 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
index 732ce24..35882dc 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/BuildRequestObject.java
@@ -203,7 +203,8 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
         return true;
     }
 
-    //TODO maybe we could share building of a request object or query params in some way
+    //TODO maybe we could share building of a request object or query params (from AbstractOIDCMessageEncoder)
+    // in some way
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -242,7 +243,8 @@ public class BuildRequestObject extends AbstractAuthenticationAction {
         setClaimIfPresent(requestObjectClaims,"scope", authnRequest.getScope());
         setClaimIfPresent(requestObjectClaims, "max_age", authnRequest.getMaxAge()); 
         setClaimIfPresent(requestObjectClaims, "login_hint", authnRequest.getLoginHint()); 
-        setClaimIfPresent(requestObjectClaims, "prompt", authnRequest.getPrompt()); 
+        setClaimIfPresent(requestObjectClaims, "prompt", authnRequest.getPrompt());
+        setClaimIfPresent(requestObjectClaims, "display", authnRequest.getDisplay());
         
         if (authnRequest.providerSupportsClaimsParameter()) {
             // Build the ACRs if set before adding the 'claims' claim
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddDisplayHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddDisplayHandler.java
new file mode 100644
index 0000000..713fcc9
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddDisplayHandler.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandlerException;
+import org.slf4j.Logger;
+
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.openid.connect.sdk.Display;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
+
+
+/** 
+ * Message handler that adds the optional 'display' request parameter if manually set on the profile configuration. 
+ */
+public class AddDisplayHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
+
+    /** Logger. */
+    @Nonnull private final Logger log = LoggerFactory.getLogger(AddDisplayHandler.class);
+
+    @Override protected void doInvoke(@Nonnull final MessageContext messageContext) 
+            throws MessageHandlerException {   
+       
+       final String display = getProfileConfiguration().getDisplay(lookupProfileRequestContext(messageContext));
+       if (StringSupport.trimOrNull(display) != null) {           
+           try {
+               getAuthenticationRequest().setDisplay(Display.parse(display));
+               log.trace("Adding 'display' request parameter value '{}'", display);
+            } catch (final ParseException e) {
+                throw new MessageHandlerException("Unable to add a 'display' value of: " + display);
+            }
+       }
+  
+    }
+
+}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 0b2c168..a733ee7 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -106,6 +106,8 @@
                             class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddResponseTypeAndModeHandler"/> 
                         <bean id="AddMaxAge" scope="prototype"
                             class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddMaxAgeHandler"/> 
+                        <bean id="AddDisplay" scope="prototype"
+                            class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddDisplayHandler"/>
                         <bean id="AddScopes" scope="prototype"
                             class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddScopesHandler"/>
                         <bean id="AddNonce" scope="prototype"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.