[java-oidc-common] branch main updated: Null cleanup
Phil Smart
philip.smart at jisc.ac.uk
Thu Apr 4 16:19:01 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=4d6b11988b3f1b46a14917cf3550f2c97ec35807
The following commit(s) were added to refs/heads/main by this push:
new 4d6b119 Null cleanup
4d6b119 is described below
commit 4d6b11988b3f1b46a14917cf3550f2c97ec35807
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Apr 4 17:18:57 2024 +0100
Null cleanup
---
.../oidc/security/CredentialConversionUtil.java | 13 +++---
.../impl/ClientInformationCredentialResolver.java | 24 +++++++----
.../impl/LocalJOSEObjectCredentialResolver.java | 40 +++++-------------
.../impl/ProviderMetadataCredentialResolver.java | 15 ++++---
.../security/impl/BaseSignedJWTTrustEngine.java | 4 +-
.../CheckClientJWTDecryptionConfiguration.java | 13 +++---
.../impl/ExplicitKeySignedJWTTrustEngine.java | 5 ++-
.../oidc/security/impl/JWETokenDecrypter.java | 24 +++++++----
.../BasicSignatureSigningParametersResolver.java | 26 +++++++++---
...ormationSignatureSigningParametersResolver.java | 19 +++++++--
.../impl/DefaultEncryptionParametersResolver.java | 30 +++++++++-----
.../RelyingPartySigningParametersResolver.java | 12 ++++--
.../jwt/claims/impl/AccessTokenHashValidator.java | 2 +-
.../jwt/claims/impl/AudienceClaimsValidator.java | 5 +--
.../claims/impl/JWTIdentifierClaimsValidator.java | 6 ++-
.../impl/JWTIdentifierRevocationValidator.java | 6 +--
.../RequestedEssentialACRClaimsLookupStrategy.java | 10 +++--
.../LocalJOSEObjectCredentialResolverTest.java | 48 +++++++++++++++-------
18 files changed, 184 insertions(+), 118 deletions(-)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/CredentialConversionUtil.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/CredentialConversionUtil.java
index ff4f4be..7747499 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/CredentialConversionUtil.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/CredentialConversionUtil.java
@@ -53,12 +53,15 @@ public final class CredentialConversionUtil {
*
* @return key names or null if not found
*/
- @Nullable public static String resolveKid(@Nonnull final Credential credential) {
- if (credential.getKeyNames() != null) {
- for (final String keyName : credential.getKeyNames()) {
- return keyName;
- }
+ @Nullable public static String resolveKid(@Nullable final Credential credential) {
+ if (credential == null) {
+ return null;
}
+
+ for (final String keyName : credential.getKeyNames()) {
+ return keyName;
+ }
+
if (credential instanceof JWKCredential) {
return ((JWKCredential) credential).getKid();
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
index 542e322..8172fb2 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
@@ -14,6 +14,7 @@
package net.shibboleth.oidc.security.credential.impl;
+import java.net.URI;
import java.time.Duration;
import java.time.Instant;
import java.util.Collection;
@@ -61,7 +62,8 @@ public class ClientInformationCredentialResolver extends AbstractClientInformati
@Nonnull private final RemoteJwkSetCache remoteJwkSetCache;
/** The remote key refresh interval. Default value: 30 minutes. */
- @Positive private final Duration keyFetchInterval;
+ @Nonnull @Positive
+ private final Duration keyFetchInterval;
/**
* Constructor.
@@ -125,16 +127,20 @@ public class ClientInformationCredentialResolver extends AbstractClientInformati
credentials.addAll(resolveSecretCredentials(criteriaSet));
final JWKSet keySet;
- if (metadata.getJWKSetURI() != null) {
+ final URI jwkSetURI = metadata.getJWKSetURI();
+ if (jwkSetURI != null) {
final String keyIdFromCriteria = extractKeyIdFromCriteria(criteriaSet);
+
+ final var now = Instant.now();
+ assert now != null;
+ final var nowPlusInterval = now.plus(keyFetchInterval);
+ assert nowPlusInterval != null;
if (StringSupport.trimOrNull(keyIdFromCriteria) != null) {
- assert keyIdFromCriteria != null;
- keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(), keyIdFromCriteria,
- Instant.now().plus(keyFetchInterval));
- } else {
- keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(),
- Instant.now().plus(keyFetchInterval));
+ assert keyIdFromCriteria != null;
+ keySet = remoteJwkSetCache.fetch(jwkSetURI, keyIdFromCriteria, nowPlusInterval);
+ } else {
+ keySet = remoteJwkSetCache.fetch(jwkSetURI, nowPlusInterval);
}
if (keySet == null) {
@@ -146,7 +152,7 @@ public class ClientInformationCredentialResolver extends AbstractClientInformati
} else {
return credentials;
}
-
+ assert keySet != null;
populateCredentialsFromKeySet(keySet, credentials);
return credentials;
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
index 50547d7..df7b436 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
@@ -17,7 +17,6 @@ package net.shibboleth.oidc.security.credential.impl;
import java.security.PublicKey;
import java.util.ArrayList;
import java.util.List;
-import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -27,7 +26,6 @@ import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.security.criteria.PublicKeyCriterion;
import org.slf4j.Logger;
-import com.google.common.base.Predicates;
import com.nimbusds.jose.Header;
import com.nimbusds.jose.JOSEObject;
import com.nimbusds.jose.JWEHeader;
@@ -38,7 +36,6 @@ import net.shibboleth.oidc.security.impl.JWETokenDecrypter;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -121,6 +118,9 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
final String kid = resolveKeyIdFromJoseHeader(joseObject.getHeader());
for (final Credential inputCred : credentials) {
+ if (inputCred == null) {
+ continue;
+ }
if (isLocalCredential(inputCred)) {
// TODO this is impossible in the JOSE case implemented here?
log.debug("Input credential was local, including in results");
@@ -159,34 +159,14 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
}
final List<Credential> localCredentials = resolveLocalCredentialsByCriteria(criteria);
log.trace("Found {} local credential(s)", localCredentials.size());
- // There is no point in adding a duplicate credential, so filter out those already resolved
- results.addAll(filterAlreadyContained(results, localCredentials));
+ results.addAll(localCredentials);
}
credentials.clear();
credentials.addAll(results);
}
-
- /**
- * Return a new list of credentials based on the {@code credentialsToFilter} that are not contained in
- * {@code credentialsToFilterOn}. Containment is determined by equality of both private and public keys.
- *
- * @param credentialsToFilterOn the credentials used to filter the {@code credentialsToFilter}
- * @param credentialsToFilter the credentials which will be filtered
- *
- * @return credentials contained in {@code credentialsToFilter} not in {@code credentialsToFilterOn}.
- */
- @Nonnull @NonnullElements @Live private List<Credential> filterAlreadyContained(
- @Nonnull final List<Credential> credentialsToFilterOn, @Nonnull final List<Credential> credentialsToFilter){
-
- return credentialsToFilter.stream().filter(Predicates.not(lc -> credentialsToFilterOn.stream()
- .anyMatch(r -> lc.getPrivateKey().equals(r.getPrivateKey())
- && lc.getPublicKey().equals(r.getPublicKey()))))
- .collect(CollectionSupport.nonnullCollector(Collectors.toList())).get();
-
- }
-
+
/**
* Resolve credentials using the {@link #localCredResolver} and the supplied criteria.
*
@@ -218,11 +198,11 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
*
* @return the keyId or null
*/
- @Nullable private String resolveKeyIdFromJoseHeader(@Nonnull final Header header) {
- if (header instanceof JWEHeader) {
- return ((JWEHeader)header).getKeyID();
- } else if (header instanceof JWSHeader) {
- return ((JWSHeader)header).getKeyID();
+ @Nullable private String resolveKeyIdFromJoseHeader(@Nullable final Header header) {
+ if (header instanceof final JWEHeader jweHeader) {
+ return jweHeader.getKeyID();
+ } else if (header instanceof final JWSHeader jwsHeader) {
+ return jwsHeader.getKeyID();
}
return null;
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
index 1504953..5c38b43 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
@@ -14,6 +14,7 @@
package net.shibboleth.oidc.security.credential.impl;
+import java.net.URI;
import java.time.Duration;
import java.time.Instant;
import java.util.Collection;
@@ -136,18 +137,22 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
final LinkedHashSet<Credential> credentials = new LinkedHashSet<>(1);
- if (metadata.getJWKSetURI() != null) {
+ final URI jwkSetUri = metadata.getJWKSetURI();
+ if (jwkSetUri != null) {
+
+ final var now = Instant.now();
+ assert now != null;
+ final var nowPlusInterval = now.plus(keyFetchInterval);
+ assert nowPlusInterval != null;
final String keyIdFromCriteria = extractKeyIdFromCriteria(criteriaSet);
JWKSet keySet = null;
if (StringSupport.trimOrNull(keyIdFromCriteria) != null) {
assert keyIdFromCriteria != null;
- keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(), keyIdFromCriteria,
- Instant.now().plus(keyFetchInterval));
+ keySet = remoteJwkSetCache.fetch(jwkSetUri, keyIdFromCriteria, nowPlusInterval);
} else {
- keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(),
- Instant.now().plus(keyFetchInterval));
+ keySet = remoteJwkSetCache.fetch(jwkSetUri, nowPlusInterval);
}
if (keySet == null) {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java
index 8db90b0..262b5c6 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java
@@ -89,7 +89,9 @@ public abstract class BaseSignedJWTTrustEngine<TrustBasisType> implements TrustE
log.debug("Performing signature algorithm include/exclude validation using params from CriteriaSet");
// Algorithm can not be null on the header
final Algorithm algorithm = signedJWT.getHeader().getAlgorithm();
- if (!AlgorithmSupport.validateAlgorithmURI(algorithm.getName(),
+ final String algName = algorithm.getName();
+ assert algName != null;
+ if (!AlgorithmSupport.validateAlgorithmURI(algName,
validationCriterion.getSignatureValidationParameters().getIncludedAlgorithms(),
validationCriterion.getSignatureValidationParameters().getExcludedAlgorithms())) {
log.warn("Algorithm failed include/exclude validation: {}", algorithm.getName());
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java
index 408cd97..87e85a5 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java
@@ -18,7 +18,6 @@ import java.util.function.Function;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -77,7 +76,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
*/
public void setJwtTokenLookupStrategy(
@Nonnull final Function<ProfileRequestContext, JWT> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
+ checkSetterPreconditions();
jwtTokenLookupStrategy = Constraint.isNotNull(strategy, "JwtToken lookup strategy cannot be null");
}
@@ -89,7 +88,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
*/
public void setClientInformationLookupStrategy(
@Nonnull final Function<ProfileRequestContext, OIDCClientInformation> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
+ checkSetterPreconditions();
clientInformationLookupStrategy =
Constraint.isNotNull(strategy, "Client information lookup strategy can not be null");
@@ -102,7 +101,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
*/
public void setDataEncryptionAlgorithmLookupStrategy(
@Nonnull final Function<OIDCClientInformation, String> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
+ checkSetterPreconditions();
dataEncryptionAlgorithmLookupStrategy = Constraint.isNotNull(strategy,
"Data encryption algorithm lookup strategy cannot be null");
@@ -115,7 +114,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
*/
public void setKeyTransportEncryptionAlgorithmLookupStrategy(
@Nonnull final Function<OIDCClientInformation, String> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
+ checkSetterPreconditions();
keyTransportEncryptionAlgorithmLookupStrategy = Constraint.isNotNull(strategy,
"Key transport encryption algorithm lookup strategy cannot be null");
@@ -127,7 +126,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
* @param condition condition to set
*/
public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- ifInitializedThrowUnmodifiabledComponentException();
+ checkSetterPreconditions();
encryptionOptionalPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
@@ -138,7 +137,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
* @param id the identifier to set
*/
public void setErrorEventId(@Nonnull final String id) {
- ifInitializedThrowUnmodifiabledComponentException();
+ checkSetterPreconditions();
errorEventId = Constraint.isNotEmpty(id, "Error event identifier cannot be empty");
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
index 06ddc45..daff336 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
@@ -97,8 +97,9 @@ public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<It
criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
}
final JWSAlgorithm sigAlg = signedJWT.getHeader().getAlgorithm();
-
- final String jcaAlgorithm = AlgorithmSupport.getKeyAlgorithm(sigAlg.getName());
+ final String sigAlgName = sigAlg.getName();
+ assert sigAlgName != null;
+ final String jcaAlgorithm = AlgorithmSupport.getKeyAlgorithm(sigAlgName);
if (!Strings.isNullOrEmpty(jcaAlgorithm)) {
assert jcaAlgorithm != null;
criteriaSet.add(new KeyAlgorithmCriterion(jcaAlgorithm), true);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
index 4771916..457d577 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
@@ -39,6 +39,7 @@ import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWEDecrypter;
import com.nimbusds.jose.JWEObject.State;
+import com.nimbusds.jose.Payload;
import com.nimbusds.jose.crypto.AESDecrypter;
import com.nimbusds.jose.crypto.DirectDecrypter;
import com.nimbusds.jose.crypto.ECDHDecrypter;
@@ -123,9 +124,12 @@ public class JWETokenDecrypter {
}
// Check decrypted
- if (encryptedObject.getState() == State.DECRYPTED) {
+ final Payload payload = encryptedObject.getPayload();
+ if (payload != null && encryptedObject.getState() == State.DECRYPTED) {
try {
- return JWTParser.parse(encryptedObject.getPayload().toString());
+ final JWT parsedJwt = JWTParser.parse(payload.toString());
+ assert parsedJwt != null;
+ return parsedJwt;
} catch (final ParseException e) {
throw new DecryptionException("Error decrypting JWT", e);
}
@@ -167,14 +171,18 @@ public class JWETokenDecrypter {
}
// Add algorithm if present(should be)
- if (encryptedObject.getHeader().getAlgorithm() != null) {
- newCriteriaSet.add(
- new KeyManagmentAlgorithmCriterion(encryptedObject.getHeader().getAlgorithm().getName()));
+ final JWEAlgorithm jweAlg = encryptedObject.getHeader().getAlgorithm();
+ if (jweAlg != null) {
+ final String algName = jweAlg.getName();
+ assert algName != null;
+ newCriteriaSet.add(new KeyManagmentAlgorithmCriterion(algName));
}
// Add encryption method if present(should be)
- if (encryptedObject.getHeader().getEncryptionMethod() != null) {
- newCriteriaSet.add(
- new DataEncryptionAlgorithmCriterion(encryptedObject.getHeader().getEncryptionMethod().getName()));
+ final EncryptionMethod encMethod = encryptedObject.getHeader().getEncryptionMethod();
+ if (encMethod != null) {
+ final String encMethodAlgName = encMethod.getName();
+ assert encMethodAlgName != null;
+ newCriteriaSet.add(new DataEncryptionAlgorithmCriterion(encMethodAlgName));
}
// Add the entire object so the resolver can access it
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
index 36d3bb8..945b64f 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
@@ -15,6 +15,7 @@
package net.shibboleth.oidc.security.jose.impl;
import java.security.Key;
+import java.security.PrivateKey;
import java.security.interfaces.ECKey;
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.RSAPrivateKey;
@@ -24,9 +25,11 @@ import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.crypto.SecretKey;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.CredentialSupport;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor;
import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
import org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver;
@@ -288,23 +291,34 @@ public class BasicSignatureSigningParametersResolver
try {
final JWSAlgorithm supportedAlgorithm = JWSAlgorithm.parse(algorithm);
+ assert supportedAlgorithm != null;
final Key key = CredentialSupport.extractSigningKey(credential);
+ if (key == null) {
+ return false;
+ }
boolean credSupportsAlgorithm = false;
- if (JWSAlgorithm.Family.HMAC_SHA.contains(supportedAlgorithm) && credential.getSecretKey() != null &&
- JWACredentialSupport.keyLengthSupportsMACAlgorithm(supportedAlgorithm, credential.getSecretKey())) {
+ final SecretKey secretKey = credential.getSecretKey();
+ final PrivateKey privateKey = credential.getPrivateKey();
+ if (JWSAlgorithm.Family.HMAC_SHA.contains(supportedAlgorithm) && secretKey != null &&
+ JWACredentialSupport.keyLengthSupportsMACAlgorithm(supportedAlgorithm, secretKey)) {
credSupportsAlgorithm = true;
} else if (JWSAlgorithm.Family.RSA.contains(supportedAlgorithm)
&& credential.getPrivateKey() instanceof RSAPrivateKey) {
credSupportsAlgorithm = true;
} else if (JWSAlgorithm.Family.EC.contains(supportedAlgorithm)
- && credential.getPrivateKey() instanceof ECPrivateKey
- && JWACredentialSupport.keySupportsCurve((ECKey)credential.getPrivateKey(), supportedAlgorithm)) {
+ && privateKey instanceof ECPrivateKey
+ && JWACredentialSupport.keySupportsCurve((ECKey)privateKey, supportedAlgorithm)) {
credSupportsAlgorithm = true;
}
// TODO the final opensaml key check is likely covered for the JWA variant in the tests above
- return credSupportsAlgorithm && AlgorithmSupport.checkKeyAlgorithmAndLength(key,
- getAlgorithmRegistry().get(algorithm));
+ final AlgorithmDescriptor algorithmDescriptor = getAlgorithmRegistry().get(algorithm);
+ if (algorithmDescriptor == null) {
+ // if algorithmDescriptor is null the checkKeyAlgorithmAndLength would return true, so ignore.
+ return credSupportsAlgorithm;
+ } else {
+ return credSupportsAlgorithm && AlgorithmSupport.checkKeyAlgorithmAndLength(key, algorithmDescriptor);
+ }
} catch (final JOSEException e) {
log.trace("Algorithm '{}' and EC credential '{}' threw an error while checking for compatibility, "
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java
index 6016814..5a18098 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java
@@ -24,6 +24,7 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
+import com.nimbusds.oauth2.sdk.auth.Secret;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
@@ -128,15 +129,27 @@ public class ClientInformationSignatureSigningParametersResolver
* @param criteria the input criteria being evaluated
* @return the list of credentials
*/
+ @Override
@Nonnull protected List<Credential> getEffectiveSigningCredentials(@Nonnull final CriteriaSet criteria) {
final List<Credential> accumulator = super.getEffectiveSigningCredentials(criteria);
final OIDCClientInformation metadata = getClientInformation(criteria);
- if (metadata == null || metadata.getSecret() == null) {
+
+ if (metadata == null ) {
log.debug("No client information found from the criteria set");
return accumulator;
}
- final DefaultClientSecretCredential secretCredential =
- new DefaultClientSecretCredential(metadata.getSecret().getValue());
+ final Secret secret = metadata.getSecret();
+ if (secret == null) {
+ log.debug("No client information secret found from the criteria set");
+ return accumulator;
+ }
+ final String secretValue = secret.getValue();
+ if (secretValue == null) {
+ log.debug("No client information secret found from the criteria set");
+ return accumulator;
+ }
+
+ final DefaultClientSecretCredential secretCredential = new DefaultClientSecretCredential(secretValue);
accumulator.add(secretCredential.toSigningCredential());
return accumulator;
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
index 4d58720..22f9ec5 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
@@ -600,11 +600,14 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
final CriteriaSet credentialCriteria = new CriteriaSet();
credentialCriteria.addAll(existingCriteria);
-
- credentialCriteria.add(new KeyManagmentAlgorithmCriterion(alg.getName()));
- credentialCriteria.add(new DataEncryptionAlgorithmCriterion(enc.getName()));
-
- final String jcaKeyAlgorithm = AlgorithmSupport.getKeyAlgorithm(alg.getName());
+ final String algName = alg.getName();
+ assert algName != null;
+ credentialCriteria.add(new KeyManagmentAlgorithmCriterion(algName));
+ final String encName = enc.getName();
+ assert encName != null;
+ credentialCriteria.add(new DataEncryptionAlgorithmCriterion(encName));
+
+ final String jcaKeyAlgorithm = AlgorithmSupport.getKeyAlgorithm(algName);
if (!Strings.isNullOrEmpty(jcaKeyAlgorithm)) {
assert jcaKeyAlgorithm != null;
credentialCriteria.add(new EvaluableKeyAlgorithmCredentialCriterion(
@@ -629,11 +632,14 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
final CriteriaSet credentialCriteria = new CriteriaSet();
credentialCriteria.addAll(existingCriteria);
-
- credentialCriteria.add(new KeyManagmentAlgorithmCriterion(alg.getName()));
- credentialCriteria.add(new DataEncryptionAlgorithmCriterion(enc.getName()));
-
- final String jcaEncAlgorithm = AlgorithmSupport.getKeyAlgorithm(enc.getName());
+ final String algName = alg.getName();
+ assert algName != null;
+ credentialCriteria.add(new KeyManagmentAlgorithmCriterion(algName));
+ final String encName = enc.getName();
+ assert encName != null;
+ credentialCriteria.add(new DataEncryptionAlgorithmCriterion(encName));
+
+ final String jcaEncAlgorithm = AlgorithmSupport.getKeyAlgorithm(encName);
if (!Strings.isNullOrEmpty(jcaEncAlgorithm)) {
assert jcaEncAlgorithm != null;
credentialCriteria.add(new EvaluableKeyAlgorithmCredentialCriterion(
@@ -664,6 +670,8 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
protected boolean checkCredentialSupportsAlgorithm(@Nonnull final Credential credential,
@Nonnull final JWEAlgorithm algorithm) {
+ final String algName = algorithm.getName();
+ assert algName != null;
if (!(credential instanceof JWKCredential)) {
return false;
}
@@ -673,7 +681,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
if (!checkKeyWithAlgorithm((JWKCredential)credential, algorithm)) {
return false;
}
- if (!checkKeyAlgorithmAndLength(credential, algorithm.getName())) {
+ if (!checkKeyAlgorithmAndLength(credential, algName)) {
return false;
}
return true;
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolver.java
index 7115477..1af432f 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolver.java
@@ -31,6 +31,9 @@ import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -124,7 +127,7 @@ public class RelyingPartySigningParametersResolver extends BasicSignatureSigning
*
* @return the current set of supported algorithms filtered by those also supported by the OP.
*/
- private List<String> filterForProviderSupportedAlgorithms(
+ @Nonnull @NotLive @Unmodifiable private List<String> filterForProviderSupportedAlgorithms(
@Nonnull final CriteriaSet criteria, @Nonnull final List<String> algorithms) {
final ProviderMetadataCriterion pmCrit = criteria.get(ProviderMetadataCriterion.class);
@@ -136,13 +139,14 @@ public class RelyingPartySigningParametersResolver extends BasicSignatureSigning
if (opSupportedAlgNames == null) {
log.trace("Lookup strategy could not determine provider supported algorithms from metadata, "
+ "no further filtering performed");
- return List.copyOf(algorithms);
+ return CollectionSupport.copyToList(algorithms);
}
- return algorithms.stream().filter(opSupportedAlgNames::contains).collect(Collectors.toList());
+ return algorithms.stream().filter(opSupportedAlgNames::contains)
+ .collect(CollectionSupport.nonnullCollector(Collectors.toList())).get();
} else {
log.debug("No provider metadata criterion, unable to filter for provider supported algorithms");
- return List.copyOf(algorithms);
+ return CollectionSupport.copyToList(algorithms);
}
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java
index fc522a7..6e1964c 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java
@@ -40,7 +40,7 @@ import net.shibboleth.shared.primitive.StringSupport;
* A validator that checks the access_token value matches its encoded at_hash representation in the
* id_token.
*
- * @since 2.2.0
+ * @since 2.2.0
*/
public class AccessTokenHashValidator extends AbstractClaimsValidator {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
index b73ad64..01309e3 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
@@ -18,7 +18,6 @@ import java.util.List;
import java.util.Objects;
import java.util.Set;
import java.util.function.BiFunction;
-import java.util.stream.Collectors;
import javax.annotation.Nonnull;
@@ -176,7 +175,7 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
}
// Filter nulls from audList
- final List<String> audListFiltered = audList.stream().filter(Objects::nonNull).collect(Collectors.toList());
+ final List<String> audListFiltered = audList.stream().filter(Objects::nonNull).toList();
final boolean acceptedAudienceMatch = audListFiltered.stream().anyMatch(acceptedAudiences::contains);
@@ -192,7 +191,7 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
// Remove the accepted audience
final List<String> audListFilteredWithoutAcceptedAud =
audListFiltered.stream().filter(aud -> !acceptedAudiences.contains(aud))
- .collect(Collectors.toList());
+ .toList();
// Test all additional audiences are known or trusted
final boolean additionalAudiencesTrusted =
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierClaimsValidator.java
index fa34fb8..5a94784 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierClaimsValidator.java
@@ -15,6 +15,7 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
import java.time.Duration;
+import java.time.Instant;
import java.util.Date;
import javax.annotation.Nonnull;
@@ -98,7 +99,10 @@ public class JWTIdentifierClaimsValidator extends AbstractClaimsValidator {
if (StringSupport.trimOrNull(jit) == null) {
throw new JWTValidationException("The claims set is missing required JWT identifier (jit)");
}
- if (!replayCache.check(getClass().getName(), jit, exp.toInstant().plus(clockSkew))) {
+ final String className = getClass().getName();
+ final Instant expiry = exp.toInstant().plus(clockSkew);
+ assert className != null && jit != null && expiry != null;
+ if (!replayCache.check(className, jit, expiry)) {
throw new JWTValidationException("Replay detected for jit '" + jit + "'");
}
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierRevocationValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierRevocationValidator.java
index 76bcb94..d7cff67 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierRevocationValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/JWTIdentifierRevocationValidator.java
@@ -50,7 +50,7 @@ public class JWTIdentifierRevocationValidator extends AbstractClaimsValidator {
* @param cache revocation cache to set
*/
public void setRevocationCache(@Nonnull final RevocationCache cache) {
- ifInitializedThrowUnmodifiabledComponentException();
+ checkSetterPreconditions();
revocationCache = Constraint.isNotNull(cache, "RevocationCache cannot be null");
}
@@ -60,7 +60,7 @@ public class JWTIdentifierRevocationValidator extends AbstractClaimsValidator {
* @param s context value
*/
public void setContext(@Nonnull @NotEmpty final String s) {
- ifInitializedThrowUnmodifiabledComponentException();
+ checkSetterPreconditions();
context = Constraint.isNotNull(StringSupport.trimOrNull(s), "Context cannot be null or empty");
}
@@ -85,7 +85,7 @@ public class JWTIdentifierRevocationValidator extends AbstractClaimsValidator {
if (StringSupport.trimOrNull(jti) == null) {
throw new JWTValidationException("Claims set is missing required JWT identifier claim");
}
-
+ assert jti != null && context != null;
if (revocationCache.isRevoked(context, jti)) {
throw new JWTValidationException("JWT ID '" + jti + "' has been revoked");
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java
index 673b4af..0ade919 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java
@@ -77,10 +77,12 @@ public class RequestedEssentialACRClaimsLookupStrategy
}
final Entry acrs = idTokenRequested.get("acr");
if (acrs != null && acrs.getClaimRequirement() == ClaimRequirement.ESSENTIAL) {
- if (acrs.getValueAsString() != null) {
- return CollectionSupport.listOf(acrs.getValueAsString());
- } else if (acrs.getValuesAsListOfStrings() != null){
- return CollectionSupport.copyToList(acrs.getValuesAsListOfStrings());
+ final String valueAsString = acrs.getValueAsString();
+ final List<String> valuesAsListOfStrings = acrs.getValuesAsListOfStrings();
+ if (valueAsString != null) {
+ return CollectionSupport.listOf(valueAsString);
+ } else if (valuesAsListOfStrings != null){
+ return CollectionSupport.copyToList(valuesAsListOfStrings);
}
// Else we do not know what they are
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java
index 1ec93dc..dde448c 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java
@@ -60,7 +60,7 @@ public class LocalJOSEObjectCredentialResolverTest {
/**
* Test set up.
*
- * @throws Exception
+ * @throws Exception on error
*/
@BeforeMethod
public void setup() throws Exception {
@@ -101,7 +101,7 @@ public class LocalJOSEObjectCredentialResolverTest {
* Resolve a credential using the public key found in the JOSEHeaders. The public component of
* the JWK in the header is different than the one resolved locally.
*
- * @throws Exception
+ * @throws Exception on error
*/
@Test
public void testSuccessful_PublicKeyInJOSEHeaderMatchesLocal() throws Exception {
@@ -115,7 +115,30 @@ public class LocalJOSEObjectCredentialResolverTest {
new Payload(createdSignedJWT()));
jweObject.encrypt(new RSAEncrypter(localRSAKey));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
- System.out.println(jwe.serialize());
+
+ final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
+ final Credential resolvedCredential = resolver.resolveSingle(criteria);
+ assert resolvedCredential != null;
+ assertNotNull(resolvedCredential.getPrivateKey());
+ assertTrue(resolvedCredential.getKeyNames().contains("mock-key"));
+ }
+
+ /**
+ * No credential in the header, but one found from the local resolver.
+ *
+ * @throws Exception on error
+ */
+ @Test
+ public void testSuccessful_NoKeyInHeaderButLocalKeyFound() throws Exception {
+
+ final JWEObject jweObject =
+ new JWEObject(new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM)
+ .contentType("JWT")
+ .build(),
+ new Payload(createdSignedJWT()));
+ jweObject.encrypt(new RSAEncrypter(localRSAKey));
+ final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
+
final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
final Credential resolvedCredential = resolver.resolveSingle(criteria);
@@ -128,7 +151,7 @@ public class LocalJOSEObjectCredentialResolverTest {
* Resolve a credential using the public key found in the JOSEHeaders. The public component of
* the JWK in the header is different than the one resolved locally.
*
- * @throws Exception
+ * @throws Exception on error
*/
@Test
public void testUnsuccessful_PublicKeyInJOSEHeaderDoesNotMatchLocal() throws Exception {
@@ -147,7 +170,6 @@ public class LocalJOSEObjectCredentialResolverTest {
new Payload(createdSignedJWT()));
jweObject.encrypt(new RSAEncrypter(keyInJoseHeader));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
- System.out.println(jwe.serialize());
final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
final Credential resolvedCredential = resolver.resolveSingle(criteria);
@@ -157,7 +179,7 @@ public class LocalJOSEObjectCredentialResolverTest {
/**
* Just 'kid' no 'jwk'.
*
- * @throws Exception
+ * @throws Exception on error
*/
@Test
public void testSuccessful_KeyIDInJOSEHeader() throws Exception {
@@ -169,7 +191,6 @@ public class LocalJOSEObjectCredentialResolverTest {
new Payload(createdSignedJWT()));
jweObject.encrypt(new RSAEncrypter(localRSAKey));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
- System.out.println(jwe.serialize());
final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
final List<Credential> resolvedCredential = StreamSupport.stream(
@@ -183,7 +204,7 @@ public class LocalJOSEObjectCredentialResolverTest {
/**
* There is no KID to use for filtering, but a credential should be returned anyway.
*
- * @throws Exception
+ * @throws Exception on error
*/
@Test
public void testSuccessful_NoKeyIDInJOSEHeader() throws Exception {
@@ -196,7 +217,6 @@ public class LocalJOSEObjectCredentialResolverTest {
new Payload(createdSignedJWT()));
jweObject.encrypt(new RSAEncrypter(localRSAKey));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
- System.out.println(jwe.serialize());
final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
final List<Credential> resolvedCredential = StreamSupport.stream(
@@ -210,7 +230,7 @@ public class LocalJOSEObjectCredentialResolverTest {
/**
* Just 'kid' no 'jwk'.
*
- * @throws Exception
+ * @throws Exception on error
*/
@Test
public void testUnSuccessful_KeyIDInJOSEHeaderDifferentThanLocalCred() throws Exception {
@@ -222,7 +242,6 @@ public class LocalJOSEObjectCredentialResolverTest {
new Payload(createdSignedJWT()));
jweObject.encrypt(new RSAEncrypter(localRSAKey));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
- System.out.println(jwe.serialize());
final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
final Credential resolvedCredential = resolver.resolveSingle(criteria);
@@ -234,7 +253,7 @@ public class LocalJOSEObjectCredentialResolverTest {
/**
* There is a 'kid' in the header and a 'jwk', the 'kid' matches the key. Resolve the key once.
*
- * @throws Exception
+ * @throws Exception on error
*/
@Test
public void testSuccessful_KeyIDInJOSEHeader_And_JWK() throws Exception {
@@ -247,7 +266,6 @@ public class LocalJOSEObjectCredentialResolverTest {
new Payload(createdSignedJWT()));
jweObject.encrypt(new RSAEncrypter(localRSAKey));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
- System.out.println(jwe.serialize());
final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
final List<Credential> resolvedCredential = StreamSupport.stream(
@@ -261,7 +279,7 @@ public class LocalJOSEObjectCredentialResolverTest {
/**
* There is a 'kid' in the header and 'jwk', and the 'kid' is different than the kid of the 'jwk'.
*
- * @throws Exception
+ * @throws Exception on error
*/
@Test
public void testUnsuccessful_KeyIDInJOSEHeader_And_JWK_KidDoesNotMatch() throws Exception {
@@ -274,7 +292,6 @@ public class LocalJOSEObjectCredentialResolverTest {
new Payload(createdSignedJWT()));
jweObject.encrypt(new RSAEncrypter(localRSAKey));
final EncryptedJWT jwe = EncryptedJWT.parse(jweObject.serialize());
- System.out.println(jwe.serialize());
final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
final List<Credential> resolvedCredential = StreamSupport.stream(
@@ -293,6 +310,7 @@ public class LocalJOSEObjectCredentialResolverTest {
key = theKey;
}
+ @Override
@Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list