[java-idp-oidc] 02/03: Null cleanup of api-module: token claims sets.
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Mar 27 16:14:03 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=0223696c53d76917379752136236ecc85001fdee
commit 0223696c53d76917379752136236ecc85001fdee
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Mar 27 18:04:48 2024 +0200
Null cleanup of api-module: token claims sets.
---
.../op/token/support/AccessTokenClaimsSet.java | 22 +--
.../op/token/support/AuthorizeCodeClaimsSet.java | 3 +-
.../op/token/support/RefreshTokenClaimsSet.java | 32 +++--
.../op/token/support/RegistrationClaimsSet.java | 9 +-
.../oidc/op/token/support/TokenClaimsSet.java | 154 +++++++++++----------
5 files changed, 119 insertions(+), 101 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
index a23bd3cd..53fcb0b0 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
@@ -24,6 +24,7 @@ import com.nimbusds.openid.connect.sdk.claims.ACR;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.security.DataSealer;
import net.shibboleth.shared.security.DataSealerException;
@@ -57,6 +58,7 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
throws ParseException {
final JWTClaimsSet atClaimsSet = JWTClaimsSet.parse(accessTokenClaimsSet);
// Throws exception if parsing result is not expected one.
+ assert atClaimsSet != null;
verifyParsedClaims(VALUE_TYPE_AT, atClaimsSet);
return new AccessTokenClaimsSet(atClaimsSet);
}
@@ -94,21 +96,22 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
JWTClaimsSet claims = jwtAccessToken.getJWTClaimsSet();
// Check for embedded custom claim.
- if (claims.getClaim(TokenClaimsSet.KEY_SEALED_FOR_OP) == null) {
+ final String sealedClaim = (String) claims.getClaim(TokenClaimsSet.KEY_SEALED_FOR_OP);
+ if (sealedClaim == null) {
// Throws exception if parsing result is not expected one.
verifyParsedClaims(VALUE_TYPE_AT, claims);
return new AccessTokenClaimsSet(claims);
}
final Map<String,Object> map = claims.toJSONObject();
- final JWTClaimsSet unsealed = JWTClaimsSet.parse(
- dataSealer.unwrap(claims.getStringClaim(TokenClaimsSet.KEY_SEALED_FOR_OP)));
+ final JWTClaimsSet unsealed = JWTClaimsSet.parse(dataSealer.unwrap(sealedClaim));
map.remove(TokenClaimsSet.KEY_SEALED_FOR_OP);
for (final Map.Entry<String,Object> claim : unsealed.getClaims().entrySet()) {
map.put(claim.getKey(), claim.getValue());
}
claims = JWTClaimsSet.parse(map);
+ assert claims != null;
verifyParsedClaims(VALUE_TYPE_AT, claims);
return new AccessTokenClaimsSet(claims);
}
@@ -155,15 +158,16 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
* @param existing existing claim set
*/
private Builder(@Nonnull final TokenClaimsSet existing) {
- setJWTID(existing.getID());
- setClientID(existing.getClientID());
- setIssuer(existing.getClaimsSet().getIssuer());
- setPrincipal(existing.getPrincipal());
- setSubject(existing.getClaimsSet().getSubject());
+ setJWTID(Constraint.isNotEmpty(existing.getID(), "JWT ID cannot be empty"));
+ setClientID(Constraint.isNotNull(existing.getClientID(), "Client ID cannot be null"));
+ setIssuer(Constraint.isNotEmpty(existing.assertedClaimsSet().getIssuer(), "Issuer cannot be empty"));
+ setPrincipal(Constraint.isNotEmpty(existing.getPrincipal(), "Principal cannot be empty"));
+ setSubject(Constraint.isNotEmpty(existing.assertedClaimsSet().getSubject(), "Subject cannot be empty"));
setACR(existing.getACR() == null ? null : new ACR(existing.getACR()));
setNonce(existing.getNonce());
setNotBefore(existing.getNotBefore());
- setAuthenticationTime(existing.getAuthenticationTime());
+ setAuthenticationTime(Constraint.isNotNull(existing.getAuthenticationTime(),
+ "Authentication time cannot be null"));
setAudience(existing.getAudience());
setClaimsRequest(existing.getClaimsRequest());
setConsentedClaims(existing.getConsentedClaims());
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
index a205c8c4..ab6a6f24 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AuthorizeCodeClaimsSet.java
@@ -35,7 +35,7 @@ public final class AuthorizeCodeClaimsSet extends TokenClaimsSet {
*
* @param authzCodeClaimsSet authorize code claims set
*/
- private AuthorizeCodeClaimsSet(final JWTClaimsSet authzCodeClaimsSet) {
+ private AuthorizeCodeClaimsSet(@Nonnull final JWTClaimsSet authzCodeClaimsSet) {
super(authzCodeClaimsSet);
}
@@ -49,6 +49,7 @@ public final class AuthorizeCodeClaimsSet extends TokenClaimsSet {
public static AuthorizeCodeClaimsSet parse(final String authorizeCodeClaimsSet) throws ParseException {
final JWTClaimsSet acClaimsSet = JWTClaimsSet.parse(authorizeCodeClaimsSet);
// Throws exception if parsing result is not expected one.
+ assert acClaimsSet != null;
verifyParsedClaims(VALUE_TYPE_AC, acClaimsSet);
return new AuthorizeCodeClaimsSet(acClaimsSet);
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
index d00d720f..ad276d59 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RefreshTokenClaimsSet.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.oidc.op.token.support;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.ACR;
@@ -42,7 +43,7 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
*
* @param refreshTokenClaimsSet refresh token claims set
*/
- private RefreshTokenClaimsSet(final JWTClaimsSet refreshTokenClaimsSet) {
+ private RefreshTokenClaimsSet(@Nonnull final JWTClaimsSet refreshTokenClaimsSet) {
super(refreshTokenClaimsSet);
}
@@ -51,11 +52,14 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
*
* @return expiration time of the token
*/
- @Nonnull public Instant getChainExp() {
- Constraint.isNotNull(getClaimsSet(), "JWTClaimsSet cannot be null");
+ @Nullable public Instant getChainExp() {
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
try {
- if (getClaimsSet().getClaims().containsKey(KEY_CHAIN_EXPIRATION_TIME)) {
- return getClaimsSet().getDateClaim(KEY_CHAIN_EXPIRATION_TIME).toInstant();
+ if (tokenClaimsSet.getClaims().containsKey(KEY_CHAIN_EXPIRATION_TIME)) {
+ final Date date = tokenClaimsSet.getDateClaim(KEY_CHAIN_EXPIRATION_TIME);
+ if (date != null) {
+ return date.toInstant();
+ }
}
} catch (final ParseException e) {
}
@@ -73,6 +77,7 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
throws ParseException {
final JWTClaimsSet atClaimsSet = JWTClaimsSet.parse(refreshTokenClaimsSet);
// Throws exception if parsing result is not expected one.
+ assert atClaimsSet != null;
verifyParsedClaims(VALUE_TYPE_RF, atClaimsSet);
if (atClaimsSet.getClaims().containsKey(KEY_CHAIN_EXPIRATION_TIME)) {
atClaimsSet.getDateClaim(KEY_CHAIN_EXPIRATION_TIME);
@@ -154,17 +159,18 @@ public final class RefreshTokenClaimsSet extends TokenClaimsSet {
* @param existing existing claim set
*/
private Builder(@Nonnull final TokenClaimsSet existing) {
- setJWTID(existing.getID());
+ setJWTID(Constraint.isNotEmpty(existing.getID(), "JWT ID cannot be empty"));
setNotBefore(existing.getNotBefore());
- setClientID(existing.getClientID());
- setIssuer(existing.getClaimsSet().getIssuer());
- setPrincipal(existing.getPrincipal());
- setSubject(existing.getClaimsSet().getSubject());
+ setClientID(Constraint.isNotNull(existing.getClientID(), "Client ID cannot be null"));
+ setIssuer(Constraint.isNotEmpty(existing.assertedClaimsSet().getIssuer(), "Issuer cannot be empty"));
+ setPrincipal(Constraint.isNotEmpty(existing.getPrincipal(), "Principal cannot be empty"));
+ setSubject(Constraint.isNotEmpty(existing.assertedClaimsSet().getSubject(), "Subject cannot be empty"));
setACR(existing.getACR() == null ? null : new ACR(existing.getACR()));
- setAuthenticationTime(existing.getAuthenticationTime());
+ setAuthenticationTime(Constraint.isNotNull(existing.getAuthenticationTime(),
+ "Authentication time cannot be null"));
setNonce(existing.getNonce());
- setRedirectURI(existing.getRedirectURI());
- setScope(existing.getScope());
+ setRedirectURI(Constraint.isNotNull(existing.getRedirectURI(), "Redirect URI cannot be null"));
+ setScope(Constraint.isNotNull(existing.getScope(), "Scope cannot be null"));
setAudience(existing.getAudience());
setClaimsRequest(existing.getClaimsRequest());
setDlClaims(existing.getDeliveryClaims());
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RegistrationClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RegistrationClaimsSet.java
index 550c9697..e27baf11 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RegistrationClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/RegistrationClaimsSet.java
@@ -20,9 +20,6 @@ import java.util.Map;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
import com.fasterxml.jackson.annotation.JsonGetter;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.annotation.JsonSetter;
@@ -43,9 +40,6 @@ public final class RegistrationClaimsSet {
/** Value of initial registration access token claims set type. */
private static final String VALUE_TYPE_RT = "rt";
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(RegistrationClaimsSet.class);
-
/** Identifier for the token. */
@JsonProperty("jti")
@Nullable @NotEmpty private String jti;
@@ -348,7 +342,8 @@ public final class RegistrationClaimsSet {
* @return true iff replacement is allowed
*/
public boolean isReplacement() {
- return replacement == null ? false : replacement.booleanValue();
+ final Boolean repl = replacement;
+ return repl == null ? false : repl.booleanValue();
}
/**
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
index 2f13339c..ea9d1a7f 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/TokenClaimsSet.java
@@ -15,7 +15,6 @@
package net.shibboleth.idp.plugin.oidc.op.token.support;
import java.util.Collection;
-import java.util.Collections;
import java.util.Date;
import java.util.HashMap;
import java.util.List;
@@ -26,7 +25,6 @@ import javax.annotation.Nullable;
import javax.annotation.concurrent.NotThreadSafe;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.Scope;
@@ -42,7 +40,10 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.ConstraintViolationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.security.DataSealer;
import net.shibboleth.shared.security.DataSealerException;
import net.shibboleth.shared.security.IdentifierGenerationStrategy;
@@ -172,10 +173,6 @@ public class TokenClaimsSet {
protected static void verifyParsedClaims(@Nonnull @NotEmpty final String tokenType,
@Nonnull final JWTClaimsSet tokenClaimsSet) throws ParseException {
- if (tokenClaimsSet == null) {
- throw new ParseException("JWT claims set is unset", 0);
- }
-
// Check existence and type of mandatory fields and values
if (!tokenType.equals(tokenClaimsSet.getClaims().get(KEY_TYPE))) {
throw new ParseException("claim type value not matching", 0);
@@ -244,7 +241,8 @@ public class TokenClaimsSet {
*/
@Nonnull @NotEmpty public String serialize() {
Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return JSONObjectUtils.toJSONObject(tokenClaimsSet).toJSONString();
+ return Constraint.isNotEmpty(JSONObjectUtils.toJSONObject(tokenClaimsSet).toJSONString(),
+ "JWTClaimsSet could not be serialized");
}
/**
@@ -255,7 +253,8 @@ public class TokenClaimsSet {
* @throws DataSealerException is thrown if unwrapping fails
*/
@Nonnull public String serialize(@Nonnull final DataSealer dataSealer) throws DataSealerException {
- return dataSealer.wrap(serialize(), Instant.ofEpochMilli(tokenClaimsSet.getExpirationTime().getTime()));
+ return dataSealer.wrap(serialize(), Instant.ofEpochMilli(
+ Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null").getExpirationTime().getTime()));
}
/**
@@ -275,6 +274,17 @@ public class TokenClaimsSet {
@Nullable public JWTClaimsSet getClaimsSet() {
return tokenClaimsSet;
}
+
+ /**
+ * Get the token claims set. If the claims set is null a {@link ConstraintViolationException} is thrown.
+ *
+ * @return token claims set
+ *
+ * @since 4.1.0
+ */
+ @Nonnull protected JWTClaimsSet assertedClaimsSet() {
+ return Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ }
/**
* Get the issuer.
@@ -284,8 +294,7 @@ public class TokenClaimsSet {
* @since 3.1.0
*/
@Nonnull @NotEmpty public String getIssuer() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return tokenClaimsSet.getIssuer();
+ return Constraint.isNotEmpty(assertedClaimsSet().getIssuer(), "The issuer cannot be null");
}
/**
@@ -296,8 +305,11 @@ public class TokenClaimsSet {
* @since 3.1.0
*/
@Nonnull public Instant getIssuedAt() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return tokenClaimsSet.getIssueTime().toInstant();
+ final Date issuedAt =
+ Constraint.isNotNull(assertedClaimsSet().getIssueTime(), "The issued at cannot be null");
+ final Instant iat = issuedAt.toInstant();
+ assert iat != null;
+ return iat;
}
/**
@@ -306,8 +318,11 @@ public class TokenClaimsSet {
* @return expiration time of the token
*/
@Nonnull public Instant getExp() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return tokenClaimsSet.getExpirationTime().toInstant();
+ final Date expiration =
+ Constraint.isNotNull(assertedClaimsSet().getExpirationTime(), "The expiration time cannot be null");
+ final Instant exp = expiration.toInstant();
+ assert exp != null;
+ return exp;
}
/**
@@ -318,8 +333,7 @@ public class TokenClaimsSet {
* @since 3.1.0
*/
@Nullable public Instant getNotBefore() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- final Date d = tokenClaimsSet.getNotBeforeTime();
+ final Date d = assertedClaimsSet().getNotBeforeTime();
return d != null ? d.toInstant() : null;
}
@@ -346,9 +360,8 @@ public class TokenClaimsSet {
* @return redirect uri of the request, null if not located.
*/
@Nullable public URI getRedirectURI() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
try {
- return URI.create(tokenClaimsSet.getStringClaim(KEY_REDIRECT_URI));
+ return URI.create(assertedClaimsSet().getStringClaim(KEY_REDIRECT_URI));
} catch (final ParseException|IllegalArgumentException e) {
log.error("error parsing redirect uri from token", e.getMessage());
}
@@ -362,8 +375,7 @@ public class TokenClaimsSet {
* @return acr of the performed authentication.
*/
@Nullable public String getACR() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return (String) tokenClaimsSet.getClaim(KEY_ACR);
+ return (String) assertedClaimsSet().getClaim(KEY_ACR);
}
/**
@@ -372,8 +384,7 @@ public class TokenClaimsSet {
* @return Type of the claims set.
*/
@Nullable public String getType() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return (String) tokenClaimsSet.getClaim(KEY_TYPE);
+ return (String) assertedClaimsSet().getClaim(KEY_TYPE);
}
/**
@@ -382,8 +393,7 @@ public class TokenClaimsSet {
* @return principal of the user.
*/
@Nullable public String getPrincipal() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return (String) tokenClaimsSet.getClaim(KEY_USER_PRINCIPAL);
+ return (String) assertedClaimsSet().getClaim(KEY_USER_PRINCIPAL);
}
/**
@@ -394,8 +404,7 @@ public class TokenClaimsSet {
* @since 3.1.0
*/
@Nullable public String getSubject() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return (String) tokenClaimsSet.getClaim(KEY_SUBJECT);
+ return (String) assertedClaimsSet().getClaim(KEY_SUBJECT);
}
/**
@@ -404,11 +413,11 @@ public class TokenClaimsSet {
* @return auth time of the user.
*/
@Nullable public Instant getAuthenticationTime() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
try {
- return tokenClaimsSet.getDateClaim(KEY_AUTH_TIME).toInstant();
+ final Date date = assertedClaimsSet().getDateClaim(KEY_AUTH_TIME);
+ return date == null ? null : date.toInstant();
} catch (final ParseException e) {
- log.error("Error parsing auth time {}", tokenClaimsSet.getClaim(KEY_AUTH_TIME));
+ log.error("Error parsing auth time {}", assertedClaimsSet().getClaim(KEY_AUTH_TIME));
// should never happen, programming error.
return null;
}
@@ -420,11 +429,8 @@ public class TokenClaimsSet {
* @return nonce of the authentication request.
*/
@Nullable public Nonce getNonce() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- if (tokenClaimsSet.getClaim(KEY_NONCE) == null) {
- return null;
- }
- return new Nonce((String) tokenClaimsSet.getClaim(KEY_NONCE));
+ final Object nonce = assertedClaimsSet().getClaim(KEY_NONCE);
+ return nonce == null ? null : new Nonce((String) nonce);
}
/**
@@ -433,7 +439,7 @@ public class TokenClaimsSet {
* @return claims request in authentication request, null if not existing.
*/
@Nullable public OIDCClaimsRequest getClaimsRequest() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
if (tokenClaimsSet.getClaim(KEY_CLAIMS) == null) {
return null;
}
@@ -451,7 +457,7 @@ public class TokenClaimsSet {
* @return token delivery claims
*/
@Nullable public ClaimsSet getDeliveryClaims() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
final ClaimsSet claimsSet = new ClaimsSet();
try {
final Map<String, Object> claims = tokenClaimsSet.getJSONObjectClaim(KEY_DELIVERY_CLAIMS);
@@ -472,7 +478,7 @@ public class TokenClaimsSet {
* @return id token token delivery claims
*/
@Nullable public ClaimsSet getIDTokenDeliveryClaims() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
final ClaimsSet claimsSet = new ClaimsSet();
try {
final Map<String, Object> claims = tokenClaimsSet.getJSONObjectClaim(KEY_DELIVERY_CLAIMS_IDTOKEN);
@@ -494,7 +500,7 @@ public class TokenClaimsSet {
* @return user info response token delivery claims
*/
@Nullable public ClaimsSet getUserinfoDeliveryClaims() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
final ClaimsSet claimsSet = new ClaimsSet();
try {
final Map<String, Object> claims = tokenClaimsSet.getJSONObjectClaim(KEY_DELIVERY_CLAIMS_USERINFO);
@@ -516,8 +522,7 @@ public class TokenClaimsSet {
* @return consented claims
*/
@Nullable @NonnullElements public List<Object> getConsentedClaims() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return (List<Object>) tokenClaimsSet.getClaim(KEY_CONSENTED_CLAIMS);
+ return (List<Object>) assertedClaimsSet().getClaim(KEY_CONSENTED_CLAIMS);
}
/**
@@ -526,7 +531,7 @@ public class TokenClaimsSet {
* @return whether consent has been enabled
*/
public boolean isConsentEnabled() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
if (tokenClaimsSet.getClaim(KEY_CONSENT_ENABLED) != null) {
try {
return tokenClaimsSet.getBooleanClaim(KEY_CONSENT_ENABLED).booleanValue();
@@ -548,7 +553,7 @@ public class TokenClaimsSet {
* @return scope of the token
*/
@Nullable public Scope getScope() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
try {
return Scope.parse(tokenClaimsSet.getStringClaim(KEY_SCOPE));
} catch (final ParseException e) {
@@ -567,8 +572,7 @@ public class TokenClaimsSet {
*/
@Nonnull @NonnullElements @NotLive @Unmodifiable
public List<String> getAudience() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return tokenClaimsSet.getAudience();
+ return Constraint.isNotNull(assertedClaimsSet().getAudience(), "The audience cannot be null");
}
/**
@@ -577,7 +581,7 @@ public class TokenClaimsSet {
* @return code challenge of the authentication request.
*/
@Nullable public String getCodeChallenge() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
if (tokenClaimsSet.getClaim(KEY_CODE_CHALLENGE) == null) {
return null;
}
@@ -590,8 +594,7 @@ public class TokenClaimsSet {
* @return id of the token
*/
@Nullable public String getID() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
- return tokenClaimsSet.getJWTID();
+ return assertedClaimsSet().getJWTID();
}
/**
@@ -600,7 +603,7 @@ public class TokenClaimsSet {
* @return Client ID of the token
*/
@Nullable public ClientID getClientID() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
Object id = tokenClaimsSet.getClaim(KEY_CLIENTID);
if (id == null) {
id = tokenClaimsSet.getClaim(KEY_LEGACY_CLIENTID);
@@ -620,7 +623,7 @@ public class TokenClaimsSet {
* @since 3.2.0
*/
@Nullable public String getRootTokenIdentifier() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
if (tokenClaimsSet.getClaim(KEY_ROOT_JTI) == null) {
return null;
}
@@ -635,7 +638,7 @@ public class TokenClaimsSet {
* @since 3.3.0
*/
@Nullable public String getSessionIdentifier() {
- Constraint.isNotNull(tokenClaimsSet, "JWTClaimsSet cannot be null");
+ final JWTClaimsSet tokenClaimsSet = assertedClaimsSet();
if (tokenClaimsSet.getClaim(KEY_SESSION_ID) == null) {
return null;
}
@@ -652,7 +655,7 @@ public class TokenClaimsSet {
// Checkstyle: VisibilityModifier OFF
/** Token ID. */
- @Nonnull @NotEmpty protected String jwtid;
+ @Nullable protected String jwtid;
/** Client Id of the rp. */
@Nullable protected ClientID rpId;
@@ -709,7 +712,7 @@ public class TokenClaimsSet {
@Nullable protected List<Object> consentedClaims;
/** Has consent been asked from the end-user. */
- protected Boolean consentEnabled;
+ @Nullable protected Boolean consentEnabled;
/** Code challenge. */
@Nullable protected String codeChallenge;
@@ -725,7 +728,7 @@ public class TokenClaimsSet {
/** Default constructor. */
protected Builder() {
- audience = Collections.emptyList();
+ audience = CollectionSupport.emptyList();
customClaims = new HashMap<>();
}
@@ -743,32 +746,41 @@ public class TokenClaimsSet {
*/
@Nonnull protected JWTClaimsSet buildJWTClaimsSet(@Nonnull @NotEmpty final String tokenType) {
- if (tokenType == null || jwtid == null || rpId == null || iss == null
- || iat == null || exp == null || authTime == null || reqScope == null
- || sub == null) {
+ if (jwtid == null || rpId == null || iss == null || iat == null || exp == null || authTime == null
+ || reqScope == null || sub == null) {
throw new RuntimeException("Invalid parameters, programming error");
}
-
+ assert rpId != null;
+ final String clientId = rpId.getValue();
+ final ACR ctxRef = acr;
+ final Nonce nonceValue = nonce;
+ final URI redirectUri = redirect;
+ assert reqScope != null;
+ final String scopeValue = reqScope.toString();
+ final OIDCClaimsRequest requestClaims = reqClaims;
+ final ClaimsSet deliveryClaims = dlClaims;
+ final ClaimsSet idTokenClaims = dlClaimsID;
+ final ClaimsSet userInfoClaims = dlClaimsUI;
final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder()
.claim(KEY_TYPE, tokenType)
.jwtID(jwtid)
- .claim(KEY_CLIENTID, rpId.getValue())
+ .claim(KEY_CLIENTID, clientId)
.issuer(iss)
.subject(sub)
.claim(KEY_USER_PRINCIPAL, principal)
- .claim(KEY_ACR, acr == null ? null : acr.getValue())
+ .claim(KEY_ACR, ctxRef == null ? null : ctxRef.getValue())
.issueTime(Date.from(iat))
.expirationTime(Date.from(exp))
.notBeforeTime(nbt != null ? Date.from(nbt) : null)
.audience(audience)
- .claim(KEY_NONCE, nonce == null ? null : nonce.getValue())
+ .claim(KEY_NONCE, nonceValue == null ? null : nonceValue.getValue())
.claim(KEY_AUTH_TIME, Date.from(authTime))
- .claim(KEY_REDIRECT_URI, redirect == null ? null : redirect.toString())
- .claim(KEY_SCOPE, reqScope.toString())
- .claim(KEY_CLAIMS, reqClaims == null ? null : reqClaims.toJSONObject())
- .claim(KEY_DELIVERY_CLAIMS, dlClaims == null ? null : dlClaims.toJSONObject())
- .claim(KEY_DELIVERY_CLAIMS_IDTOKEN, dlClaimsID == null ? null : dlClaimsID.toJSONObject())
- .claim(KEY_DELIVERY_CLAIMS_USERINFO, dlClaimsUI == null ? null : dlClaimsUI.toJSONObject())
+ .claim(KEY_REDIRECT_URI, redirectUri == null ? null : redirectUri.toString())
+ .claim(KEY_SCOPE, scopeValue)
+ .claim(KEY_CLAIMS, requestClaims == null ? null : requestClaims.toJSONObject())
+ .claim(KEY_DELIVERY_CLAIMS, deliveryClaims == null ? null : deliveryClaims.toJSONObject())
+ .claim(KEY_DELIVERY_CLAIMS_IDTOKEN, idTokenClaims == null ? null : idTokenClaims.toJSONObject())
+ .claim(KEY_DELIVERY_CLAIMS_USERINFO, userInfoClaims == null ? null : userInfoClaims.toJSONObject())
.claim(KEY_CONSENTED_CLAIMS, consentedClaims)
.claim(KEY_CODE_CHALLENGE, codeChallenge)
.claim(KEY_CONSENT_ENABLED, consentEnabled)
@@ -781,7 +793,7 @@ public class TokenClaimsSet {
}
});
- return builder.build();
+ return Constraint.isNotNull(builder.build(), "Could not build JWT claims set");
}
// Checkstyle:CyclomaticComplexity ON
@@ -922,7 +934,7 @@ public class TokenClaimsSet {
*
* @since 3.1.0
*/
- public Builder<T> setNotBefore(@Nonnull final Instant i) {
+ public Builder<T> setNotBefore(@Nullable final Instant i) {
nbt = i;
return this;
}
@@ -966,9 +978,9 @@ public class TokenClaimsSet {
*/
public Builder<T> setAudience(@Nullable @NonnullElements final Collection<String> aud) {
if (aud != null) {
- audience = List.copyOf(aud);
+ audience = CollectionSupport.copyToList(aud);
} else {
- audience = Collections.emptyList();
+ audience = CollectionSupport.emptyList();
}
return this;
}
@@ -1167,7 +1179,7 @@ public class TokenClaimsSet {
*
* @return claims set instance.
*/
- public abstract T build();
+ @Nonnull public abstract T build();
}
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list