[java-oidc-common] branch main updated: JCOMOIDC-74 - Add annotations to profile configuration settings for diagnostics
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Sep 8 08:50:17 UTC 2023
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=bdb82529b61768f025375a9eee050858ab33b05f
The following commit(s) were added to refs/heads/main by this push:
new bdb8252 JCOMOIDC-74 - Add annotations to profile configuration settings for diagnostics
bdb8252 is described below
commit bdb82529b61768f025375a9eee050858ab33b05f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 8 11:49:10 2023 +0300
JCOMOIDC-74 - Add annotations to profile configuration settings for diagnostics
https://shibboleth.atlassian.net/browse/JCOMOIDC-74
Added '@ConfigurationSetting' annotations to profile configuration interfaces.
---
.../OIDCAuthenticationProfileConfiguration.java | 6 +++
...enticationRelyingPartyProfileConfiguration.java | 15 +++++--
.../config/OIDCAuthorizationConfiguration.java | 6 +++
.../OIDCDynamicRegistrationConfiguration.java | 4 ++
.../config/OIDCFlowAwareProfileConfiguration.java | 4 +-
.../OIDCIDTokenProducingProfileConfiguration.java | 5 +++
.../config/OIDCSSOProfileConfiguration.java | 5 ++-
.../profile/config/OIDCUserInfoConfiguration.java | 2 +
...h2AccessTokenProducingProfileConfiguration.java | 50 ++++++++++++----------
...orizationCodeProducingProfileConfiguration.java | 3 ++
.../OAuth2AuthorizationProfileConfiguration.java | 23 ++++++----
...entAuthenticableClientProfileConfiguration.java | 4 ++
...th2ClientAuthenticableProfileConfiguration.java | 4 ++
.../OAuth2FlowAwareProfileConfiguration.java | 10 +++--
...2RefreshTokenProducingProfileConfiguration.java | 3 ++
.../oauth2/config/OAuth2TokenConfiguration.java | 7 ++-
.../OAuth2TokenEncryptionProfileConfiguration.java | 2 +
.../config/OAuth2TokenRevocationConfiguration.java | 3 ++
.../OAuth2TokenValidatingProfileConfiguration.java | 2 +
19 files changed, 115 insertions(+), 43 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
index 6b78030..96eada3 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
@@ -25,6 +25,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/** Generic configuration for an OIDC 1.0 authentication request.*/
@@ -40,6 +41,7 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
*
* @return whether authentication request parameters should be passed in a single, self contained, JWT
*/
+ @ConfigurationSetting(name="useRequestObject")
boolean isUseRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -52,6 +54,7 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="authenticationMethodsReferencesTranslationStrategy")
@Nullable Function<Collection<String>,Collection<Principal>>
getAuthenticationMethodsReferencesTranslationStrategy(@Nullable final ProfileRequestContext prc);
@@ -65,6 +68,7 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="authenticationContextClassReferenceTranslationStrategy")
@Nullable Function<Collection<String>,Collection<Principal>>
getAuthenticationContextClassReferenceTranslationStrategy(@Nullable final ProfileRequestContext prc);
@@ -77,6 +81,7 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="loginHint")
@Nullable @NotEmpty String getLoginHint(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -88,6 +93,7 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="maxAuthenticationAge")
@Nullable
public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
index 26bf806..ca37e6d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
@@ -19,6 +19,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/**
@@ -38,6 +39,7 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="userInfoHttpRequestMethod")
@Nullable HttpRequestMethod getUserInfoHttpRequestMethod(
@Nullable final ProfileRequestContext profileRequestContext);
@@ -50,6 +52,7 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="retrieveUserInfoEndpointClaims")
boolean isRetrieveUserInfoEndpointClaims(@Nonnull final ProfileRequestContext profileRequestContext);
/**
@@ -61,6 +64,7 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="signRequestObject")
boolean isSignRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -72,6 +76,7 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="encryptRequestObject")
boolean isEncryptRequestObject(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -86,7 +91,8 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
*
* @since 2.2.0
*/
- boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext);
+ @ConfigurationSetting(name="proxiedAuthnInstant")
+ boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the redirect_uri override if set.
@@ -97,7 +103,8 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
*
* @since 2.2.0
*/
- @Nullable @NotEmpty String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext);
+ @ConfigurationSetting(name="redirectUriOverride")
+ @Nullable @NotEmpty String getRedirectUriOverride(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Is TLS server validation of the token endpoint sufficient to verify an id_token without checking the id_token
@@ -110,7 +117,7 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
*
* @since 2.2.0
*/
- boolean isTlsServerValidationSufficient(@Nullable final ProfileRequestContext profileRequestContext);
-
+ @ConfigurationSetting(name="tlsServerValidationSufficient")
+ boolean isTlsServerValidationSufficient(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index a48504f..1a2d6aa 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -24,6 +24,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationCodeProducingProfileConfiguration;
import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
@@ -48,6 +49,7 @@ public interface OIDCAuthorizationConfiguration extends OIDCAuthenticationProfil
*
* @return whether all acr claim requests should be treated as Essential
*/
+ @ConfigurationSetting(name="acrRequestAlwaysEssential")
boolean isAcrRequestAlwaysEssential(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -57,6 +59,7 @@ public interface OIDCAuthorizationConfiguration extends OIDCAuthenticationProfil
*
* @return whether to encode consent in authorization code and access/refresh tokens
*/
+ @ConfigurationSetting(name="encodeConsentInTokens")
boolean isEncodeConsentInTokens(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -69,6 +72,7 @@ public interface OIDCAuthorizationConfiguration extends OIDCAuthenticationProfil
*
* @return the attribute IDs to omit from UserInfo token
*/
+ @ConfigurationSetting(name="deniedUserInfoAttributes")
@Nonnull @NonnullElements @NotLive Set<String> getDeniedUserInfoAttributes(
@Nullable final ProfileRequestContext profileRequestContext);
@@ -82,6 +86,7 @@ public interface OIDCAuthorizationConfiguration extends OIDCAuthenticationProfil
* @since 2.1.0
*
*/
+ @ConfigurationSetting(name="includeIssuerInResponse")
boolean isIncludeIssuerInResponse(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -92,6 +97,7 @@ public interface OIDCAuthorizationConfiguration extends OIDCAuthenticationProfil
*
* @return the attribute IDs to encode
*/
+ @ConfigurationSetting(name="encodedAttributes")
@Nonnull @NonnullElements @NotLive Set<String> getEncodedAttributes(
@Nullable final ProfileRequestContext profileRequestContext);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
index c7fc274..379b49f 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCDynamicRegistrationConfiguration.java
@@ -24,6 +24,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NonNegative;
/**
@@ -47,6 +48,7 @@ public interface OIDCDynamicRegistrationConfiguration extends OverriddenIssuerPr
*
* @return dynamic registration validity period
*/
+ @ConfigurationSetting(name="registrationValidityPeriod")
@Nullable @NonNegative
Duration getRegistrationValidityPeriod(@Nullable final ProfileRequestContext profileRequestContext);
@@ -59,6 +61,7 @@ public interface OIDCDynamicRegistrationConfiguration extends OverriddenIssuerPr
*
* @return client secret expiration period
*/
+ @ConfigurationSetting(name="secretExpirationPeriod")
@Nullable @NonNegative
Duration getSecretExpirationPeriod(@Nullable final ProfileRequestContext profileRequestContext);
@@ -69,6 +72,7 @@ public interface OIDCDynamicRegistrationConfiguration extends OverriddenIssuerPr
*
* @return metadata policy
*/
+ @ConfigurationSetting(name="metadataPolicy")
@Nullable
Map<String,MetadataPolicy> getMetadataPolicy(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCFlowAwareProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCFlowAwareProfileConfiguration.java
index bfc8c4b..d820c13 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCFlowAwareProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCFlowAwareProfileConfiguration.java
@@ -19,6 +19,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
/**
* Interface for profile configurations that understand OIDC specific authentication flows in addition to the OAuth 2.0
@@ -34,6 +35,7 @@ public interface OIDCFlowAwareProfileConfiguration extends OIDCProfileConfigurat
*
* @return whether implicit flow is supported by this profile
*/
- boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+ @ConfigurationSetting(name="hybridFlowEnabled")
+ boolean isHybridFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
index e72f176..db54837 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCIDTokenProducingProfileConfiguration.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Positive;
@@ -42,6 +43,7 @@ public interface OIDCIDTokenProducingProfileConfiguration extends OIDCProfileCon
*
* @return ID token lifetime
*/
+ @ConfigurationSetting(name="iDTokenLifetime")
@Positive @Nonnull Duration getIDTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -53,6 +55,7 @@ public interface OIDCIDTokenProducingProfileConfiguration extends OIDCProfileCon
*
* @since 2.1.0
*/
+ @ConfigurationSetting(name="iDTokenManipulationStrategy")
@Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> getIDTokenManipulationStrategy(
@Nullable final ProfileRequestContext profileRequestContext);
@@ -68,6 +71,7 @@ public interface OIDCIDTokenProducingProfileConfiguration extends OIDCProfileCon
*
* @return the attribute IDs to include in all cases
*/
+ @ConfigurationSetting(name="alwaysIncludedAttributes")
@Nonnull @NonnullElements @NotLive Set<String> getAlwaysIncludedAttributes(
@Nullable final ProfileRequestContext profileRequestContext);
@@ -80,6 +84,7 @@ public interface OIDCIDTokenProducingProfileConfiguration extends OIDCProfileCon
*
* @return the additional audiences
*/
+ @ConfigurationSetting(name="additionalAudiencesForIdToken")
@Nonnull @NonnullElements @NotLive Set<String> getAdditionalAudiencesForIdToken(
@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
index 20bb684..35e95a7 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
@@ -19,6 +19,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/** Profile configuration generic to all OIDC SSO profiles.*/
@@ -34,6 +35,7 @@ public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
*
* @return whether client is required to use PKCE
*/
+ @ConfigurationSetting(name="forcePKCE")
boolean isForcePKCE(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -43,8 +45,7 @@ public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
*
* @return whether client is allowed to use PKCE code challenge method plain
*/
+ @ConfigurationSetting(name="allowPKCEPlain")
boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext);
-
-
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
index 5bf38f3..6e15efa 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
@@ -24,6 +24,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenValidatingProfileConfiguration;
import net.shibboleth.profile.config.AttributeResolvingProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
@@ -50,6 +51,7 @@ public interface OIDCUserInfoConfiguration extends AttributeResolvingProfileConf
*
* @return the attribute IDs to omit from UserInfo token
*/
+ @ConfigurationSetting(name="deniedUserInfoAttributes")
@Nonnull @NonnullElements @NotLive Set<String> getDeniedUserInfoAttributes(
@Nullable final ProfileRequestContext profileRequestContext);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
index ee3f44c..fa558c5 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
@@ -23,6 +23,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.Positive;
@@ -40,30 +41,33 @@ public interface OAuth2AccessTokenProducingProfileConfiguration extends OAuth2Pr
*
* @since 2.1.0
*/
- @Nullable @NotEmpty String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext);
+ @ConfigurationSetting(name="accessTokenType")
+ @Nullable @NotEmpty String getAccessTokenType(@Nullable final ProfileRequestContext profileRequestContext);
- /**
- * Get access token lifetime.
- *
- * <p>Defaults to 10 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return access token lifetime
- */
- @Positive @Nonnull Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get access token lifetime.
+ *
+ * <p>Defaults to 10 minutes.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return access token lifetime
+ */
+ @ConfigurationSetting(name="accessTokenLifetime")
+ @Positive @Nonnull Duration getAccessTokenLifetime(@Nullable final ProfileRequestContext profileRequestContext);
- /**
- * Get the bi-function for manipulating access token claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating access token claims set
- *
- * @since 2.1.0
- */
- @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getAccessTokenClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get the bi-function for manipulating access token claims set.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-function for manipulating access token claims set
+ *
+ * @since 2.1.0
+ */
+ @ConfigurationSetting(name="accessTokenClaimsSetManipulationStrategy")
+ @Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
+ getAccessTokenClaimsSetManipulationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java
index 7e12e0b..ba20b78 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationCodeProducingProfileConfiguration.java
@@ -23,6 +23,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.Positive;
/**
@@ -40,6 +41,7 @@ public interface OAuth2AuthorizationCodeProducingProfileConfiguration extends OA
*
* @return authz code lifetime
*/
+ @ConfigurationSetting(name="authorizeCodeLifetime")
@Positive @Nonnull
Duration getAuthorizeCodeLifetime(@Nullable final ProfileRequestContext profileRequestContext);
@@ -52,6 +54,7 @@ public interface OAuth2AuthorizationCodeProducingProfileConfiguration extends OA
*
* @since 2.1.0
*/
+ @ConfigurationSetting(name="authorizationCodeClaimsSetManipulationStrategy")
@Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
getAuthorizationCodeClaimsSetManipulationStrategy(
@Nullable final ProfileRequestContext profileRequestContext);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
index 931abf5..3904d0b 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
@@ -20,6 +20,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
@@ -51,6 +52,7 @@ public interface OAuth2AuthorizationProfileConfiguration {
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="scopes")
@Nullable @NonnullElements @Unmodifiable @NotLive Set<String> getScopes(
@Nullable final ProfileRequestContext profileRequestContext);
@@ -61,18 +63,20 @@ public interface OAuth2AuthorizationProfileConfiguration {
*
* @return the HTTP request method
*/
+ @ConfigurationSetting(name="httpRequestMethod")
@Nullable HttpRequestMethod getHttpRequestMethod(@Nullable final ProfileRequestContext profileRequestContext);
- /**
- * Get the response_mode to use for authorization requests.
- *
- * @param profileRequestContext the profile request context
- *
- * @return the response_mode
- *
- * @since 2.2.0
- */
+ /**
+ * Get the response_mode to use for authorization requests.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the response_mode
+ *
+ * @since 2.2.0
+ */
+ @ConfigurationSetting(name="responseMode")
@Nullable @NotEmpty String getResponseMode(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -84,6 +88,7 @@ public interface OAuth2AuthorizationProfileConfiguration {
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="responseType")
@Nullable @NotEmpty String getResponseType(@Nullable final ProfileRequestContext profileRequestContext);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
index cc2fdee..66e9a27 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
@@ -21,6 +21,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/**
@@ -40,6 +41,7 @@ public interface OAuth2ClientAuthenticableClientProfileConfiguration
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="tokenEndpointAuthMethod")
@Nonnull String getTokenEndpointAuthMethod(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -53,6 +55,7 @@ public interface OAuth2ClientAuthenticableClientProfileConfiguration
* @since 2.2.0
*
*/
+ @ConfigurationSetting(name="clientCredential")
@Nullable ClientSecretCredential getClientCredential(
@Nullable final ProfileRequestContext profileRequestContext);
@@ -66,6 +69,7 @@ public interface OAuth2ClientAuthenticableClientProfileConfiguration
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="clientId")
@Nullable @NotEmpty String getClientId(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
index fac317a..9cfc7c6 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableProfileConfiguration.java
@@ -25,6 +25,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -42,6 +43,7 @@ public interface OAuth2ClientAuthenticableProfileConfiguration
*
* @since 3.1.0
*/
+ @ConfigurationSetting(name="claimsValidator")
@Nullable ClaimsValidator getClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -51,6 +53,7 @@ public interface OAuth2ClientAuthenticableProfileConfiguration
*
* @return enabled token endpoint authentication methods
*/
+ @ConfigurationSetting(name="tokenEndpointAuthMethods")
@Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getTokenEndpointAuthMethods(
@Nullable final ProfileRequestContext profileRequestContext);
@@ -63,6 +66,7 @@ public interface OAuth2ClientAuthenticableProfileConfiguration
*
* @since 3.0.0
*/
+ @ConfigurationSetting(name="unregisteredClientPolicy")
@Nullable @Unmodifiable Map<String, UnregisteredClientPolicy> getUnregisteredClientPolicy(
@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2FlowAwareProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2FlowAwareProfileConfiguration.java
index a3317bd..54ad731 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2FlowAwareProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2FlowAwareProfileConfiguration.java
@@ -18,6 +18,8 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
+
/**
* Interface for profile configurations that understand OAuth 2.0 authorization grants corresponding to OIDC
* authentication flows.
@@ -31,8 +33,8 @@ public interface OAuth2FlowAwareProfileConfiguration extends OAuth2ProfileConfig
*
* @return whether authorization code flow is supported by this profile
*/
- boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
-
+ @ConfigurationSetting(name="authorizationCodeFlowEnabled")
+ boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get whether hybrid flow is supported by this profile.
@@ -41,7 +43,8 @@ public interface OAuth2FlowAwareProfileConfiguration extends OAuth2ProfileConfig
*
* @return whether hybrid flow is supported by this profile
*/
- boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
+ @ConfigurationSetting(name="implicitFlowEnabled")
+ boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get whether refresh tokens are supported by this profile.
@@ -50,6 +53,7 @@ public interface OAuth2FlowAwareProfileConfiguration extends OAuth2ProfileConfig
*
* @return whether refresh tokens are supported by this profile
*/
+ @ConfigurationSetting(name="refreshTokensEnabled")
boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
index 8e3a7df..649ebe5 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2RefreshTokenProducingProfileConfiguration.java
@@ -21,6 +21,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.Positive;
/**
@@ -53,6 +54,7 @@ public interface OAuth2RefreshTokenProducingProfileConfiguration extends OAuth2P
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="refreshTokenTimeout")
@Nonnull @Positive Duration getRefreshTokenTimeout(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -66,6 +68,7 @@ public interface OAuth2RefreshTokenProducingProfileConfiguration extends OAuth2P
*
* @since 2.2.0
*/
+ @ConfigurationSetting(name="refreshTokenChainLifetime")
@Nonnull @Positive Duration getRefreshTokenChainLifetime(
@Nullable final ProfileRequestContext profileRequestContext);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
index 898cdeb..e49d9ad 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenConfiguration.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.profile.config.OIDCSSOProviderConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
@@ -44,6 +45,7 @@ public interface OAuth2TokenConfiguration extends OIDCSSOProviderConfiguration {
*
* @return enabled grant types
*/
+ @ConfigurationSetting(name="grantTypes")
@Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getGrantTypes(
@Nullable final ProfileRequestContext profileRequestContext);
@@ -58,6 +60,7 @@ public interface OAuth2TokenConfiguration extends OIDCSSOProviderConfiguration {
*
* @since 2.1.0
*/
+ @ConfigurationSetting(name="enforceRefreshTokenRotation")
boolean isEnforceRefreshTokenRotation(
@Nullable final ProfileRequestContext profileRequestContext);
@@ -71,6 +74,7 @@ public interface OAuth2TokenConfiguration extends OIDCSSOProviderConfiguration {
* @since 2.1.0
*/
// TODO: move to OAuth2RefreshTokenProducingProfileConfiguration in 3.0.0
+ @ConfigurationSetting(name="refreshTokenClaimsSetManipulationStrategy")
@Nonnull BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
getRefreshTokenClaimsSetManipulationStrategy(@Nullable final ProfileRequestContext profileRequestContext);
@@ -84,6 +88,7 @@ public interface OAuth2TokenConfiguration extends OIDCSSOProviderConfiguration {
*
* @since 2.2.0
*/
- boolean isIssueIdTokenViaRefreshToken(@Nullable final ProfileRequestContext profileRequestContext);
+ @ConfigurationSetting(name="issueIdTokenViaRefreshToken")
+ boolean isIssueIdTokenViaRefreshToken(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenEncryptionProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenEncryptionProfileConfiguration.java
index 4c79ede..bad8e52 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenEncryptionProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenEncryptionProfileConfiguration.java
@@ -19,6 +19,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.profile.config.OIDCProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
/**
* Profile configuration for token endpoints that deal with encryption.
@@ -32,6 +33,7 @@ public interface OAuth2TokenEncryptionProfileConfiguration extends OIDCProfileCo
*
* @return true iff encryption is optional
*/
+ @ConfigurationSetting(name="encryptionOptional")
boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
index e28e0d5..124f803 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenRevocationConfiguration.java
@@ -22,6 +22,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.Positive;
@@ -56,6 +57,7 @@ public interface OAuth2TokenRevocationConfiguration extends OAuth2TokenValidatin
*
* @since 2.1.0
*/
+ @ConfigurationSetting(name="revocationMethod")
OAuth2TokenRevocationMethod getRevocationMethod(@Nullable final ProfileRequestContext profileRequestContext);
/**
@@ -69,6 +71,7 @@ public interface OAuth2TokenRevocationConfiguration extends OAuth2TokenValidatin
*
* @since 2.1.0
*/
+ @ConfigurationSetting(name="revocationLifetime")
@Positive @Nonnull
Duration getRevocationLifetime(@Nullable final ProfileRequestContext profileRequestContext);
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java
index fa0f381..20717ce 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenValidatingProfileConfiguration.java
@@ -21,6 +21,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
/**
* Profile configuration for OIDC-aware OAuth 2.0 token endpoints.
@@ -35,6 +36,7 @@ public interface OAuth2TokenValidatingProfileConfiguration extends OAuth2ClientA
*
* @return the validator to use
*/
+ @ConfigurationSetting(name="issuedClaimsValidator")
@Nullable ClaimsValidator getIssuedClaimsValidator(@Nullable final ProfileRequestContext profileRequestContext);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list