[java-oidc-common] branch main updated: JCOMOIDC-86 - Add PKCE support to the OIDC message encoders
Phil Smart
philip.smart at jisc.ac.uk
Fri Sep 29 15:31:42 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=dcae9a04306181c5654484f2c570a1af2766ec8d
The following commit(s) were added to refs/heads/main by this push:
new dcae9a0 JCOMOIDC-86 - Add PKCE support to the OIDC message encoders
dcae9a0 is described below
commit dcae9a04306181c5654484f2c570a1af2766ec8d
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Sep 29 16:31:35 2023 +0100
JCOMOIDC-86 - Add PKCE support to the OIDC message encoders
https://shibboleth.atlassian.net/browse/JCOMOIDC-86
---
.../encoding/impl/AbstractOIDCMessageEncoder.java | 70 ++++++++++++----------
1 file changed, 37 insertions(+), 33 deletions(-)
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
index e9a7195..88bc076 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
@@ -28,13 +28,14 @@ import org.opensaml.messaging.encoder.servlet.AbstractHttpServletResponseMessage
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import com.google.common.base.Predicates;
import com.nimbusds.openid.connect.sdk.claims.ACR;
+import net.shibboleth.oidc.profile.core.OAuthAuthorizationRequest.CodeChallengeMethod;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.oidc.profile.encoding.AuthenticationContextClassReferenceSupport;
import net.shibboleth.oidc.profile.encoding.OIDCMessageEncoder;
import net.shibboleth.shared.collection.Pair;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.net.URLBuilder;
/**
@@ -53,7 +54,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
/** Constructor. */
protected AbstractOIDCMessageEncoder() {
- authorizationParamsAreValidPredicate = Predicates.alwaysTrue();
+ authorizationParamsAreValidPredicate = PredicateSupport.alwaysTrue();
setProtocolMessageLoggerSubCategory("OAUTH2");
}
@@ -134,20 +135,17 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
createParametersFromRequestWithoutRequestObject(params,req);
}
return params;
- }
+ }
/**
- * Create the set of OAuth2.0 authorization and and OIDC authentication request parameters when a RequestObject
- * is present.
- *
- * @param params the OAuth2.0 authorization and and OIDC authentication request parameters to set
- * @param req the current authentication request
+ * Add the standard set of OAuth2 2.0 authorization parameters to the params list using the
+ * OAuth 2.0 request syntax.
*
- * @throws MessageEncodingException if there is an error building the parameters
+ * @param params the parameter list to add the
+ * @param req the built authentication request
*/
- private void createParametersFromRequestWithRequestObject(@Nonnull final List<Pair<String, String>> params,
- @Nonnull final OIDCAuthenticationRequest req) throws MessageEncodingException {
-
+ private void createStandardOAuthParameters(@Nonnull final List<Pair<String, String>> params,
+ @Nonnull final OIDCAuthenticationRequest req) {
// The following three parameters are *always* required, even if a request object is used.
params.add(new Pair<>("client_id", req.getClientID().getValue()));
if (req.getResponseType() != null) {
@@ -155,12 +153,32 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
}
// Must contain openid so the OAuth AuthZ server knows it is an OIDC request
params.add(new Pair<>("scope", req.getScope().toString()));
-
// Only set the response_mode if not equal to the default for that response_type
if (req.getDefaultResponseMode() != null &&
!req.getDefaultResponseMode().equals(req.getResponseMode())){
params.add(new Pair<>("response_mode", req.getResponseMode().getValue()));
}
+ final CodeChallengeMethod codeChallengedMethod = req.getCodeChallengeMethod();
+ if (req.getCodeChallenge() != null && codeChallengedMethod != null) {
+ params.add(new Pair<>("code_challenge", req.getCodeChallenge()));
+ params.add(new Pair<>("code_challenge_method", codeChallengedMethod.getValue()));
+ }
+ }
+
+ /**
+ * Create the set of OAuth2.0 authorization and and OIDC authentication request parameters when a RequestObject
+ * is present.
+ *
+ * @param params the OAuth2.0 authorization and and OIDC authentication request parameters to set
+ * @param req the current authentication request
+ *
+ * @throws MessageEncodingException if there is an error building the parameters
+ */
+ private void createParametersFromRequestWithRequestObject(@Nonnull final List<Pair<String, String>> params,
+ @Nonnull final OIDCAuthenticationRequest req) throws MessageEncodingException {
+
+ createStandardOAuthParameters(params, req);
+
if (req.getRequestObject() != null) {
try {
params.add(new Pair<>("request", req.getRequestObject().serialize()));
@@ -171,10 +189,7 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
if (!validateParams(params)) {
throw new MessageEncodingException("Authorization parameters are not valid");
- }
-
-
-
+ }
}
// Checkstyle: CyclomaticComplexity OFF
@@ -191,19 +206,8 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
private void createParametersFromRequestWithoutRequestObject(@Nonnull final List<Pair<String, String>> params,
@Nonnull final OIDCAuthenticationRequest req) throws MessageEncodingException {
-
- params.add(new Pair<>("client_id", req.getClientID().getValue()));
- if (req.getResponseType() != null) {
- params.add(new Pair<>("response_type", req.getResponseType().toString()));
- }
- // Must contain openid so the authz server knows it is an OIDC request
- params.add(new Pair<>("scope", req.getScope().toString()));
+ createStandardOAuthParameters(params, req);
- // Only set the response_mode if not equal to the default for that response_type
- if (req.getDefaultResponseMode() != null &&
- !req.getDefaultResponseMode().equals(req.getResponseMode())){
- params.add(new Pair<>("response_mode", req.getResponseMode().getValue()));
- }
if (req.getRedirectURI() != null) {
params.add(new Pair<>("redirect_uri", req.getRedirectURI().toString()));
}
@@ -320,15 +324,15 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
/** {@inheritDoc} */
@Override
@Nullable
- protected String serializeMessageForLogging(@Nullable Object message) {
- if (message instanceof OIDCAuthenticationRequest authnRequest) {
+ protected String serializeMessageForLogging(@Nullable final Object message) {
+ if (message instanceof final OIDCAuthenticationRequest authnRequest) {
try {
- List<Pair<String, String>> params = createParametersFromRequest(authnRequest);
+ final List<Pair<String, String>> params = createParametersFromRequest(authnRequest);
final String paramsSerialized =
params.stream().map(p -> p.getFirst()+"="+p.getSecond()).collect(Collectors.joining(", "));
return "OIDCAuthenticationRequest{" + paramsSerialized + "}";
- } catch (MessageEncodingException e) {
+ } catch (final MessageEncodingException e) {
log.trace("Unable to generate serialized message for logging '{}'", e.getMessage());
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list