[java-oidc-common] branch main updated: JCOMOIDC-85 - Add PKCE support to authorization request object
Phil Smart
philip.smart at jisc.ac.uk
Fri Sep 29 15:06:58 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=dbcabf7e130875ff61adb9418164ff9e1b001af9
The following commit(s) were added to refs/heads/main by this push:
new dbcabf7 JCOMOIDC-85 - Add PKCE support to authorization request object
dbcabf7 is described below
commit dbcabf7e130875ff61adb9418164ff9e1b001af9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Sep 29 16:06:51 2023 +0100
JCOMOIDC-85 - Add PKCE support to authorization request object
https://shibboleth.atlassian.net/browse/JCOMOIDC-85
---
.../profile/core/OAuthAuthorizationRequest.java | 110 +++++++++++++++++++++
.../profile/core/OIDCAuthenticationRequest.java | 14 +--
2 files changed, 117 insertions(+), 7 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java
index 7561327..aeedfff 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java
@@ -25,6 +25,7 @@ import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.id.State;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
/**
@@ -61,6 +62,48 @@ public class OAuthAuthorizationRequest {
*/
@Nullable private ResponseMode defaultResponseMode;
+ /**
+ * The authorisation code_verifier for Proof Key for Code Exchange.
+ */
+ @Nullable private String codeVerifier;
+
+ /** The authorisation code_challenge for Proof Key for Code Exchange.*/
+ @Nullable private String codeChallenge;
+
+ /** The code challenge method for Proof Key for Code Exchange.*/
+ public enum CodeChallengeMethod {
+
+ /** The code_challenge is the same as the code_verifier.*/
+ PLAIN("plain"),
+
+ /** Compute the code_challenge by SHA-256 hashing and base64 URL encoding the code_verifier.*/
+ S256("S256");
+
+ /** The value.*/
+ @Nonnull @NotEmpty private final String value;
+
+ /**
+ * Constructor.
+ *
+ * @param valueIn the code_challenge_method value;
+ */
+ private CodeChallengeMethod(@Nonnull @NotEmpty final String valueIn) {
+ value = Constraint.isNotEmpty(valueIn, "Code challenge method can not be null or empty");
+ }
+
+ /**
+ * Get the code_challenge_method value.
+ *
+ * @return the value.
+ */
+ @Nonnull @NotEmpty public String getValue() {
+ return value;
+ }
+ }
+
+ /** The authorisation code_challenge_method used for Proof Key for Code Exchange.*/
+ @Nullable private CodeChallengeMethod codeChallengeMethod;
+
/**
*
* Constructor.
@@ -204,6 +247,73 @@ public class OAuthAuthorizationRequest {
public void setResponseMode(@Nullable final ResponseMode mode) {
responseMode = mode;
}
+
+ /**
+ * Set the authorisation code_verifier for Proof Key for Code Exchange.
+ *
+ * @param code The code_verifier to set.
+ *
+ * @since 3.1.0
+ */
+ public void setCodeVerifier(@Nullable final String code) {
+ codeVerifier = code;
+ }
+
+ /**
+ * Get the authorisation code_verifier for Proof Key for Code Exchange.
+ *
+ * @return the code_verifier.
+ *
+ * @since 3.1.0
+ */
+ @Nullable public String getCodeVerifier() {
+ return codeVerifier;
+ }
+
+ /**
+ * Get the authorisation code_challenge for Proof Key for Code Exchange.
+ *
+ * @param code The code_challenge to set.
+ *
+ * @since 3.1.0
+ */
+ public void setCodeChallenge(@Nullable final String code) {
+ codeChallenge = code;
+ }
+
+ /**
+ * Get the authorisation code_challenge (which was derived from the code_verifier)
+ * for Proof Key for Code Exchange.
+ *
+ * @return Returns the code_challenge.
+ *
+ * @since 3.1.0
+ */
+ @Nullable public String getCodeChallenge() {
+ return codeChallenge;
+ }
+
+ /**
+ * Get the code_challenge_method used to transform the code_verifier into a code_challenge.
+ *
+ * @return Returns the code_challenge_method.
+ *
+ * @since 3.1.0
+ */
+ @Nullable public CodeChallengeMethod getCodeChallengeMethod() {
+ return codeChallengeMethod;
+ }
+
+ /**
+ * Set the code_challenge_method used to transform the code_verifier into a code_challenge.
+ *
+ * @param method The code_challenge_method to set.
+ *
+ * @since 3.1.0
+ */
+ public void setCodeChallengeMethod(@Nullable final CodeChallengeMethod method) {
+ codeChallengeMethod = method;
+ }
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
index e091ca8..25fcfa1 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -35,6 +35,7 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
/**
* OpenID Connect Authentication Request. Extends the OAuth 2.0 authorization request.
@@ -96,7 +97,7 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
/** The time at which the RP made the authentication request to the OP.*/
@Nullable private Instant authnRequestTime;
-
+
/**
*
* Constructor.
@@ -107,7 +108,7 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
super(id);
// Must contain the openid scope.
getScope().add(DEFAULT_OPENID_SCOPE);
- acrs = Collections.emptyList();
+ acrs = CollectionSupport.emptyList();
}
/**
@@ -226,8 +227,7 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
* @since 2.2.0
*/
public void setLoginHint(@Nullable final String hint) {
- loginHint = hint;
-
+ loginHint = hint;
}
/**
@@ -352,9 +352,9 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
* @since 2.2.0
*/
@Nullable public Instant getAuthnRequestTime() {
- return authnRequestTime;
-}
-
+ return authnRequestTime;
+ }
+
//TODO others relating to sections 5.2, 5.5, 6, and 7.2.1
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list