[java-oidc-common] branch main updated: JCOMOIDC-105 - Profile configuration setting to require OIDC authentication request

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=f82b35b50b84167cf788c02afdc008a5f454c026

The following commit(s) were added to refs/heads/main by this push:
     new f82b35b  JCOMOIDC-105 - Profile configuration setting to require OIDC authentication request
f82b35b is described below

commit f82b35b50b84167cf788c02afdc008a5f454c026
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Mar 26 09:13:23 2024 +0200

    JCOMOIDC-105 - Profile configuration setting to require OIDC authentication request
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-105
    
    Profile configuration setting 'requireAuthenticationRequest' and corresponding predicate.
---
 .../RequireAuthenticationRequestPredicate.java     | 48 ++++++++++++++++++++++
 .../OAuth2AuthorizationProfileConfiguration.java   | 12 ++++++
 .../DefaultOIDCAuthorizationConfiguration.java     | 33 +++++++++++++++
 3 files changed, 93 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RequireAuthenticationRequestPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RequireAuthenticationRequestPredicate.java
new file mode 100644
index 0000000..f2945fd
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RequireAuthenticationRequestPredicate.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OAuth2AuthorizationProfileConfiguration#isRequireAuthenticationRequest(ProfileRequestContext)}. Defaults to
+ * true.
+ * 
+ * @since 3.1.0
+ */
+public class RequireAuthenticationRequestPredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    @Override
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc instanceof OAuth2AuthorizationProfileConfiguration oapc) {
+                return oapc.isRequireAuthenticationRequest(input);
+            }
+        }
+        return true;
+    }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
index 5cfeda1..3c6530c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
@@ -105,4 +105,16 @@ public interface OAuth2AuthorizationProfileConfiguration {
     @Nonnull @NonnullElements @Unmodifiable @NotLive Set<String> getResponseModes(
             @Nullable final ProfileRequestContext profileRequestContext);
 
+    /**
+     * Get whether client is required to use OIDC authentication request vs plain OAuth2 authorization request.
+     * 
+      * @param profileRequestContext profile request context
+      * 
+      * @return whether client is required to use OIDC authentication request vs plain OAuth2 authorization request
+     * 
+     * @since 3.1.0
+     */
+    @ConfigurationSetting(name="requireAuthenticationRequest")
+    boolean isRequireAuthenticationRequest(@Nullable final ProfileRequestContext profileRequestContext);
+
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 744cc16..7b5c85f 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -142,6 +142,9 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
     /** Lookup function to supply the response_modes that are allowed to be used in authorization request. */
     @Nonnull private Function<ProfileRequestContext,Set<String>> responseModesLookupStrategy;
 
+    /** Whether client is required to use OIDC authentication request vs plain OAuth2 authorization request. */
+    @Nonnull private Predicate<ProfileRequestContext> requireAuthenticationRequestPredicate;
+
     /**
      * Constructor.
      */
@@ -182,6 +185,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
         tlsServerValidationOnlyPredicate = PredicateSupport.alwaysFalse();
         displayLookupStrategy = FunctionSupport.constant(null);
         responseModesLookupStrategy = FunctionSupport.constant(CollectionSupport.emptySet());
+        requireAuthenticationRequestPredicate = PredicateSupport.alwaysTrue();
     }
 
     /** {@inheritDoc} */
@@ -938,4 +942,33 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
         responseModesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
     }
 
+    /** {@inheritDoc} */
+    @Override
+    public boolean isRequireAuthenticationRequest(@Nullable final ProfileRequestContext profileRequestContext) {
+        return requireAuthenticationRequestPredicate.test(profileRequestContext);
+    }
+
+    /**
+     * Set whether client is required to use OIDC authentication request vs plain OAuth2 authorization request.
+     *
+     * @param flag flag to set
+     * 
+     * @since 3.1.0
+     */
+    public void setRequireAuthenticationRequest(final boolean flag) {
+        requireAuthenticationRequestPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+    }
+
+    /**
+     * Set condition for whether client is required to use OIDC authentication request vs plain OAuth2 authorization
+     * request.
+     *
+     * @param condition condition to set
+     * 
+     * @since 3.1.0
+     */
+    public void setRequireAuthenticationRequestPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        requireAuthenticationRequestPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+    }
+
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.