[java-oidc-common] 02/04: JCOMOIDC-87 - Profile configuration for OIDC logout
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Jan 3 10:57:25 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=5fe91b7cf4a122265c35270da1b5c7428f6fa546
commit 5fe91b7cf4a122265c35270da1b5c7428f6fa546
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Oct 10 14:49:44 2023 +0300
JCOMOIDC-87 - Profile configuration for OIDC logout
https://shibboleth.atlassian.net/browse/JCOMOIDC-87
Initial version of the OIDC.Logout profile configuration interface
and implementation with predicates for the new flags:
- preferFrontChannel
- frontChannelSuccess
- revokeTokens
---
.../config/OIDCLogoutProfileConfiguration.java | 66 +++++++
.../logic/FrontChannelLogoutSuccessPredicate.java | 47 +++++
.../logic/PreferFrontChannelLogoutPredicate.java | 47 +++++
.../logic/RevokeTokensInLogoutPredicate.java | 47 +++++
.../impl/DefaultOIDCLogoutConfiguration.java | 197 +++++++++++++++++++++
5 files changed, 404 insertions(+)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
new file mode 100644
index 0000000..ff77c79
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
+/**
+ * Configuration for IdP OpenID Connect Logout.
+ *
+ * @since 3.1.0
+ */
+public interface OIDCLogoutProfileConfiguration extends OAuth2TokenEncryptionProfileConfiguration {
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty
+ public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidc/logout";
+
+ /**
+ * Get whether to prefer front-channel if both are defined for the RP.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff front-channel is to be preferred
+ */
+ @ConfigurationSetting(name="preferFrontChannel")
+ boolean isPreferFrontChannel(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether to consider front-channel logout propagation successful.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff front-channel propagation considered as successful
+ */
+ @ConfigurationSetting(name="frontChannelSuccess")
+ boolean isFrontChannelSuccess(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether to revoke the tokens related to the session to be logged out.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff the tokens are to be revoked
+ */
+ @ConfigurationSetting(name="revokeTokens")
+ boolean isRevokeTokens(@Nullable final ProfileRequestContext profileRequestContext);
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/FrontChannelLogoutSuccessPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/FrontChannelLogoutSuccessPredicate.java
new file mode 100644
index 0000000..afc08c6
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/FrontChannelLogoutSuccessPredicate.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.config.OIDCLogoutProfileConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OIDCLogoutProfileConfiguration#isFrontChannelSuccess(ProfileRequestContext)}.
+ *
+ * @since 3.1.0
+ */
+public class FrontChannelLogoutSuccessPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OIDCLogoutProfileConfiguration olpc) {
+ return olpc.isFrontChannelSuccess(input);
+ }
+ }
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/PreferFrontChannelLogoutPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/PreferFrontChannelLogoutPredicate.java
new file mode 100644
index 0000000..8ee2e84
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/PreferFrontChannelLogoutPredicate.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.config.OIDCLogoutProfileConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OIDCLogoutProfileConfiguration#isPreferFrontChannel(ProfileRequestContext)}.
+ *
+ * @since 3.1.0
+ */
+public class PreferFrontChannelLogoutPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OIDCLogoutProfileConfiguration olpc) {
+ return olpc.isPreferFrontChannel(input);
+ }
+ }
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RevokeTokensInLogoutPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RevokeTokensInLogoutPredicate.java
new file mode 100644
index 0000000..4679286
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RevokeTokensInLogoutPredicate.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.config.OIDCLogoutProfileConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OIDCLogoutProfileConfiguration#isRevokeTokens(ProfileRequestContext)}.
+ *
+ * @since 3.1.0
+ */
+public class RevokeTokensInLogoutPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OIDCLogoutProfileConfiguration olpc) {
+ return olpc.isRevokeTokens(input);
+ }
+ }
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
new file mode 100644
index 0000000..f4c27f4
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
@@ -0,0 +1,197 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.impl;
+
+import java.util.function.Function;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.google.common.base.Predicates;
+
+import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.config.OIDCLogoutProfileConfiguration;
+import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
+
+/**
+ * Implementation of a profile configuration for the OpenID Connect logout.
+ *
+ * @since 3.1.0
+ */
+public class DefaultOIDCLogoutConfiguration extends AbstractInterceptorAwareProfileConfiguration
+ implements OIDCLogoutProfileConfiguration, OverriddenIssuerProfileConfiguration {
+
+ /** OIDC Back-Channel Logout profile counter name. */
+ @Nonnull @NotEmpty public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.oidc.logout";
+
+ /** Lookup function to override issuer value. */
+ @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+
+ /** Whether encryption is optional in the face of no key, etc. */
+ @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
+
+ /** Whether encryption is optional in the face of no key, etc. */
+ @Nonnull private Predicate<ProfileRequestContext> preferFrontChannelPredicate;
+
+ /** Whether to consider front-channel logout propagation successful. */
+ @Nonnull private Predicate<ProfileRequestContext> frontChannelSuccessPredicate;
+
+ /** Whether to revoke the tokens related to the session to be logged out. */
+ @Nonnull private Predicate<ProfileRequestContext> revokeTokensPredicate;
+
+ /**
+ * Constructor.
+ */
+ public DefaultOIDCLogoutConfiguration() {
+ this(OIDCLogoutProfileConfiguration.PROFILE_ID);
+ }
+
+ /**
+ * Creates a new configuration instance.
+ *
+ * @param profileId Unique profile identifier.
+ */
+ public DefaultOIDCLogoutConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+ issuerLookupStrategy = FunctionSupport.constant(null);
+ encryptionOptionalPredicate = Predicates.alwaysTrue();
+ preferFrontChannelPredicate = Predicates.alwaysTrue();
+ frontChannelSuccessPredicate = Predicates.alwaysFalse();
+ revokeTokensPredicate = Predicates.alwaysTrue();
+ }
+
+ @Override @Nullable @NotEmpty
+ public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
+ return issuerLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set overridden issuer value.
+ *
+ * @param issuer issuer value
+ */
+ public void setIssuer(@Nullable @NotEmpty final String issuer) {
+ issuerLookupStrategy = FunctionSupport.constant(issuer);
+ }
+
+ /**
+ * Sets lookup strategy for overridden issuer value.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ }
+
+ @Override
+ public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptionOptionalPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether encryption is optional in the face of a missing key, etc.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptionOptional(final boolean flag) {
+ encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether encryption is optional in the face of a missing key, etc.
+ *
+ * @param condition condition to set
+ */
+ public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
+ }
+
+ @Override
+ public boolean isPreferFrontChannel(@Nullable final ProfileRequestContext profileRequestContext) {
+ return preferFrontChannelPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to prefer front-channel if both are defined for the RP.
+ *
+ * @param flag flag to set
+ */
+ public void setPreferFrontChannel(final boolean flag) {
+ preferFrontChannelPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether to prefer front-channel if both are defined for the RP.
+ *
+ * @param condition condition to set
+ */
+ public void setPreferFrontChannelPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ preferFrontChannelPredicate = Constraint.isNotNull(condition, "Prefer front-channel predicate cannot be null");
+ }
+
+ @Override
+ public boolean isFrontChannelSuccess(@Nullable final ProfileRequestContext profileRequestContext) {
+ return frontChannelSuccessPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to consider front-channel logout propagation successful.
+ *
+ * @param flag flag to set
+ */
+ public void setFrontChannelSuccess(final boolean flag) {
+ frontChannelSuccessPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether to consider front-channel logout propagation successful.
+ *
+ * @param condition condition to set
+ */
+ public void setFrontChannelSuccessPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ frontChannelSuccessPredicate =
+ Constraint.isNotNull(condition, "Front-channel success predicate cannot be null");
+ }
+
+ @Override
+ public boolean isRevokeTokens(@Nullable final ProfileRequestContext profileRequestContext) {
+ return revokeTokensPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to revoke the tokens related to the session to be logged out.
+ *
+ * @param flag flag to set
+ */
+ public void setRevokeTokens(final boolean flag) {
+ revokeTokensPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether to revoke the tokens related to the session to be logged out.
+ *
+ * @param condition condition to set
+ */
+ public void setRevokeTokensPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ revokeTokensPredicate =
+ Constraint.isNotNull(condition, "Front-channel success predicate cannot be null");
+ }
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list