[java-oidc-common] branch main updated: JCOMOIDC-117 - Profile configuration setting for custom redirect URI validation
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Jun 5 11:55:17 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=872b6d1bd28e05132978cf3e89516dc24e95d8c8
The following commit(s) were added to refs/heads/main by this push:
new 872b6d1 JCOMOIDC-117 - Profile configuration setting for custom redirect URI validation
872b6d1 is described below
commit 872b6d1bd28e05132978cf3e89516dc24e95d8c8
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Jun 5 14:51:44 2024 +0300
JCOMOIDC-117 - Profile configuration setting for custom redirect URI validation
https://shibboleth.atlassian.net/browse/JCOMOIDC-117
- customRedirectUriValidationStrategy to OIDCSSOProfileConfiguration
- BiPredicate<URI,ProfileRequestContext>
- Implemented in AbstractOIDCSSOConfiguration
---
.../config/OIDCSSOProfileConfiguration.java | 17 ++++++-
...edirectUriValidationStrategyLookupFunction.java | 56 ++++++++++++++++++++++
.../config/impl/AbstractOIDCSSOConfiguration.java | 42 +++++++++++++++-
3 files changed, 112 insertions(+), 3 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
index 35e95a7..22d9387 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProfileConfiguration.java
@@ -14,6 +14,9 @@
package net.shibboleth.oidc.profile.config;
+import java.net.URI;
+import java.util.function.BiPredicate;
+
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -47,5 +50,17 @@ public interface OIDCSSOProfileConfiguration extends OIDCProfileConfiguration {
*/
@ConfigurationSetting(name="allowPKCEPlain")
boolean isAllowPKCEPlain(@Nullable final ProfileRequestContext profileRequestContext);
-
+
+ /**
+ * Get the bi-predicate for validating redirect URI in request to the current profile request context state.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the bi-predicate for validating requested redirect URI
+ *
+ * @since 3.2.0
+ */
+ @ConfigurationSetting(name="customRedirectUriValidationStrategy")
+ @Nullable BiPredicate<URI,ProfileRequestContext> getCustomRedirectUriValidationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/CustomRedirectUriValidationStrategyLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/CustomRedirectUriValidationStrategyLookupFunction.java
new file mode 100644
index 0000000..364d770
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/CustomRedirectUriValidationStrategyLookupFunction.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.net.URI;
+import java.util.function.BiPredicate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
+
+/**
+ * A function that returns
+ * {@link OIDCSSOProfileConfiguration#getCustomRedirectUriValidationStrategy(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 3.2.0
+ */
+public class CustomRedirectUriValidationStrategyLookupFunction extends
+ AbstractRelyingPartyLookupFunction<BiPredicate<URI,ProfileRequestContext>> {
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public BiPredicate<URI,ProfileRequestContext> apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OIDCSSOProfileConfiguration ospc) {
+ return ospc.getCustomRedirectUriValidationStrategy(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 3d3e9d5..ed2c65a 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -14,11 +14,13 @@
package net.shibboleth.oidc.profile.config.impl;
+import java.net.URI;
import java.time.Duration;
import java.util.Collection;
import java.util.Map;
import java.util.Set;
import java.util.function.BiFunction;
+import java.util.function.BiPredicate;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -95,6 +97,11 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
accessTokenClaimsSetManipulationStrategyLookupStrategy;
+ /** Lookup function to supply strategy bi-predicate for custom valdation of redirect URI in the request. */
+ @Nonnull
+ private Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>>
+ customRedirectUriValidationStrategyLookupStrategy;
+
/**
* Creates a new configuration instance.
*
@@ -121,8 +128,8 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
idTokenManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
-
-
+
+ customRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -597,4 +604,35 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
"Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public BiPredicate<URI,ProfileRequestContext> getCustomRedirectUriValidationStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return customRedirectUriValidationStrategyLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the bi-predicate for custom validation of redirect URI in the request.
+ * .
+ * @param strategy bi-predicate for custom validation of redirect URI in the request
+ *
+ * @since 3.2.0
+ */
+ public void setCustomRedirectUriValidationStrategy(
+ @Nullable final BiPredicate<URI,ProfileRequestContext> strategy) {
+ customRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the bi-predicate for custom validation of redirect URI in the request.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.2.0
+ */
+ public void setCustomRedirectUriValidationStrategyLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext,BiPredicate<URI,ProfileRequestContext>> strategy) {
+ customRedirectUriValidationStrategyLookupStrategy = Constraint.isNotNull(strategy,
+ "Lookup strategy cannot be null");
+ }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list