[java-idp-oidc] 03/03: Null cleanup of rest of api-module.
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Mar 27 16:14:04 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=cceb3777063d6c3667eaeba25515304e95519b64
commit cceb3777063d6c3667eaeba25515304e95519b64
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Mar 27 18:09:13 2024 +0200
Null cleanup of rest of api-module.
---
.../ServiceableProviderMetadataProvider.java | 8 +++-
.../idp/plugin/oidc/op/profile/ScopeUtil.java | 32 +++++++++++-----
...AbstractAuthorizationRequestLookupFunction.java | 4 +-
.../AbstractTokenClaimsLookupFunction.java | 2 +-
.../AbstractTokenRequestLookupFunction.java | 8 ++--
.../AccessTokenClaimsSetLookupFunction.java | 2 +-
.../navigate/ClientInfoAudienceLookupFunction.java | 44 +++++++++++-----------
.../navigate/ClientInfoScopeLookupFunction.java | 10 +++--
...efaultComputeAuthorizationCodeHashFunction.java | 20 ++++++----
...gistrationTokenClaimsContextLookupFunction.java | 2 +-
.../DefaultRequestAudienceLookupFunction.java | 13 ++++---
.../DefaultRequestCodeChallengeLookupFunction.java | 13 ++++---
...ltRequestCodeChallengeMethodLookupFunction.java | 14 ++++---
.../DefaultRequestLoginHintLookupFunction.java | 10 +++--
.../DefaultRequestMaxAgeLookupFunction.java | 10 +++--
.../DefaultRequestNonceLookupFunction.java | 14 ++++---
.../DefaultRequestRedirectURILookupFunction.java | 9 +++--
.../DefaultRequestResponseModeLookupFunction.java | 9 +++--
.../DefaultRequestResponseTypeLookupFunction.java | 9 +++--
.../DefaultRequestStateLookupFunction.java | 13 ++++---
.../DefaultRequestedAcrLookupFunction.java | 10 +++--
.../DefaultRequestedClaimsLookupFunction.java | 9 +++--
.../DefaultRequestedPromptLookupFunction.java | 9 +++--
.../DefaultRequestedScopeLookupFunction.java | 9 +++--
.../DefaultResponseClaimsSetLookupFunction.java | 2 +-
.../DefaultUserInfoSigningAlgLookupFunction.java | 11 ++++--
...tValidPostLogoutRedirectUrisLookupFunction.java | 12 ++++--
.../DefaultValidRedirectUrisLookupFunction.java | 13 +++++--
.../DefaultValidResponseTypesLookupFunction.java | 6 ---
.../navigate/JWTAccessTokenUpdateStrategy.java | 7 +++-
.../LogoutRequestClientIDLookupFunction.java | 3 +-
.../navigate/MetadataStatementsLookupFunction.java | 2 +-
...uthenticationResponseContextLookupFunction.java | 2 +-
.../OIDCRPSessionClientIDLookupFunction.java | 8 ++--
...CRegistrationResponseContextLookupFunction.java | 2 +-
.../ProcessedIdTokenHintUpdateStrategy.java | 10 ++---
.../navigate/ProcessedTokenUpdateStrategy.java | 6 ++-
.../navigate/ProfileResponderIdLookupFunction.java | 11 ++----
.../navigate/RequestObjectUpdateStrategy.java | 10 ++---
...onseContextAuthorizationCodeLookupFunction.java | 13 +++++--
.../navigate/SectorIdentifierLookupFunction.java | 22 ++++++++---
.../TokenRequestRedirectURILookupFunction.java | 3 +-
.../TokenRequestSubjectLookupFunction.java | 5 ++-
.../TokenRequestTokenClaimsSetLookupFunction.java | 9 +++--
.../UserInfoRequestClientIDLookupFunction.java | 30 ++++++---------
.../UserInfoResponseClaimsSetLookupFunction.java | 2 +-
.../navigate/ValidatedAudienceLookupFunction.java | 2 +-
.../ValidatedRedirectURILookupFunction.java | 2 +-
.../navigate/ValidatedScopeLookupFunction.java | 2 +-
.../idp/plugin/oidc/op/session/OIDCRPSession.java | 14 ++++++-
50 files changed, 300 insertions(+), 192 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/resolver/ServiceableProviderMetadataProvider.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/resolver/ServiceableProviderMetadataProvider.java
index a9c301d6..0b6391d4 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/resolver/ServiceableProviderMetadataProvider.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/metadata/resolver/ServiceableProviderMetadataProvider.java
@@ -21,7 +21,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.Objects;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
@@ -30,6 +29,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.ResolverException;
import net.shibboleth.shared.spring.service.AbstractServiceableComponent;
@@ -86,6 +86,8 @@ public class ServiceableProviderMetadataProvider extends AbstractServiceableComp
*/
@Nonnull
public ProviderMetadataResolver getEmbeddedResolver() {
+ ifNotInitializedThrowUninitializedComponentException();
+ assert resolver != null;
return resolver;
}
@@ -181,7 +183,9 @@ public class ServiceableProviderMetadataProvider extends AbstractServiceableComp
if (equals(other)) {
return 0;
}
- return getId().compareTo(other.getId());
+ final String id = getId();
+ assert id != null;
+ return id.compareTo(other.getId());
}
/**
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/ScopeUtil.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/ScopeUtil.java
index 2bb02aa9..187980c7 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/ScopeUtil.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/ScopeUtil.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.oidc.op.profile;
import java.util.ArrayList;
+import java.util.Collection;
import java.util.List;
import javax.annotation.Nonnull;
@@ -76,7 +77,12 @@ public final class ScopeUtil {
return;
}
final List<IdPAttributeValue> values = new ArrayList<>(scope.size());
- scope.forEach(value -> values.add(new StringAttributeValue(value.getValue())));
+ scope.forEach(value -> {
+ final String stringValue = value.getValue();
+ if (stringValue != null) {
+ values.add(new StringAttributeValue(stringValue));
+ }
+ });
attribute.setValues(values);
}
@@ -108,14 +114,17 @@ public final class ScopeUtil {
*/
public static void populateScriptedAttribute(@Nonnull final ScriptedIdPAttribute attribute,
@Nullable final ScriptedIdPAttribute source) throws ResolutionException {
- if (source != null && !source.getValues().isEmpty()) {
- source.getValues().forEach(value -> {
- try {
- attribute.addValue(value);
- } catch (final ResolutionException e) {
- log.warn("Resolution exception catched when populating attribute", e);
- }
- });
+ if (source != null) {
+ final Collection<Object> values = source.getValues();
+ if (values != null && !values.isEmpty()) {
+ values.forEach(value -> {
+ try {
+ attribute.addValue(value);
+ } catch (final ResolutionException e) {
+ log.warn("Resolution exception catched when populating attribute", e);
+ }
+ });
+ }
}
}
@@ -151,7 +160,10 @@ public final class ScopeUtil {
if (attribute == null) {
return scope;
}
- attribute.getValues().forEach(value -> scope.add(new Scope.Value((String) value)));
+ final Collection<Object> values = attribute.getValues();
+ if (values != null) {
+ values.forEach(value -> scope.add(new Scope.Value((String) value)));
+ }
return scope;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java
index fb934e18..cf536a28 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java
@@ -72,13 +72,13 @@ public abstract class AbstractAuthorizationRequestLookupFunction<T>
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
- final Object message = input.getInboundMessageContext().getMessage();
+ final Object message = input.ensureInboundMessageContext().getMessage();
if (message == null || !(messageClass.isInstance(message))) {
return null;
}
if (input.getOutboundMessageContext() != null) {
final OIDCAuthenticationResponseContext ctx =
- input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
if (ctx != null) {
requestObject = ctx.getRequestObject();
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenClaimsLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenClaimsLookupFunction.java
index c33e8f64..c1116bc1 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenClaimsLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenClaimsLookupFunction.java
@@ -47,7 +47,7 @@ public abstract class AbstractTokenClaimsLookupFunction<T>
return null;
}
final OIDCAuthenticationResponseContext oidcResponseContext =
- input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
if (oidcResponseContext == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java
index 3e534161..9bec672e 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java
@@ -42,10 +42,10 @@ public abstract class AbstractTokenRequestLookupFunction<T>
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
- final Object message = input.getInboundMessageContext().getMessage();
- if (!(message instanceof TokenRequest)) {
- return null;
+ final Object message = input.ensureInboundMessageContext().getMessage();
+ if (message instanceof TokenRequest tokenRequest) {
+ return doLookup(tokenRequest);
}
- return doLookup((TokenRequest) message);
+ return null;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AccessTokenClaimsSetLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AccessTokenClaimsSetLookupFunction.java
index 473c3aec..db110e6b 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AccessTokenClaimsSetLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AccessTokenClaimsSetLookupFunction.java
@@ -54,7 +54,7 @@ public class AccessTokenClaimsSetLookupFunction
}
final OIDCAuthenticationResponseContext ctx =
- input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
if (ctx == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoAudienceLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoAudienceLookupFunction.java
index 72a7cd3a..569c0cbb 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoAudienceLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoAudienceLookupFunction.java
@@ -20,12 +20,11 @@ import java.util.Collection;
import java.util.Collections;
import java.util.List;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
@@ -34,9 +33,6 @@ import net.shibboleth.shared.primitive.StringSupport;
/** A function that returns {@link OIDCMetadataContext}. */
public class ClientInfoAudienceLookupFunction implements ContextDataLookupFunction<OIDCMetadataContext,List<String>> {
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(ClientInfoAudienceLookupFunction.class);
-
/** Default audience in the absence of metadata. */
@Nullable @NonnullElements private List<String> defaultAudience;
@@ -51,28 +47,30 @@ public class ClientInfoAudienceLookupFunction implements ContextDataLookupFuncti
/** {@inheritDoc} */
@Nullable @NonnullElements public List<String> apply(@Nullable final OIDCMetadataContext input) {
- if (input == null || input.getClientInformation() == null) {
+ if (input == null) {
return defaultAudience;
}
-
- final Object obj = input.getClientInformation().getMetadata().getCustomField("audience");
- if (obj instanceof Collection) {
- final List<String> audience = new ArrayList<>();
-
- for (final Object val: (Collection<?>) obj) {
- if (val instanceof String) {
- audience.add((String) val);
- } else if (val instanceof URI) {
- audience.add(val.toString());
+ final OIDCClientInformation clientInformation = input.getClientInformation();
+ if (clientInformation != null) {
+ final Object obj = clientInformation.getMetadata().getCustomField("audience");
+ if (obj instanceof Collection collection) {
+ final List<String> audience = new ArrayList<>();
+
+ for (final Object val: collection) {
+ if (val instanceof String string) {
+ audience.add(string);
+ } else if (val instanceof URI uri) {
+ audience.add(uri.toString());
+ }
}
+
+ return audience;
+ } else if (obj instanceof String string) {
+ return Collections.singletonList(string);
}
-
- return audience;
- } else if (obj instanceof String) {
- return Collections.singletonList((String) obj);
+ return null;
}
-
- return null;
+ return defaultAudience;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoScopeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoScopeLookupFunction.java
index 756725ea..dc0483ef 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoScopeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ClientInfoScopeLookupFunction.java
@@ -19,6 +19,7 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import com.nimbusds.oauth2.sdk.Scope;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
@@ -49,11 +50,14 @@ public class ClientInfoScopeLookupFunction implements ContextDataLookupFunction<
/** {@inheritDoc} */
@Nullable public Scope apply(@Nullable final OIDCMetadataContext input) {
- if (input == null || input.getClientInformation() == null) {
+ if (input == null) {
return defaultScope;
}
-
- return input.getClientInformation().getMetadata().getScope();
+ final OIDCClientInformation clientInformation = input.getClientInformation();
+ if (clientInformation != null) {
+ return clientInformation.getMetadata().getScope();
+ }
+ return defaultScope;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultComputeAuthorizationCodeHashFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultComputeAuthorizationCodeHashFunction.java
index 8283de7f..6b038aa5 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultComputeAuthorizationCodeHashFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultComputeAuthorizationCodeHashFunction.java
@@ -22,7 +22,6 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.oauth2.sdk.AuthorizationCode;
@@ -34,6 +33,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -107,17 +107,21 @@ public class DefaultComputeAuthorizationCodeHashFunction extends AbstractIdentif
}
final AuthorizationCode code = new AuthorizationCode(rawCode);
final SecurityParametersContext securityParameters = securityParametersLookupStrategy.apply(input);
- if (securityParameters == null || securityParameters.getSignatureSigningParameters() == null) {
+ if (securityParameters == null) {
log.error("Could not resolve security parameters for calculating the code hash value");
return null;
}
final SignatureSigningParameters signingParameters = securityParameters.getSignatureSigningParameters();
- final CodeHash cHash = CodeHash.compute(code, new JWSAlgorithm(signingParameters.getSignatureAlgorithm()),
- null);
- if (cHash == null || cHash.getValue() == null) {
- log.error("Not able to generate c_hash using algorithm {}", signingParameters.getSignatureAlgorithm());
- return null;
+ if (signingParameters != null) {
+ final CodeHash cHash = CodeHash.compute(code, new JWSAlgorithm(signingParameters.getSignatureAlgorithm()),
+ null);
+ if (cHash == null || cHash.getValue() == null) {
+ log.error("Not able to generate c_hash using algorithm {}", signingParameters.getSignatureAlgorithm());
+ return null;
+ }
+ return cHash.getValue();
}
- return cHash.getValue();
+ log.error("Could not resolve security parameters for calculating the code hash value");
+ return null;
}
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction.java
index c13e24e6..6b66185e 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction.java
@@ -34,6 +34,6 @@ public class DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
- return input.getInboundMessageContext().getSubcontext(OIDCClientRegistrationTokenClaimsContext.class);
+ return input.ensureInboundMessageContext().getSubcontext(OIDCClientRegistrationTokenClaimsContext.class);
}
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java
index b70b639c..0b7a0776 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java
@@ -22,10 +22,12 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns resource value of the authorization request.
*
@@ -45,11 +47,12 @@ public class DefaultRequestAudienceLookupFunction extends AbstractAuthorizationR
/** {@inheritDoc} */
@Nullable protected List<String> doLookup(@Nonnull final AuthorizationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("resource") != null) {
- final Object resource = getRequestObject().getJWTClaimsSet().getClaim("resource");
- if (resource instanceof String) {
- return Collections.singletonList((String) resource);
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("resource") != null) {
+ final Object resource = requestObject.getJWTClaimsSet().getClaim("resource");
+ if (resource instanceof String string) {
+ return Collections.singletonList(string);
} else if (resource instanceof List) {
return (List<String>) resource;
} else if (resource != null) {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
index 2c83e58d..4ecd3e94 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
@@ -19,10 +19,12 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns code challenge value of the authorization request via a lookup function. This default lookup
* locates code challenge from OAuth authorization request if available. If information is not available, null is
@@ -36,11 +38,12 @@ public class DefaultRequestCodeChallengeLookupFunction extends AbstractAuthoriza
/** {@inheritDoc} */
@Nullable protected String doLookup(@Nonnull final AuthorizationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("code_challenge") != null) {
- final Object codeChallenge = getRequestObject().getJWTClaimsSet().getClaim("code_challenge");
- if (codeChallenge instanceof String) {
- return (String) codeChallenge;
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("code_challenge") != null) {
+ final Object codeChallenge = requestObject.getJWTClaimsSet().getClaim("code_challenge");
+ if (codeChallenge instanceof String string) {
+ return string;
} else {
log.error("code_challenge claim is not of expected type");
return null;
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
index ac1c2edd..e68e0e55 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
@@ -17,10 +17,12 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns code challenge method value of the authorization request via a lookup function. This default
* lookup locates code challenge method from OAuth authorization request if available. If information is not available,
@@ -37,12 +39,12 @@ public class DefaultRequestCodeChallengeMethodLookupFunction
/** {@inheritDoc} */
@Override
protected String doLookup(@Nonnull final AuthorizationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null &&
- getRequestObject().getJWTClaimsSet().getClaim("code_challenge_method") != null) {
- final Object codeChallenge = getRequestObject().getJWTClaimsSet().getClaim("code_challenge_method");
- if (codeChallenge instanceof String) {
- return (String) codeChallenge;
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("code_challenge_method") != null) {
+ final Object codeChallenge = requestObject.getJWTClaimsSet().getClaim("code_challenge_method");
+ if (codeChallenge instanceof String string) {
+ return string;
} else {
log.error("code_challenge_method claim is not of expected type");
return null;
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java
index 483e32dd..99628838 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java
@@ -17,9 +17,12 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWT;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns request login hint via a lookup function. This default lookup locates hint from oidc
* authentication request if available. If information is not available, null is returned. If there is hint in request
@@ -34,9 +37,10 @@ public class DefaultRequestLoginHintLookupFunction extends AbstractAuthenticatio
/** {@inheritDoc} */
@Override
protected String doLookup(@Nonnull final AuthenticationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("login_hint") != null) {
- final Object hint = getRequestObject().getJWTClaimsSet().getClaim("login_hint");
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("login_hint") != null) {
+ final Object hint = requestObject.getJWTClaimsSet().getClaim("login_hint");
if (hint instanceof String) {
return (String) hint;
} else {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java
index 150e45c7..17892346 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java
@@ -19,9 +19,12 @@ import java.time.Duration;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWT;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns authentication max age parameter the request via a lookup function. This default lookup
* locates max age from oidc authentication request if available. If information is not available, null is returned. If
@@ -36,9 +39,10 @@ public class DefaultRequestMaxAgeLookupFunction extends AbstractAuthenticationRe
/** {@inheritDoc} */
@Override
protected Duration doLookup(@Nonnull final AuthenticationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("max_age") != null) {
- return Duration.ofSeconds(getRequestObject().getJWTClaimsSet().getIntegerClaim("max_age"));
+ if (requestObject != null && requestObject.getJWTClaimsSet().getIntegerClaim("max_age") != null) {
+ return Duration.ofSeconds(requestObject.getJWTClaimsSet().getIntegerClaim("max_age"));
}
} catch (final ParseException e) {
log.error("Unable to parse state from request object state value");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java
index bcf9bae6..e7fb2d28 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java
@@ -17,10 +17,13 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWT;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.Nonce;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns copy of Nonce via a lookup function. This default lookup locates nonce from oidc
* authentication request if available. If information is not available, null is returned. If there is nonce in request
@@ -35,11 +38,12 @@ public class DefaultRequestNonceLookupFunction extends AbstractAuthenticationReq
/** {@inheritDoc} */
@Override
protected Nonce doLookup(@Nonnull final AuthenticationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("nonce") != null) {
- final Object nonce = getRequestObject().getJWTClaimsSet().getClaim("nonce");
- if (nonce instanceof String) {
- return new Nonce((String) nonce);
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("nonce") != null) {
+ final Object nonce = requestObject.getJWTClaimsSet().getClaim("nonce");
+ if (nonce instanceof String string) {
+ return new Nonce(string);
} else {
log.error("nonce claim is not of expected type");
return null;
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java
index 7091e30b..d252849a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java
@@ -19,10 +19,12 @@ import java.net.URISyntaxException;
import java.text.ParseException;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns redirect uri of the authentication request via a lookup function. This default lookup locates
* redirect uri from OAuth authorization request if available. If information is not available, null is returned. If
@@ -37,9 +39,10 @@ public class DefaultRequestRedirectURILookupFunction extends AbstractAuthorizati
/** {@inheritDoc} */
@Override
protected URI doLookup(@Nonnull final AuthorizationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("redirect_uri") != null) {
- final Object redirect = getRequestObject().getJWTClaimsSet().getClaim("redirect_uri");
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("redirect_uri") != null) {
+ final Object redirect = requestObject.getJWTClaimsSet().getClaim("redirect_uri");
if (redirect instanceof String) {
return new URI((String)redirect);
} else {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java
index 691b854b..3083bf8c 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java
@@ -18,11 +18,13 @@ import java.text.ParseException;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseMode;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns copy of the response mode of the request via a lookup function. This default lookup locates
* response mode from OAuth authorization request if available. If information is not available, null is returned. If
@@ -38,9 +40,10 @@ public class DefaultRequestResponseModeLookupFunction
/** {@inheritDoc} */
@Override
protected ResponseMode doLookup(@Nonnull final AuthorizationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("response_mode") != null) {
- final Object rMode = getRequestObject().getJWTClaimsSet().getClaim("response_mode");
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("response_mode") != null) {
+ final Object rMode = requestObject.getJWTClaimsSet().getClaim("response_mode");
if (rMode instanceof String) {
return new ResponseMode((String) rMode);
} else {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java
index 70729baf..5b05ab29 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java
@@ -17,11 +17,13 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseType;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns copy of response type via a lookup function. This default lookup locates response type from
* OAuth authorization request if available. If information is not available, null is returned. If there is response
@@ -37,9 +39,10 @@ public class DefaultRequestResponseTypeLookupFunction
/** {@inheritDoc} */
@Override
protected ResponseType doLookup(@Nonnull final AuthorizationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("response_type") != null) {
- return ResponseType.parse((String) getRequestObject().getJWTClaimsSet().getClaim("response_type"));
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("response_type") != null) {
+ return ResponseType.parse((String) requestObject.getJWTClaimsSet().getClaim("response_type"));
}
} catch (final ParseException | com.nimbusds.oauth2.sdk.ParseException e) {
log.error("Unable to parse response type from request object response_type value {}", e.getMessage());
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java
index a23a6c63..36eb00bc 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java
@@ -17,11 +17,13 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.id.State;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns copy of the state the request via a lookup function. This default lookup locates state from
* OAuth authorization request if available. If information is not available, null is returned. If there is state in
@@ -36,11 +38,12 @@ public class DefaultRequestStateLookupFunction extends AbstractAuthorizationRequ
/** {@inheritDoc} */
@Override
protected State doLookup(@Nonnull final AuthorizationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("state") != null) {
- final Object state = getRequestObject().getJWTClaimsSet().getClaim("state");
- if (state instanceof String) {
- return new State((String) state);
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("state") != null) {
+ final Object state = requestObject.getJWTClaimsSet().getClaim("state");
+ if (state instanceof String string) {
+ return new State(string);
} else {
log.error("state claim is not of expected type");
return null;
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java
index 6fdc1aa3..2fcbd20c 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java
@@ -19,10 +19,13 @@ import java.util.ArrayList;
import java.util.List;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWT;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.claims.ACR;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns copy of requested acr values via a lookup function. This default lookup locates acr values
* from oidc authentication request if available. If information is not available, null is returned. If there are acr
@@ -37,10 +40,11 @@ public class DefaultRequestedAcrLookupFunction extends AbstractAuthenticationReq
/** {@inheritDoc} */
@Override
protected List<ACR> doLookup(@Nonnull final AuthenticationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("acr_values") != null) {
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("acr_values") != null) {
final List<ACR> reqObjectAcr = new ArrayList<ACR>();
- final String[] acrs = ((String) getRequestObject().getJWTClaimsSet().getClaim("acr_values")).split(" ");
+ final String[] acrs = ((String) requestObject.getJWTClaimsSet().getClaim("acr_values")).split(" ");
for (final String acr : acrs) {
reqObjectAcr.add(new ACR(acr));
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
index 1c8c2101..a4b5969b 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
@@ -19,11 +19,13 @@ import java.util.Map;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWT;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
import net.minidev.json.JSONObject;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns copy of requested claims via a lookup function. This default lookup locates requested claims
@@ -41,9 +43,10 @@ public class DefaultRequestedClaimsLookupFunction
@SuppressWarnings("unchecked")
@Override
protected OIDCClaimsRequest doLookup(@Nonnull final AuthenticationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("claims") != null) {
- final Object claims = getRequestObject().getJWTClaimsSet().getClaim("claims");
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("claims") != null) {
+ final Object claims = requestObject.getJWTClaimsSet().getClaim("claims");
if (claims instanceof Map) {
log.debug("claims claim is a map, converting it into a JSONObject");
// the casting is safe as Nimbus shouldn't allow other than String-keyed maps to exist here
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java
index a8445146..0edf0e53 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java
@@ -17,11 +17,13 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.openid.connect.sdk.Prompt;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns copy of requested prompt via a lookup function. This default lookup locates prompt from OAuth
* authorization request if available. If information is not available, null is returned. If there is prompt in request
@@ -36,9 +38,10 @@ public class DefaultRequestedPromptLookupFunction extends AbstractAuthorizationR
/** {@inheritDoc} */
@Override
protected Prompt doLookup(@Nonnull final AuthorizationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("prompt") != null) {
- return Prompt.parse((String) getRequestObject().getJWTClaimsSet().getClaim("prompt"));
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("prompt") != null) {
+ return Prompt.parse((String) requestObject.getJWTClaimsSet().getClaim("prompt"));
}
} catch (final ParseException | com.nimbusds.oauth2.sdk.ParseException e) {
log.error("Unable to parse prompt from request object prompt value");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java
index e0e24a05..57d2d298 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java
@@ -17,11 +17,13 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.Scope;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns copy of requested scopes via a lookup function. This default lookup locates scope from OAuth
* authorization request if available. If information is not available, null is returned. If there is scope in request
@@ -36,9 +38,10 @@ public class DefaultRequestedScopeLookupFunction extends AbstractAuthorizationRe
/** {@inheritDoc} */
@Override
protected Scope doLookup(@Nonnull final AuthorizationRequest req) {
+ final JWT requestObject = getRequestObject();
try {
- if (getRequestObject() != null && getRequestObject().getJWTClaimsSet().getClaim("scope") != null) {
- return Scope.parse((String) getRequestObject().getJWTClaimsSet().getClaim("scope"));
+ if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("scope") != null) {
+ return Scope.parse((String) requestObject.getJWTClaimsSet().getClaim("scope"));
}
} catch (final ParseException e) {
log.error("Unable to parse scope from request object scope value");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultResponseClaimsSetLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultResponseClaimsSetLookupFunction.java
index 6d04beb7..7434d8e3 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultResponseClaimsSetLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultResponseClaimsSetLookupFunction.java
@@ -33,7 +33,7 @@ public class DefaultResponseClaimsSetLookupFunction
return null;
}
final OIDCAuthenticationResponseContext ctx =
- input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
if (ctx == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultUserInfoSigningAlgLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultUserInfoSigningAlgLookupFunction.java
index e521a6c0..0c2a7ab9 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultUserInfoSigningAlgLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultUserInfoSigningAlgLookupFunction.java
@@ -20,6 +20,7 @@ import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
@@ -33,11 +34,15 @@ public class DefaultUserInfoSigningAlgLookupFunction
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
- final OIDCMetadataContext ctx = input.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
- if (ctx == null || ctx.getClientInformation() == null || ctx.getClientInformation().getOIDCMetadata() == null) {
+ final OIDCMetadataContext ctx = input.ensureInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
+ if (ctx == null) {
return null;
}
- return ctx.getClientInformation().getOIDCMetadata().getUserInfoJWSAlg();
+ final OIDCClientInformation clientInformation = ctx.getClientInformation();
+ if (clientInformation != null && clientInformation.getOIDCMetadata() != null) {
+ return clientInformation.getOIDCMetadata().getUserInfoJWSAlg();
+ }
+ return null;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidPostLogoutRedirectUrisLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidPostLogoutRedirectUrisLookupFunction.java
index 4c035d1f..3c92a8e2 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidPostLogoutRedirectUrisLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidPostLogoutRedirectUrisLookupFunction.java
@@ -22,6 +22,8 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
/**
@@ -38,11 +40,15 @@ public class DefaultValidPostLogoutRedirectUrisLookupFunction
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
- final OIDCMetadataContext ctx = input.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
- if (ctx == null || ctx.getClientInformation() == null || ctx.getClientInformation().getOIDCMetadata() == null) {
+ final OIDCMetadataContext ctx = input.ensureInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
+ if (ctx == null) {
return null;
}
- return ctx.getClientInformation().getOIDCMetadata().getPostLogoutRedirectionURIs();
+ final OIDCClientInformation clientInformation = ctx.getClientInformation();
+ if (clientInformation != null && clientInformation.getOIDCMetadata() != null) {
+ return clientInformation.getOIDCMetadata().getPostLogoutRedirectionURIs();
+ }
+ return null;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidRedirectUrisLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidRedirectUrisLookupFunction.java
index 8ce26ac1..9eaf3243 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidRedirectUrisLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidRedirectUrisLookupFunction.java
@@ -22,6 +22,8 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
/** A function that returns registered redirection uris from metadata. */
@@ -34,11 +36,14 @@ public class DefaultValidRedirectUrisLookupFunction
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
- final OIDCMetadataContext ctx = input.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
- if (ctx == null || ctx.getClientInformation() == null || ctx.getClientInformation().getMetadata() == null) {
+ final OIDCMetadataContext ctx = input.ensureInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
+ if (ctx == null) {
return null;
}
- return ctx.getClientInformation().getMetadata().getRedirectionURIs();
+ final OIDCClientInformation clientInformation = ctx.getClientInformation();
+ if (clientInformation != null && clientInformation.getMetadata() != null) {
+ return clientInformation.getMetadata().getRedirectionURIs();
+ }
+ return null;
}
-
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java
index 578df169..bec75af1 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java
@@ -17,8 +17,6 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import java.util.Set;
import javax.annotation.Nonnull;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseType;
@@ -34,10 +32,6 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
public class DefaultValidResponseTypesLookupFunction
extends AbstractAuthorizationRequestLookupFunction<Set<ResponseType>> {
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(DefaultValidResponseTypesLookupFunction.class);
-
/** {@inheritDoc} */
@Override
protected Set<ResponseType> doLookup(@Nonnull final AuthorizationRequest req) {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/JWTAccessTokenUpdateStrategy.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/JWTAccessTokenUpdateStrategy.java
index 0a24f2ce..29f8ab3e 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/JWTAccessTokenUpdateStrategy.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/JWTAccessTokenUpdateStrategy.java
@@ -42,8 +42,11 @@ public class JWTAccessTokenUpdateStrategy implements BiConsumer<JWT, MessageCont
*/
public JWTAccessTokenUpdateStrategy() {
// message context -> OIDC response context -> ATC
- accessTokenContextLookupStrategy = new ChildContextLookup<>(AccessTokenContext.class).compose(
- new ChildContextLookup<>(OIDCAuthenticationResponseContext.class));
+ final Function<MessageContext,AccessTokenContext> atcls =
+ new ChildContextLookup<>(AccessTokenContext.class).compose(
+ new ChildContextLookup<>(OIDCAuthenticationResponseContext.class));
+ assert atcls != null;
+ accessTokenContextLookupStrategy = atcls;
}
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/LogoutRequestClientIDLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/LogoutRequestClientIDLookupFunction.java
index 5e80f4c8..6a5ccbcd 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/LogoutRequestClientIDLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/LogoutRequestClientIDLookupFunction.java
@@ -23,7 +23,6 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.EncryptedJWT;
import com.nimbusds.jwt.JWT;
@@ -31,6 +30,8 @@ import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.openid.connect.sdk.LogoutRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* A function that returns client id of the OIDC logout request. This lookup locates client id from then request if
* available from the client_id parameter or in the audience of the ID token hint. If multiple audiences exist, the
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/MetadataStatementsLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/MetadataStatementsLookupFunction.java
index a75b453d..76b95814 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/MetadataStatementsLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/MetadataStatementsLookupFunction.java
@@ -25,7 +25,6 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
@@ -33,6 +32,7 @@ import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.OIDCClientRegistrationRequestMetadataLookupFunction;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns metadata_statements (oidcfed) obtained via a lookup function.
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCAuthenticationResponseContextLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCAuthenticationResponseContextLookupFunction.java
index fc7e4624..a3ef80b7 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCAuthenticationResponseContextLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCAuthenticationResponseContextLookupFunction.java
@@ -34,7 +34,7 @@ public class OIDCAuthenticationResponseContextLookupFunction
if (input == null || input.getOutboundMessageContext() == null) {
return null;
}
- return input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ return input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
}
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCRPSessionClientIDLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCRPSessionClientIDLookupFunction.java
index 33299b2a..deee34d4 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCRPSessionClientIDLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCRPSessionClientIDLookupFunction.java
@@ -17,15 +17,16 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.messaging.context.BaseContext;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.ClientID;
import net.shibboleth.idp.plugin.oidc.op.session.OIDCRPSession;
import net.shibboleth.idp.session.context.LogoutPropagationContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A lookup function that fetches {@link ClientID} value from the {@link OIDCRPSession} found from the session stored in
@@ -44,12 +45,13 @@ public class OIDCRPSessionClientIDLookupFunction implements ContextDataLookupFun
log.warn("MessageContext cannot be null, return null for ClientID.");
return null;
}
- if (messageContext.getParent() == null) {
+ final BaseContext parentContext = messageContext.getParent();
+ if (parentContext == null) {
log.warn("ProfileRequestContext cannot be null, return null for ClientID.");
return null;
}
final LogoutPropagationContext logoutPropagationContext =
- messageContext.getParent().getSubcontext(LogoutPropagationContext.class);
+ parentContext.getSubcontext(LogoutPropagationContext.class);
if (logoutPropagationContext == null) {
log.warn("LogoutPropagationContext cannot be null, return null for ClientID.");
return null;
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCRegistrationResponseContextLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCRegistrationResponseContextLookupFunction.java
index 09402dcc..4f8287c3 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCRegistrationResponseContextLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/OIDCRegistrationResponseContextLookupFunction.java
@@ -34,7 +34,7 @@ public class OIDCRegistrationResponseContextLookupFunction
if (input == null || input.getOutboundMessageContext() == null) {
return null;
}
- return input.getOutboundMessageContext().getSubcontext(OIDCClientRegistrationResponseContext.class);
+ return input.ensureOutboundMessageContext().getSubcontext(OIDCClientRegistrationResponseContext.class);
}
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedIdTokenHintUpdateStrategy.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedIdTokenHintUpdateStrategy.java
index ec485c08..4f2d3b36 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedIdTokenHintUpdateStrategy.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedIdTokenHintUpdateStrategy.java
@@ -34,14 +34,14 @@ public class ProcessedIdTokenHintUpdateStrategy implements BiConsumer<ProfileReq
/** {@inheritDoc} */
@Override
public void accept(@Nullable final ProfileRequestContext profileRequestContext, @Nullable final JWT jwt) {
- if (profileRequestContext == null || profileRequestContext.getOutboundMessageContext() == null
- || profileRequestContext.getOutboundMessageContext().getSubcontext(
- OIDCRpInitiatedLogoutContext.class) == null) {
+ if (profileRequestContext == null || profileRequestContext.getOutboundMessageContext() == null) {
return;
}
final OIDCRpInitiatedLogoutContext oidcResponseCtx = profileRequestContext
- .getOutboundMessageContext()
+ .ensureOutboundMessageContext()
.getSubcontext(OIDCRpInitiatedLogoutContext.class);
- oidcResponseCtx.setProcessedIdTokenHint(jwt);
+ if (oidcResponseCtx != null) {
+ oidcResponseCtx.setProcessedIdTokenHint(jwt);
+ }
}
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedTokenUpdateStrategy.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedTokenUpdateStrategy.java
index c6bed592..2db14a68 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedTokenUpdateStrategy.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProcessedTokenUpdateStrategy.java
@@ -32,11 +32,13 @@ public class ProcessedTokenUpdateStrategy implements BiConsumer<JWT, MessageCont
/** {@inheritDoc} */
@Override
public void accept(final JWT jwt, final MessageContext messageContext) {
- if (messageContext == null || messageContext.getSubcontext(OIDCAuthenticationResponseContext.class) == null) {
+ if (messageContext == null) {
return;
}
final OIDCAuthenticationResponseContext oidcResponseCtx =
messageContext.getSubcontext(OIDCAuthenticationResponseContext.class);
- oidcResponseCtx.setProcessedToken(jwt);
+ if (oidcResponseCtx != null) {
+ oidcResponseCtx.setProcessedToken(jwt);
+ }
}
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProfileResponderIdLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProfileResponderIdLookupFunction.java
index c620cd54..e2e0481c 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProfileResponderIdLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ProfileResponderIdLookupFunction.java
@@ -21,25 +21,20 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/** A function that returns responder id based on profile. */
public class ProfileResponderIdLookupFunction extends AbstractIdentifiableInitializableComponent
implements ContextDataLookupFunction<ProfileRequestContext, String> {
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(ProfileResponderIdLookupFunction.class);
-
/** Default responder value, usually entity id. */
- @Nonnull
+ @NonnullAfterInit
private String defaultResponder;
/** Mapping from profile id to responder value. */
@@ -84,7 +79,7 @@ public class ProfileResponderIdLookupFunction extends AbstractIdentifiableInitia
/** {@inheritDoc} */
@Nullable
public String apply(@Nullable final ProfileRequestContext input) {
- if (profileResponders.containsKey(input.getProfileId())) {
+ if (input != null && profileResponders.containsKey(input.getProfileId())) {
return profileResponders.get(input.getProfileId());
}
return defaultResponder;
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/RequestObjectUpdateStrategy.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/RequestObjectUpdateStrategy.java
index 05adbb7f..0c73d48a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/RequestObjectUpdateStrategy.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/RequestObjectUpdateStrategy.java
@@ -34,14 +34,14 @@ public class RequestObjectUpdateStrategy implements BiConsumer<ProfileRequestCon
/** {@inheritDoc} */
@Override
public void accept(@Nullable final ProfileRequestContext profileRequestContext, @Nullable final JWT jwt) {
- if (profileRequestContext == null || profileRequestContext.getOutboundMessageContext() == null
- || profileRequestContext.getOutboundMessageContext().getSubcontext(
- OIDCAuthenticationResponseContext.class) == null) {
+ if (profileRequestContext == null || profileRequestContext.getOutboundMessageContext() == null) {
return;
}
final OIDCAuthenticationResponseContext oidcResponseCtx = profileRequestContext
- .getOutboundMessageContext()
+ .ensureOutboundMessageContext()
.getSubcontext(OIDCAuthenticationResponseContext.class);
- oidcResponseCtx.setRequestObject(jwt);
+ if (oidcResponseCtx != null) {
+ oidcResponseCtx.setRequestObject(jwt);
+ }
}
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ResponseContextAuthorizationCodeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ResponseContextAuthorizationCodeLookupFunction.java
index 63e26a10..d90f19a4 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ResponseContextAuthorizationCodeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ResponseContextAuthorizationCodeLookupFunction.java
@@ -19,6 +19,8 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.oauth2.sdk.AuthorizationCode;
+
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
/**
@@ -37,11 +39,14 @@ public class ResponseContextAuthorizationCodeLookupFunction implements
return null;
}
final OIDCAuthenticationResponseContext ctx =
- input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
- if (ctx == null || ctx.getAuthorizationCode() == null) {
- return null;
+ input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ if (ctx != null) {
+ final AuthorizationCode code = ctx.getAuthorizationCode();
+ if (code != null) {
+ return code.getValue();
+ }
}
- return ctx.getAuthorizationCode().getValue();
+ return null;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/SectorIdentifierLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/SectorIdentifierLookupFunction.java
index 3480136d..89721594 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/SectorIdentifierLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/SectorIdentifierLookupFunction.java
@@ -25,11 +25,14 @@ import javax.annotation.Nullable;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
/**
* A function that returns sector identifier obtained via a lookup function.
@@ -78,18 +81,25 @@ public class SectorIdentifierLookupFunction extends AbstractIdentifiableInitiali
return null;
}
final OIDCMetadataContext ctx = oidcMetadataContextLookupStrategy.apply(input);
- if (ctx == null || ctx.getClientInformation() == null || ctx.getClientInformation().getOIDCMetadata() == null) {
+ if (ctx == null) {
+ log.warn("OIDC metadata not available, no sector identifier can be resolved");
+ return null;
+ }
+ final OIDCClientInformation clientInformation = ctx.getClientInformation();
+ if (clientInformation == null || clientInformation.getOIDCMetadata() == null) {
log.warn("OIDC metadata not available, no sector identifier can be resolved");
return null;
- } else if (ctx.getClientInformation().getOIDCMetadata().getSectorIDURI() != null) {
- final String sectorIdentifier = ctx.getClientInformation().getOIDCMetadata().getSectorIDURI().getHost();
+ }
+ final OIDCClientMetadata clientMetadata = clientInformation.getOIDCMetadata();
+ if (clientMetadata.getSectorIDURI() != null) {
+ final String sectorIdentifier = clientMetadata.getSectorIDURI().getHost();
log.debug("Sector identifier resolved by registered sector uri {}", sectorIdentifier);
return sectorIdentifier;
- } else if (ctx.getClientInformation().getOIDCMetadata().getRedirectionURIs() == null) {
+ } else if (clientMetadata.getRedirectionURIs() == null) {
log.warn("Redirection uri not available, unable to determine sector identifier");
return null;
}
- final Set<String> hosts = ctx.getClientInformation().getOIDCMetadata().getRedirectionURIs().stream()
+ final Set<String> hosts = clientMetadata.getRedirectionURIs().stream()
.map(URI::getHost).collect(Collectors.toSet());
if (hosts.size() > 1) {
log.warn("Multiple hosts found from the redirection uris but no registered sector uri");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java
index 5fe3ebbe..625b6e1a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java
@@ -21,10 +21,11 @@ import java.util.List;
import javax.annotation.Nonnull;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.TokenRequest;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* For Token endpoint.
*
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestSubjectLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestSubjectLookupFunction.java
index f80a2dcf..33b8d800 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestSubjectLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestSubjectLookupFunction.java
@@ -16,6 +16,8 @@ package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
import javax.annotation.Nonnull;
+import com.nimbusds.jwt.JWTClaimsSet;
+
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
/**
@@ -29,7 +31,8 @@ public class TokenRequestSubjectLookupFunction extends AbstractTokenClaimsLookup
/** {@inheritDoc} */
@Override
String doLookup(@Nonnull final TokenClaimsSet tokenClaims) {
- return tokenClaims.getClaimsSet().getSubject();
+ final JWTClaimsSet claimsSet = tokenClaims.getClaimsSet();
+ return claimsSet != null ? claimsSet.getSubject() : null;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestTokenClaimsSetLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestTokenClaimsSetLookupFunction.java
index 0c188a3e..bdadbf6a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestTokenClaimsSetLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestTokenClaimsSetLookupFunction.java
@@ -22,6 +22,8 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.jwt.JWTClaimsSet;
+
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
/**
@@ -32,14 +34,15 @@ public class TokenRequestTokenClaimsSetLookupFunction implements BiFunction<Prof
/** {@inheritDoc} */
@Override
- @Nullable public Object apply(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final String claim) {
+ @Nullable public Object apply(@Nullable final ProfileRequestContext profileRequestContext,
+ @Nullable final String claim) {
final Function<ProfileRequestContext, Object> claimsSetLookup =
new AbstractTokenClaimsLookupFunction<Object>() {
@Override
Object doLookup(final @Nonnull TokenClaimsSet tokenClaims) {
- return tokenClaims.getClaimsSet().getClaim(claim);
+ final JWTClaimsSet claimsSet = tokenClaims.getClaimsSet();
+ return claimsSet != null ? claimsSet.getClaim(claim) : null;
}
};
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoRequestClientIDLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoRequestClientIDLookupFunction.java
index ea4a6b92..687bf063 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoRequestClientIDLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoRequestClientIDLookupFunction.java
@@ -14,18 +14,16 @@
package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.ClientID;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
/**
* For UserInfo end point.
@@ -35,28 +33,24 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationRes
*/
public class UserInfoRequestClientIDLookupFunction implements ContextDataLookupFunction<MessageContext, ClientID> {
- /** Logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(UserInfoRequestClientIDLookupFunction.class);
-
/** {@inheritDoc} */
@Nullable
public ClientID apply(@Nullable final MessageContext input) {
if (input == null) {
return null;
}
- if (!(input.getParent() instanceof ProfileRequestContext)) {
- return null;
- }
- final MessageContext msgCtx = ((ProfileRequestContext) input.getParent()).getOutboundMessageContext();
- if (msgCtx == null) {
- return null;
- }
- final OIDCAuthenticationResponseContext ctx = msgCtx.getSubcontext(OIDCAuthenticationResponseContext.class);
- if (ctx == null || ctx.getAuthorizationGrantClaimsSet() == null) {
- return null;
+ if (input.getParent() instanceof ProfileRequestContext profileRequestContext) {
+ final MessageContext msgCtx = profileRequestContext.getOutboundMessageContext();
+ if (msgCtx == null) {
+ return null;
+ }
+ final OIDCAuthenticationResponseContext ctx = msgCtx.getSubcontext(OIDCAuthenticationResponseContext.class);
+ if (ctx != null) {
+ final TokenClaimsSet claimsSet = ctx.getAuthorizationGrantClaimsSet();
+ return claimsSet != null ? claimsSet.getClientID() : null;
+ }
}
- return ctx.getAuthorizationGrantClaimsSet().getClientID();
+ return null;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoResponseClaimsSetLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoResponseClaimsSetLookupFunction.java
index 5e55ba21..8dba8497 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoResponseClaimsSetLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/UserInfoResponseClaimsSetLookupFunction.java
@@ -33,7 +33,7 @@ public class UserInfoResponseClaimsSetLookupFunction
return null;
}
final OIDCAuthenticationResponseContext ctx =
- input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
if (ctx == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedAudienceLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedAudienceLookupFunction.java
index a2000155..df9ff2cf 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedAudienceLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedAudienceLookupFunction.java
@@ -34,7 +34,7 @@ public class ValidatedAudienceLookupFunction
return null;
}
final OIDCAuthenticationResponseContext ctx =
- input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
if (ctx == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedRedirectURILookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedRedirectURILookupFunction.java
index 01e98306..28c3af29 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedRedirectURILookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedRedirectURILookupFunction.java
@@ -33,7 +33,7 @@ public class ValidatedRedirectURILookupFunction implements ContextDataLookupFunc
return null;
}
final OIDCAuthenticationResponseContext ctx =
- input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
if (ctx == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedScopeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedScopeLookupFunction.java
index d0984665..d67566a7 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedScopeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/ValidatedScopeLookupFunction.java
@@ -34,7 +34,7 @@ public class ValidatedScopeLookupFunction
return null;
}
final OIDCAuthenticationResponseContext ctx =
- input.getOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
+ input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
if (ctx == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/OIDCRPSession.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/OIDCRPSession.java
index 7021a0f8..9aff09ce 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/OIDCRPSession.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/OIDCRPSession.java
@@ -97,7 +97,7 @@ public class OIDCRPSession extends BasicSPSession implements SPSession {
*
* @return the root token identifier
*/
- @Nonnull @NotEmpty public String getRootTokenIdentifier() {
+ @Nullable @NotEmpty public String getRootTokenIdentifier() {
return rootTokenIdentifier;
}
@@ -254,6 +254,18 @@ public class OIDCRPSession extends BasicSPSession implements SPSession {
* @return the newly built object
*/
public OIDCRPSession build() {
+ Constraint.isNotEmpty(serviceId, "The serviceId value cannot be empty");
+ Constraint.isNotNull(creationInstant, "The creationInstant value cannot be null");
+ Constraint.isNotNull(expirationInstant, "The expirationInstant value cannot be null");
+ Constraint.isNotEmpty(issuer, "The issuer value cannot be empty");
+ Constraint.isNotEmpty(sessionIdentifier, "The session identifier cannot be empty");
+ Constraint.isNotEmpty(subject, "The subject value cannot be empty");
+ assert serviceId != null;
+ assert creationInstant != null;
+ assert expirationInstant != null;
+ assert issuer != null;
+ assert sessionIdentifier != null;
+ assert subject != null;
return new OIDCRPSession(serviceId, creationInstant, expirationInstant, issuer, rootTokenIdentifier,
sessionIdentifier, subject, supportsLogoutPropagation);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list