[java-oidc-common] branch main updated: JCOMOIDC-81 - Support policies for unregistered clients
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Sep 1 08:31:29 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=3aa00f83c31ff3ef172aa220519a6269e49ff419
The following commit(s) were added to refs/heads/main by this push:
new 3aa00f8 JCOMOIDC-81 - Support policies for unregistered clients
3aa00f8 is described below
commit 3aa00f83c31ff3ef172aa220519a6269e49ff419
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 1 11:29:58 2023 +0300
JCOMOIDC-81 - Support policies for unregistered clients
https://shibboleth.atlassian.net/browse/JCOMOIDC-81
Added profile configuration option and lookup function. The class
UnregisteredClientPolicy currently matches MetadataPolicy, but may have
more features in the future.
---
.../metadata/policy/UnregisteredClientPolicy.java | 47 ++++++++++++++++++
.../UnregisteredClientPolicyLookupFunction.java | 56 ++++++++++++++++++++++
...th2ClientAuthenticableProfileConfiguration.java | 14 +++++-
...th2ClientAuthenticableProfileConfiguration.java | 42 ++++++++++++++--
4 files changed, 154 insertions(+), 5 deletions(-)
diff --git a/oidc-common-metadata-api/src/main/java/net/shibboleth/oidc/metadata/policy/UnregisteredClientPolicy.java b/oidc-common-metadata-api/src/main/java/net/shibboleth/oidc/metadata/policy/UnregisteredClientPolicy.java
new file mode 100644
index 0000000..eca4e6f
--- /dev/null
+++ b/oidc-common-metadata-api/src/main/java/net/shibboleth/oidc/metadata/policy/UnregisteredClientPolicy.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.metadata.policy;
+
+/**
+ * The policy used for validating single claim of an unregistered client.
+ *
+ * @since 3.0.0
+ */
+public class UnregisteredClientPolicy extends MetadataPolicy {
+
+ /**
+ * Constructor.
+ */
+ public UnregisteredClientPolicy() {
+ super();
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param metadataPolicy The metadata policy object to be used as a basis
+ */
+ public UnregisteredClientPolicy(final MetadataPolicy metadataPolicy) {
+ setAdd(metadataPolicy.getAdd());
+ setDefaultValue(metadataPolicy.getDefaultValue());
+ setEssential(metadataPolicy.getEssential());
+ setOneOfValues(metadataPolicy.getOneOfValues());
+ setRegexp(metadataPolicy.getRegexp());
+ setSubsetOfValues(metadataPolicy.getSubsetOfValues());
+ setSupersetOfValues(metadataPolicy.getSupersetOfValues());
+ setValue(metadataPolicy.getValue());
+ }
+
+}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/UnregisteredClientPolicyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/UnregisteredClientPolicyLookupFunction.java
new file mode 100644
index 0000000..f04f55c
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/UnregisteredClientPolicyLookupFunction.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.Map;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
+
+/**
+ * A function that obtains
+ * {@link OAuth2ClientAuthenticableProfileConfiguration#getUnregisteredClientPolicy(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 3.0.0
+ */
+public class UnregisteredClientPolicyLookupFunction
+ extends AbstractRelyingPartyLookupFunction<Map<String, UnregisteredClientPolicy>> {
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public Map<String, UnregisteredClientPolicy> apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OAuth2ClientAuthenticableProfileConfiguration oapc) {
+ return oapc.getUnregisteredClientPolicy(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
index 3c3772c..fac317a 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
@@ -14,6 +14,7 @@
package net.shibboleth.oidc.profile.oauth2.config;
+import java.util.Map;
import java.util.Set;
import javax.annotation.Nonnull;
@@ -23,6 +24,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -52,5 +54,15 @@ public interface OAuth2ClientAuthenticableProfileConfiguration
@Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getTokenEndpointAuthMethods(
@Nullable final ProfileRequestContext profileRequestContext);
-
+ /**
+ * Get the policy for validating unregistered clients.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the map of policies for validating claims of an unregistered client
+ *
+ * @since 3.0.0
+ */
+ @Nullable @Unmodifiable Map<String, UnregisteredClientPolicy> getUnregisteredClientPolicy(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index 0c59682..5d0a957 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -18,6 +18,7 @@ import java.security.Principal;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
+import java.util.Map;
import java.util.Set;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -33,10 +34,10 @@ import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
+import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
-import net.shibboleth.profile.config.AbstractConditionalProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NonNegative;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
@@ -85,7 +86,10 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
//TODO this is the same as the issuer in the proxy context?
@Nonnull private Function<ProfileRequestContext, String> clientIdLookupStrategy;
-
+ /** Lookup function to retrieve the policy for validating claims of an unregistered client. */
+ @Nonnull private Function<ProfileRequestContext, Map<String, UnregisteredClientPolicy>>
+ unregisteredClientPolicyLookupStrategy;
+
/**
* Constructor.
*
@@ -110,7 +114,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
clientCredentialLookupStrategy = FunctionSupport.constant(null);
clientIdLookupStrategy = FunctionSupport.constant(null);
-
+ unregisteredClientPolicyLookupStrategy = FunctionSupport.constant(null);
}
@Override
@@ -439,5 +443,35 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
@Nullable public String getClientId(@Nullable final ProfileRequestContext profileRequestContext) {
return clientIdLookupStrategy.apply(profileRequestContext);
}
-
+
+ @Override
+ @Nullable @Unmodifiable
+ public Map<String,UnregisteredClientPolicy> getUnregisteredClientPolicy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return unregisteredClientPolicyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Sets the policy for validating unregistered clients.
+ *
+ * @param policy policy to set
+ *
+ * @since 3.0.0
+ */
+ public void setUnregisteredClientPolicy(@Nonnull final Map<String,UnregisteredClientPolicy> policy) {
+ unregisteredClientPolicyLookupStrategy = FunctionSupport.constant(policy);
+ }
+
+ /**
+ * Set a lookup strategy for the policy for validating unregistered clients.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.0.0
+ */
+ public void setUnregisteredClientPolicyLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Map<String,UnregisteredClientPolicy>> strategy) {
+ unregisteredClientPolicyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list