[java-oidc-common] 01/02: JCOMOIDC-112 - Profile configuration settings for OAuth2 DPoP
Henri Mikkonen
henri.mikkonen at iki.fi
Mon Aug 12 16:44:03 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=dcd09015c0fdbc363b40c22ebd079f527df3f4bf
commit dcd09015c0fdbc363b40c22ebd079f527df3f4bf
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Aug 12 19:42:47 2024 +0300
JCOMOIDC-112 - Profile configuration settings for OAuth2 DPoP
https://shibboleth.atlassian.net/browse/JCOMOIDC-112
Add 'alwaysIssueBearerAccessToken' option to OAuth2AccessTokenProducingProfileConfiguration
- Implemented in AbstractOIDCSSOConfiguration (OIDC.SSO and OAUTH2.Token) and DefaultOAuth2TokenAudienceConfiguration (OAUTH2.Token)
- Needed for providing means to issue bearer access token even when DPoP proof is involved
- It may be useful for public clients for DPoP-binding solely the refresh token
---
.../AlwaysIssueBearerAccessTokenPredicate.java | 45 ++++++++++++++++++++++
...h2AccessTokenProducingProfileConfiguration.java | 11 ++++++
.../config/impl/AbstractOIDCSSOConfiguration.java | 35 +++++++++++++++++
.../DefaultOAuth2TokenAudienceConfiguration.java | 37 +++++++++++++++++-
4 files changed, 126 insertions(+), 2 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AlwaysIssueBearerAccessTokenPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AlwaysIssueBearerAccessTokenPredicate.java
new file mode 100644
index 0000000..78d4f8f
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/AlwaysIssueBearerAccessTokenPredicate.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OAuth2AccessTokenProducingProfileConfiguration#isAlwaysIssueBearerAccessToken(ProfileRequestContext)}.
+ *
+ * @since 3.2.0
+ */
+public class AlwaysIssueBearerAccessTokenPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ if (rpc.getProfileConfig() instanceof OAuth2AccessTokenProducingProfileConfiguration oatppc) {
+ return oatppc.isAlwaysIssueBearerAccessToken(input);
+ }
+ }
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
index 25ed8e1..e019534 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
@@ -70,4 +70,15 @@ public interface OAuth2AccessTokenProducingProfileConfiguration extends OAuth2Pr
getAccessTokenClaimsSetManipulationStrategy(
@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get whether the access token to be issued is always a bearer access token.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return whether the access token to be issued is always a bearer access token
+ *
+ * @since 3.2.0
+ */
+ @ConfigurationSetting(name="alwaysIssueBearerAccessToken")
+ boolean isAlwaysIssueBearerAccessToken(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index ed2c65a..9535faa 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -102,6 +102,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
private Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>>
customRedirectUriValidationStrategyLookupStrategy;
+ /** Whether the access token to be issued is always a bearer access token. */
+ @Nonnull private Predicate<ProfileRequestContext> alwaysIssueBearerAccessTokenPredicate;
+
/**
* Creates a new configuration instance.
*
@@ -130,6 +133,8 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
customRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(null);
+
+ alwaysIssueBearerAccessTokenPredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -635,4 +640,34 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
customRedirectUriValidationStrategyLookupStrategy = Constraint.isNotNull(strategy,
"Lookup strategy cannot be null");
}
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isAlwaysIssueBearerAccessToken(@Nullable final ProfileRequestContext profileRequestContext) {
+ return alwaysIssueBearerAccessTokenPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether the access token to be issued is always a bearer access token.
+ *
+ * @param flag flag to set
+ *
+ * @since 3.2.0
+ */
+ public void setAlwaysIssueBearerAccessToken(final boolean flag) {
+ alwaysIssueBearerAccessTokenPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether the access token to be issued is always a bearer access token.
+ *
+ * @param condition condition to set
+ *
+ * @since 3.2.0
+ */
+ public void setAlwaysIssueBearerAccessTokenPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ alwaysIssueBearerAccessTokenPredicate = Constraint.isNotNull(condition,
+ "Always issue bearer access token predicate cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
index 6679696..cdc61b3 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
@@ -57,8 +57,11 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractOAuth2Inter
/** Lookup function to supply strategy bi-function for manipulating access token claims set. */
@Nonnull
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- accessTokenClaimsSetManipulationStrategyLookupStrategy;
-
+ accessTokenClaimsSetManipulationStrategyLookupStrategy;
+
+ /** Whether the access token to be issued is always a bearer access token. */
+ @Nonnull private Predicate<ProfileRequestContext> alwaysIssueBearerAccessTokenPredicate;
+
/** Constructor. */
public DefaultOAuth2TokenAudienceConfiguration() {
this(PROFILE_ID);
@@ -80,6 +83,8 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractOAuth2Inter
accessTokenTypeLookupStrategy = FunctionSupport.constant(null);
accessTokenLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(10));
accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
+
+ alwaysIssueBearerAccessTokenPredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -267,5 +272,33 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractOAuth2Inter
"Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ public boolean isAlwaysIssueBearerAccessToken(@Nullable final ProfileRequestContext profileRequestContext) {
+ return alwaysIssueBearerAccessTokenPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether the access token to be issued is always a bearer access token.
+ *
+ * @param flag flag to set
+ *
+ * @since 3.2.0
+ */
+ public void setAlwaysIssueBearerAccessToken(final boolean flag) {
+ alwaysIssueBearerAccessTokenPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether the access token to be issued is always a bearer access token.
+ *
+ * @param condition condition to set
+ *
+ * @since 3.2.0
+ */
+ public void setAlwaysIssueBearerAccessTokenPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ alwaysIssueBearerAccessTokenPredicate = Constraint.isNotNull(condition,
+ "Always issue bearer access token predicate cannot be null");
+ }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list