[java-oidc-common] branch main updated: JCOMOIDC-100 - Allowed ResponseModes should be configurable

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=4d3ef20a7e0dd3f45003745c5861830b26673d42

The following commit(s) were added to refs/heads/main by this push:
     new 4d3ef20  JCOMOIDC-100 - Allowed ResponseModes should be configurable
4d3ef20 is described below

commit 4d3ef20a7e0dd3f45003745c5861830b26673d42
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Mar 11 13:22:08 2024 +0200

    JCOMOIDC-100 - Allowed ResponseModes should be configurable
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-100
    
    Added 'responseModes' configuration setting to OAuth2AuthorizationProfileConfiguration and
    DefaultOIDCAuthorizationConfiguration.
---
 .../OAuth2AuthorizationProfileConfiguration.java   | 13 +++++++
 .../DefaultOIDCAuthorizationConfiguration.java     | 45 ++++++++++++++++++++++
 2 files changed, 58 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
index 3904d0b..5cfeda1 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
@@ -16,6 +16,7 @@ package net.shibboleth.oidc.profile.oauth2.config;
 
 import java.util.Set;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -91,5 +92,17 @@ public interface OAuth2AuthorizationProfileConfiguration {
     @ConfigurationSetting(name="responseType")
     @Nullable @NotEmpty String getResponseType(@Nullable final ProfileRequestContext profileRequestContext);
 
+    /**
+     * Get the response_modes that are allowed to be used in authorization requests.
+     *
+     * @param profileRequestContext the profile request context
+     *
+     * @return the response_mode
+     * 
+     * @since 3.1.0
+     */
+    @ConfigurationSetting(name="responseModes")
+    @Nonnull @NonnullElements @Unmodifiable @NotLive Set<String> getResponseModes(
+            @Nullable final ProfileRequestContext profileRequestContext);
 
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 91edae7..744cc16 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -139,6 +139,9 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
     /** Lookup function to determine the optional display parameter value of an authentication request.*/
     @Nonnull private Function<ProfileRequestContext,String> displayLookupStrategy;
 
+    /** Lookup function to supply the response_modes that are allowed to be used in authorization request. */
+    @Nonnull private Function<ProfileRequestContext,Set<String>> responseModesLookupStrategy;
+
     /**
      * Constructor.
      */
@@ -178,6 +181,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
         responseModeLookupStrategy = FunctionSupport.constant(null);
         tlsServerValidationOnlyPredicate = PredicateSupport.alwaysFalse();
         displayLookupStrategy = FunctionSupport.constant(null);
+        responseModesLookupStrategy = FunctionSupport.constant(CollectionSupport.emptySet());
     }
 
     /** {@inheritDoc} */
@@ -893,4 +897,45 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
         return displayLookupStrategy.apply(profileRequestContext);
     }
 
+    /** {@inheritDoc} */
+    @Override
+    @Nonnull @NonnullElements @NotLive public Set<String> getResponseModes(
+            @Nullable final ProfileRequestContext profileRequestContext) {
+
+        final Set<String> responseModes = responseModesLookupStrategy.apply(profileRequestContext);
+        if (responseModes != null) {
+            return CollectionSupport.copyToSet(responseModes);
+        }
+        return CollectionSupport.emptySet();
+    }
+
+    /**
+     * Set the set of response modes that are allowed to be used in authorization request.
+     *
+     * @param responseModes the allowed response modes
+     * 
+     * @since 3.1.0
+     */
+    public void setResponseModes(@Nullable @NonnullElements final Collection<String> responseModes) {
+
+        if (responseModes == null || responseModes.isEmpty()) {
+            responseModesLookupStrategy = FunctionSupport.constant(CollectionSupport.emptySet());
+        } else {
+            responseModesLookupStrategy = FunctionSupport.constant(
+                    Set.copyOf(StringSupport.normalizeStringCollection(responseModes)));
+        }
+    }
+
+    /**
+     * Set a lookup strategy for the set of response modes that are allowed to be used in authorization request.
+     *
+     * @param strategy lookup strategy
+     * 
+     * @since 3.1.0
+     */
+    public void setResponseModesLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
+        responseModesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+    }
+
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.