[java-idp-oidc] branch main updated: Null cleanup for remaining parts of the main code.
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Mar 28 15:54:07 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=bd1deb6294a9ae0c11663e3aecb6d886ced5be13
The following commit(s) were added to refs/heads/main by this push:
new bd1deb62 Null cleanup for remaining parts of the main code.
bd1deb62 is described below
commit bd1deb6294a9ae0c11663e3aecb6d886ced5be13
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Mar 28 17:53:28 2024 +0200
Null cleanup for remaining parts of the main code.
---
.../idp/plugin/oidc/op/session/OIDCRPSession.java | 4 +-
.../impl/ExecuteBackChannelLogoutRequest.java | 12 ++-
.../impl/FormOutboundLogoutRequestMessage.java | 6 +-
.../op/oauth2/profile/impl/BuildAccessToken.java | 5 +-
.../impl/SetAccessTokenToResponseContext.java | 5 +-
.../op/oauth2/profile/impl/ValidateAudience.java | 3 +-
.../impl/AbstractBuildErrorResponseFromEvent.java | 18 ++--
...ctInitializeOutboundResponseMessageContext.java | 2 +-
.../AbstractOIDCAuthenticationRequestAction.java | 7 --
.../AbstractOIDCAuthenticationResponseAction.java | 14 ++--
...AbstractOIDCClientMetadataPopulationAction.java | 2 +-
.../op/profile/impl/AbstractOIDCRequestAction.java | 4 +-
.../profile/impl/AbstractOIDCResponseAction.java | 27 +++---
.../impl/AbstractOIDCSigningResponseAction.java | 16 +++-
.../impl/AbstractOIDCTokenResponseAction.java | 16 ++--
.../profile/impl/AddAccessTokenHashToIDToken.java | 26 ++++--
.../oidc/op/profile/impl/AddAcrToIDToken.java | 20 +++--
.../impl/AddApplicationTypeToClientMetadata.java | 2 +-
.../op/profile/impl/AddAttributesToClaimsSet.java | 48 ++++++++---
.../oidc/op/profile/impl/AddAuthTimeToIDToken.java | 23 +++--
.../impl/AddAuthorizationCodeHashToIDToken.java | 14 ++--
.../impl/AddClientNameToClientMetadata.java | 2 +-
.../profile/impl/AddContactsToClientMetadata.java | 3 +-
.../profile/impl/AddGrantTypeToClientMetadata.java | 5 +-
.../oidc/op/profile/impl/AddIDTokenShell.java | 20 ++---
.../op/profile/impl/AddJwksToClientMetadata.java | 6 +-
.../profile/impl/AddLogoUrisToClientMetadata.java | 3 +-
.../impl/AddMetadataStatementToClientMetadata.java | 2 +-
.../oidc/op/profile/impl/AddNonceToIDToken.java | 17 ++--
.../impl/AddPolicyUrisToClientMetadata.java | 3 +-
.../impl/AddRedirectUrisToClientMetadata.java | 6 --
.../impl/AddRemainingClaimsToClientMetadata.java | 14 ++--
...bjectSecurityConfigurationToClientMetadata.java | 71 ++++++++++------
.../impl/AddRequestUrisToClientMetadata.java | 6 --
.../impl/AddResponseTypesToClientMetadata.java | 2 +-
.../op/profile/impl/AddScopeToClientMetadata.java | 2 +-
.../AddSecurityConfigurationToClientMetadata.java | 97 +++++++++++++---------
.../impl/AddSubjectTypeToClientMetadata.java | 2 +-
.../AddTokenDeliveryAttributesToClaimsSet.java | 28 +++++--
...ddTokenEndpointAuthMethodsToClientMetadata.java | 3 +-
.../profile/impl/AddTosUrisToClientMetadata.java | 3 +-
.../BuildAuthenticationErrorResponseFromEvent.java | 2 +-
.../op/profile/impl/BuildClientInformation.java | 2 +-
.../oidc/op/profile/impl/CheckRedirectURIs.java | 11 ++-
.../FormOutboundAuthenticationResponseMessage.java | 21 +++--
.../impl/FormOutboundDiscoveryResponse.java | 10 ++-
.../impl/FormOutboundTokenResponseMessage.java | 22 +++--
.../oidc/op/profile/impl/GenerateClientID.java | 19 +++--
.../oidc/op/profile/impl/GenerateClientSecret.java | 5 +-
.../impl/InitializeAuthenticationContext.java | 2 +-
...tboundAuthenticationResponseMessageContext.java | 35 +++++---
...OutboundRegistrationResponseMessageContext.java | 2 +-
.../InitializeOutboundResponseMessageContext.java | 2 +-
...nitializeRegistrationMetadataPolicyContext.java | 13 +--
.../impl/InitializeRelyingPartyContext.java | 23 +++--
.../op/profile/impl/InitializeSubjectContext.java | 16 +++-
.../InitializeUnverifiedRelyingPartyContext.java | 2 +-
.../profile/impl/ManipulateClaimsForIDToken.java | 11 ++-
.../op/profile/impl/OIDCMetadataLookupHandler.java | 2 +-
.../profile/impl/ProcessRequestedAuthnContext.java | 38 ++++++---
...assReferenceFromAuthzCodeToResponseContext.java | 13 ++-
...tionContextClassReferenceToResponseContext.java | 61 +++++++-------
.../SetAuthenticationTimeToResponseContext.java | 6 +-
.../impl/SetConsentFromTokenToResponseContext.java | 9 +-
.../profile/impl/SetConsentToResponseContext.java | 18 ++--
.../impl/SetRefreshTokenToResponseContext.java | 75 +++++++++++------
.../impl/SetRequestedClaimsToResponseContext.java | 21 +++--
.../impl/SetRequestedSubjectToResponseContext.java | 38 ++++++---
.../impl/SetResponseStatusCodeFromEvent.java | 27 ++++--
.../SetSectorIdentifierForAttributeResolution.java | 2 +-
.../impl/SetSessionIdToResponseContext.java | 6 +-
.../profile/impl/SetSubjectToResponseContext.java | 14 ++--
...liveryAttributesFromTokenToResponseContext.java | 31 ++++---
...etTokenDeliveryAttributesToResponseContext.java | 42 ++++++----
.../op/profile/impl/StoreClientInformation.java | 50 +++++------
.../plugin/oidc/op/profile/impl/ValidateGrant.java | 52 ++++++++----
.../oidc/op/profile/impl/ValidateGrantType.java | 21 +++--
.../plugin/oidc/op/profile/impl/ValidatePKCE.java | 38 +++++----
.../impl/ValidateRegistrationAccessToken.java | 12 ++-
.../impl/ValidateRegistrationRequestMetadata.java | 26 ++++--
.../impl/VerifyRequestedSubjectIdentifier.java | 10 ++-
...uteConsentEnabledInTokenClaimsSetPredicate.java | 11 ++-
.../AttributeResolutionSubjectLookupFunction.java | 9 +-
...AuthorizationRequestTypeValidationStrategy.java | 10 ++-
...faultChainRevocationLifetimeLookupStrategy.java | 10 ++-
...efaultMetadataPolicyCriteriaLookupFunction.java | 5 +-
.../DefaultMetadataPolicyMergingStrategy.java | 2 +-
.../DefaultRootTokenIdentifierLookupStrategy.java | 2 +-
.../profile/logic/DefaultSubjectTypeStrategy.java | 14 ++--
...faultTokenRevocationLifetimeLookupStrategy.java | 10 ++-
.../DefaultUnregisteredClientPolicyValidator.java | 22 +++--
...egisteredClientResponseTypesLookupFunction.java | 8 +-
.../logic/MetadataValueEqualsCondition.java | 13 ++-
.../profile/logic/SubjectActivationCondition.java | 3 +
.../ProviderMetadataResolverServiceStrategy.java | 7 +-
.../claims/impl/ChainExpiryClaimsValidator.java | 13 ++-
.../impl/RootTokenIdRevocationValidator.java | 4 +-
.../impl/OIDCRPSessionCreationStrategy.java | 20 +++--
.../op/session/impl/OIDCRPSessionSerializer.java | 13 ++-
.../impl/AbstractOIDCUserInfoResponseAction.java | 10 ++-
...stractOIDCUserInfoValidationResponseAction.java | 7 +-
.../op/userinfo/profile/impl/AddUserInfoShell.java | 11 ++-
.../impl/FormOutboundUserInfoResponseMessage.java | 14 ++--
.../op/userinfo/profile/impl/ParseAccessToken.java | 21 +++--
.../userinfo/profile/impl/ValidateAccessToken.java | 16 ++--
105 files changed, 1041 insertions(+), 593 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/OIDCRPSession.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/OIDCRPSession.java
index 9aff09ce..94de2855 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/OIDCRPSession.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/OIDCRPSession.java
@@ -210,7 +210,7 @@ public class OIDCRPSession extends BasicSPSession implements SPSession {
* @param rootJti root token identifier
* @return this builder
*/
- public Builder rootTokenIdentifier(@Nonnull final String rootJti) {
+ public Builder rootTokenIdentifier(@Nullable final String rootJti) {
rootTokenIdentifier = rootJti;
return this;
}
@@ -253,7 +253,7 @@ public class OIDCRPSession extends BasicSPSession implements SPSession {
*
* @return the newly built object
*/
- public OIDCRPSession build() {
+ @Nonnull public OIDCRPSession build() {
Constraint.isNotEmpty(serviceId, "The serviceId value cannot be empty");
Constraint.isNotNull(creationInstant, "The creationInstant value cannot be null");
Constraint.isNotNull(expirationInstant, "The expirationInstant value cannot be null");
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/ExecuteBackChannelLogoutRequest.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/ExecuteBackChannelLogoutRequest.java
index 342a3db1..f5926c90 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/ExecuteBackChannelLogoutRequest.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/ExecuteBackChannelLogoutRequest.java
@@ -18,9 +18,11 @@ import com.nimbusds.common.contenttype.ContentType;
import com.nimbusds.jwt.JWT;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCLogoutPropagationContext;
import net.shibboleth.idp.plugin.oidc.op.session.OIDCRPSession;
import net.shibboleth.idp.session.context.LogoutPropagationContext;
+import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.profile.config.navigate.ClientInformationStringValueLookupFunction;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
@@ -123,8 +125,10 @@ public class ExecuteBackChannelLogoutRequest extends AbstractOIDCBackChannelLogo
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
+ final OIDCMetadataContext metadataContext = getMetadataContext();
+ assert metadataContext != null;
final String backChannelLogoutURIValue =
- oidcBackChannelLogoutURILookupFunction.apply(getMetadataContext().getClientInformation());
+ oidcBackChannelLogoutURILookupFunction.apply(metadataContext.getClientInformation());
if (backChannelLogoutURIValue == null) {
log.error("{} Back-channel logout URI cannot be determined.", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
@@ -138,8 +142,10 @@ public class ExecuteBackChannelLogoutRequest extends AbstractOIDCBackChannelLogo
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
-
- logoutToken = getOidcResponseContext().getProcessedToken();
+
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ logoutToken = oidcResponseContext.getProcessedToken();
if (logoutToken == null) {
log.error("{} OIDCAuthenticationResponseContext did not contain any back-channel logout token.",
getLogPrefix());
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/FormOutboundLogoutRequestMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/FormOutboundLogoutRequestMessage.java
index 19553f9a..8611b582 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/FormOutboundLogoutRequestMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/logout/profile/impl/FormOutboundLogoutRequestMessage.java
@@ -29,6 +29,7 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.plugin.oidc.op.messaging.impl.FrontChannelLogoutPropagationResponse;
import net.shibboleth.idp.plugin.oidc.op.session.OIDCRPSession;
import net.shibboleth.idp.profile.IdPEventIds;
+import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -86,13 +87,14 @@ public class FormOutboundLogoutRequestMessage extends AbstractOIDCLogoutPropagat
return false;
}
- if (getMetadataContext() == null || getMetadataContext().getClientInformation() == null) {
+ final OIDCMetadataContext metadataContext = getMetadataContext();
+ if (metadataContext == null || metadataContext.getClientInformation() == null) {
log.error("{} Could not find OIDC metadata", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
return false;
}
- clientInformation = getMetadataContext().getClientInformation();
+ clientInformation = metadataContext.getClientInformation();
assert clientInformation != null;
frontChannelLogoutUri = clientInformation.getOIDCMetadata().getFrontChannelLogoutURI();
if (frontChannelLogoutUri == null) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
index abfec090..76c5e013 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
@@ -372,7 +372,9 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
return false;
}
- tokenClaimsSet = getOidcResponseContext().getAuthorizationGrantClaimsSet();
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ tokenClaimsSet = oidcResponseContext.getAuthorizationGrantClaimsSet();
if (tokenClaimsSet != null && !(tokenClaimsSet instanceof RefreshTokenClaimsSet)
&& !(tokenClaimsSet instanceof AuthorizeCodeClaimsSet)) {
log.error("{} Authorization grant is of unknown type: {}", getLogPrefix(),
@@ -452,6 +454,7 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
}
final OIDCAuthenticationResponseContext responseCtx = getOidcResponseContext();
+ assert responseCtx != null;
final Scope scope = responseCtx.getScope() != null ? responseCtx.getScope() : new Scope();
log.debug("{} Building access token with scope: {}", getLogPrefix(), scope);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAccessTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAccessTokenToResponseContext.java
index 43961b52..f1a245c0 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAccessTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAccessTokenToResponseContext.java
@@ -121,10 +121,11 @@ public class SetAccessTokenToResponseContext extends AbstractOIDCResponseAction
} else {
token = nonNullTokenCtx.getOpaque();
}
-
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
final Duration lifetime = nonNullTokenCtx.getLifetime();
assert lifetime != null;
- getOidcResponseContext().setAccessToken(token, lifetime, getOidcResponseContext().getScope());
+ oidcResponseContext.setAccessToken(token, lifetime, oidcResponseContext.getScope());
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java
index b2854d38..5e7b2102 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java
@@ -174,6 +174,7 @@ public class ValidateAudience extends AbstractOIDCAuthenticationResponseAction {
// These come from a previous authorization grant (authz code or refresh token).
List<String> previouslyGrantedAudience = null;
final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
final TokenClaimsSet grantClaimsSet = oidcResponseContext.getAuthorizationGrantClaimsSet();
if (grantClaimsSet != null) {
previouslyGrantedAudience = grantClaimsSet.getAudience();
@@ -243,7 +244,7 @@ public class ValidateAudience extends AbstractOIDCAuthenticationResponseAction {
}
log.debug("{} Computed audience for client {}: {}", getLogPrefix(), clientId, effectiveAudience);
- getOidcResponseContext().getAudience().addAll(effectiveAudience);
+ oidcResponseContext.getAudience().addAll(effectiveAudience);
final ProxiedRequesterContext proxyCtx = proxiedRequesterContextCreationStrategy.apply(profileRequestContext);
if (proxyCtx == null) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractBuildErrorResponseFromEvent.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractBuildErrorResponseFromEvent.java
index 3b7d43fa..7f2c0518 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractBuildErrorResponseFromEvent.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractBuildErrorResponseFromEvent.java
@@ -147,18 +147,22 @@ public abstract class AbstractBuildErrorResponseFromEvent<T extends ErrorRespons
log.error("{} No event to be included in the response, nothing to do", getLogPrefix());
return;
}
- final String event = eventCtx.getEvent().toString();
+ assert eventCtx != null;
+ final Object event = eventCtx.getEvent();
+ assert event != null;
+ final String eventValue = event.toString();
final ErrorObject error;
- if (mappedErrors.containsKey(event)) {
- log.debug("{} Found mapped event for {}", getLogPrefix(), event);
- error = mappedErrors.get(event);
+ if (mappedErrors.containsKey(eventValue)) {
+ log.debug("{} Found mapped event for {}", getLogPrefix(), eventValue);
+ error = mappedErrors.get(eventValue);
} else {
- log.debug("{} No mapped event found for {}, creating general {}", getLogPrefix(), event, defaultCode);
- error = new ErrorObject(defaultCode, eventCtx.getEvent().toString(), defaultStatusCode);
+ log.debug("{} No mapped event found for {}, creating general {}", getLogPrefix(), eventValue, defaultCode);
+ error = new ErrorObject(defaultCode, eventValue, defaultStatusCode);
}
+ assert error != null;
final ErrorResponse errorResponse = buildErrorResponse(error, profileRequestContext);
if (errorResponse != null) {
- profileRequestContext.getOutboundMessageContext()
+ profileRequestContext.ensureOutboundMessageContext()
.setMessage(buildErrorResponse(error, profileRequestContext));
log.debug("{} ErrorResponse successfully set as the outbound message", getLogPrefix());
} else {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractInitializeOutboundResponseMessageContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
index 1ad1a539..287793fe 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractInitializeOutboundResponseMessageContext.java
@@ -19,12 +19,12 @@ import javax.annotation.Nonnull;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.messaging.context.BaseContext;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Action that adds an outbound {@link MessageContext} and related OIDC contexts to the {@link ProfileRequestContext}.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCAuthenticationRequestAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCAuthenticationRequestAction.java
index 35388f9a..d4d568bc 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCAuthenticationRequestAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCAuthenticationRequestAction.java
@@ -14,11 +14,8 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
@@ -28,10 +25,6 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
*/
public abstract class AbstractOIDCAuthenticationRequestAction extends AbstractOIDCRequestAction<AuthenticationRequest> {
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(AbstractOIDCAuthenticationRequestAction.class);
-
/**
* Returns OIDC authentication request.
*
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCAuthenticationResponseAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCAuthenticationResponseAction.java
index f0c75d60..1870e212 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCAuthenticationResponseAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCAuthenticationResponseAction.java
@@ -15,18 +15,19 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
*
@@ -41,11 +42,11 @@ public abstract class AbstractOIDCAuthenticationResponseAction extends AbstractO
private Logger log = LoggerFactory.getLogger(AbstractOIDCAuthenticationResponseAction.class);
/** oidc response context. */
- @Nonnull
+ @Nullable
private OIDCAuthenticationResponseContext oidcResponseContext;
/** OIDC Metadata context. */
- @Nonnull
+ @Nullable
private OIDCMetadataContext oidcMetadataContext;
/**
@@ -53,7 +54,7 @@ public abstract class AbstractOIDCAuthenticationResponseAction extends AbstractO
*
* @return ctx.
*/
- @Nonnull
+ @Nullable
public OIDCAuthenticationResponseContext getOidcResponseContext() {
return oidcResponseContext;
}
@@ -63,7 +64,7 @@ public abstract class AbstractOIDCAuthenticationResponseAction extends AbstractO
*
* @return The OIDC Metadata context.
*/
- public OIDCMetadataContext getMetadataContext() {
+ @Nullable public OIDCMetadataContext getMetadataContext() {
return oidcMetadataContext;
}
@@ -88,7 +89,8 @@ public abstract class AbstractOIDCAuthenticationResponseAction extends AbstractO
return false;
}
- oidcMetadataContext = profileRequestContext.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
+ oidcMetadataContext =
+ profileRequestContext.ensureInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
return true;
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCClientMetadataPopulationAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCClientMetadataPopulationAction.java
index 579c87a4..5c2f0414 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCClientMetadataPopulationAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCClientMetadataPopulationAction.java
@@ -23,7 +23,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.client.ClientRegistrationRequest;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
@@ -32,6 +31,7 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.OIDCClientRe
import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.OIDCPolicyEnforcedClientRegistrationRequestMetadataLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Abstract action for populating metadata from the {@link ClientRegistrationRequest} message to the response
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCRequestAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCRequestAction.java
index 66306c06..16f9a0eb 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCRequestAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCRequestAction.java
@@ -17,13 +17,13 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import javax.annotation.Nonnull;
import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
*
@@ -65,7 +65,7 @@ public abstract class AbstractOIDCRequestAction<T> extends AbstractProfileAction
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return false;
}
- final Object message = profileRequestContext.getInboundMessageContext().getMessage();
+ final Object message = profileRequestContext.ensureInboundMessageContext().getMessage();
if (message == null) {
log.error("{} Unable to locate inbound message", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCResponseAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCResponseAction.java
index 9e1f51df..9d249ba2 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCResponseAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCResponseAction.java
@@ -15,17 +15,17 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
-import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Abstract class for actions performing actions on {@link OIDCAuthenticationResponseContext} located under
@@ -38,11 +38,11 @@ public abstract class AbstractOIDCResponseAction extends AbstractProfileAction {
private Logger log = LoggerFactory.getLogger(AbstractOIDCResponseAction.class);
/** oidc response context. */
- @Nonnull
+ @Nullable
private OIDCAuthenticationResponseContext oidcResponseContext;
/** OIDC Metadata context. */
- @Nonnull
+ @Nullable
private OIDCMetadataContext oidcMetadataContext;
/**
@@ -50,7 +50,7 @@ public abstract class AbstractOIDCResponseAction extends AbstractProfileAction {
*
* @return ctx.
*/
- @Nonnull
+ @Nullable
public OIDCAuthenticationResponseContext getOidcResponseContext() {
return oidcResponseContext;
}
@@ -60,7 +60,7 @@ public abstract class AbstractOIDCResponseAction extends AbstractProfileAction {
*
* @return The OIDC Metadata context.
*/
- public OIDCMetadataContext getMetadataContext() {
+ @Nullable public OIDCMetadataContext getMetadataContext() {
return oidcMetadataContext;
}
@@ -71,19 +71,26 @@ public abstract class AbstractOIDCResponseAction extends AbstractProfileAction {
if (!super.doPreExecute(profileRequestContext)) {
return false;
}
- final MessageContext outboundMessageCtx = profileRequestContext.getOutboundMessageContext();
- if (outboundMessageCtx == null) {
+ if (profileRequestContext.getOutboundMessageContext() == null) {
log.error("{} No outbound message context", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return false;
}
- oidcResponseContext = outboundMessageCtx.getSubcontext(OIDCAuthenticationResponseContext.class);
+ oidcResponseContext = profileRequestContext.ensureOutboundMessageContext()
+ .getSubcontext(OIDCAuthenticationResponseContext.class);
if (oidcResponseContext == null) {
log.error("{} No oidc response context", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return false;
}
- oidcMetadataContext = profileRequestContext.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
+ if (profileRequestContext.getInboundMessageContext() == null) {
+ log.error("{} No inbound message context", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
+ return false;
+ }
+
+ oidcMetadataContext =
+ profileRequestContext.ensureInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
return true;
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCSigningResponseAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCSigningResponseAction.java
index a4859c18..85a5ee49 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCSigningResponseAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCSigningResponseAction.java
@@ -23,11 +23,11 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Abstract action to be extended by oidc response actions requiring signing parameters. Not having signing credentials
@@ -48,8 +48,11 @@ public abstract class AbstractOIDCSigningResponseAction extends AbstractOIDCResp
/** Constructor. */
public AbstractOIDCSigningResponseAction() {
- securityParametersLookupStrategy = new ChildContextLookup<>(SecurityParametersContext.class)
- .compose(new OutboundMessageContextLookup());
+ final Function<ProfileRequestContext, SecurityParametersContext> splcs =
+ new ChildContextLookup<>(SecurityParametersContext.class)
+ .compose(new OutboundMessageContextLookup());
+ assert splcs != null;
+ securityParametersLookupStrategy = splcs;
}
/**
@@ -89,7 +92,12 @@ public abstract class AbstractOIDCSigningResponseAction extends AbstractOIDCResp
}
signatureSigningParameters = secParamCtx.getSignatureSigningParameters();
- if (signatureSigningParameters == null || signatureSigningParameters.getSigningCredential() == null) {
+ if (signatureSigningParameters == null) {
+ log.debug("{} no signature signing parameters available", getLogPrefix());
+ return false;
+ }
+ assert signatureSigningParameters != null;
+ if (signatureSigningParameters.getSigningCredential() == null) {
log.debug("{} no signature signing credentials available", getLogPrefix());
return false;
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCTokenResponseAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCTokenResponseAction.java
index 659ef60d..da36a41f 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCTokenResponseAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AbstractOIDCTokenResponseAction.java
@@ -22,12 +22,12 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.TokenRequest;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Abstract class for actions performing actions on {@link OIDCAuthenticationResponseContext} located under
@@ -71,20 +71,26 @@ public abstract class AbstractOIDCTokenResponseAction extends AbstractOIDCTokenR
return false;
}
- final MessageContext outboundMessageCtx = profileRequestContext.getOutboundMessageContext();
- if (outboundMessageCtx == null) {
+ if (profileRequestContext.getOutboundMessageContext() == null) {
log.error("{} No outbound message context", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return false;
}
- oidcResponseContext = outboundMessageCtx.getSubcontext(OIDCAuthenticationResponseContext.class);
+ oidcResponseContext = profileRequestContext.ensureOutboundMessageContext()
+ .getSubcontext(OIDCAuthenticationResponseContext.class);
if (oidcResponseContext == null) {
log.error("{} No OIDC response context", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return false;
}
- oidcMetadataContext = profileRequestContext.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
+ if (profileRequestContext.getInboundMessageContext() == null) {
+ log.error("{} No inbound message context", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
+ return false;
+ }
+ oidcMetadataContext = profileRequestContext.ensureInboundMessageContext()
+ .getSubcontext(OIDCMetadataContext.class);
return true;
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAccessTokenHashToIDToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAccessTokenHashToIDToken.java
index c2e56417..4562483d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAccessTokenHashToIDToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAccessTokenHashToIDToken.java
@@ -19,11 +19,14 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.openid.connect.sdk.claims.AccessTokenHash;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* Action that adds access token hash claim to a {@link IDTokenClaimsSet}. If there are no signing parameters available,
* action fails without error event.
@@ -38,28 +41,35 @@ public class AddAccessTokenHashToIDToken extends AbstractOIDCSigningResponseActi
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (getOidcResponseContext().getIDToken() == null) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
+ if (oidcResponseContext.getIDToken() == null) {
log.error("{} No id token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return;
}
- if (getOidcResponseContext().getAccessToken() == null) {
+ final IDTokenClaimsSet idTokenClaimsSet = oidcResponseContext.getIDToken();
+ assert idTokenClaimsSet != null;
+ if (oidcResponseContext.getAccessToken() == null) {
log.error("{} No access token to calculate hash on", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return;
}
- final AccessTokenHash atHash = AccessTokenHash.compute(getOidcResponseContext().getAccessToken(),
- new JWSAlgorithm(getSignatureSigningParameters().getSignatureAlgorithm()), null);
+ final SignatureSigningParameters signingParameters = getSignatureSigningParameters();
+ assert signingParameters != null;
+ final AccessTokenHash atHash = AccessTokenHash.compute(oidcResponseContext.getAccessToken(),
+ new JWSAlgorithm(signingParameters.getSignatureAlgorithm()), null);
if (atHash == null || atHash.getValue() == null) {
log.error("{} Not able to generate at_hash using algorithm {}", getLogPrefix(),
- getSignatureSigningParameters().getSignatureAlgorithm());
+ signingParameters.getSignatureAlgorithm());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
return;
}
log.debug("{} Setting access token hash to id token", getLogPrefix());
- getOidcResponseContext().getIDToken().setClaim(IDTokenClaimsSet.AT_HASH_CLAIM_NAME, atHash.getValue());
+ idTokenClaimsSet.setClaim(IDTokenClaimsSet.AT_HASH_CLAIM_NAME, atHash.getValue());
log.debug("{} Updated token {}", getLogPrefix(),
- getOidcResponseContext().getIDToken().toJSONObject().toJSONString());
+ idTokenClaimsSet.toJSONObject().toJSONString());
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAcrToIDToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAcrToIDToken.java
index 69f77dcb..5fb2a6c8 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAcrToIDToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAcrToIDToken.java
@@ -19,10 +19,12 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* Action that adds acr claim to a {@link IDTokenClaimsSet}.
*/
@@ -35,16 +37,22 @@ public class AddAcrToIDToken extends AbstractOIDCAuthenticationResponseAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (getOidcResponseContext().getIDToken() == null) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
+ if (oidcResponseContext.getIDToken() == null) {
log.error("{} No id token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return;
}
- if (getOidcResponseContext().getAcr() != null) {
+
+ final IDTokenClaimsSet idTokenClaimsSet = oidcResponseContext.getIDToken();
+ assert idTokenClaimsSet != null;
+
+ if (oidcResponseContext.getAcr() != null) {
log.debug("{} Setting acr to id token", getLogPrefix());
- getOidcResponseContext().getIDToken().setACR(getOidcResponseContext().getAcr());
- log.debug("{} Updated token {}", getLogPrefix(),
- getOidcResponseContext().getIDToken().toJSONObject().toJSONString());
+ idTokenClaimsSet.setACR(oidcResponseContext.getAcr());
+ log.debug("{} Updated token {}", getLogPrefix(), idTokenClaimsSet.toJSONObject().toJSONString());
}
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddApplicationTypeToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddApplicationTypeToClientMetadata.java
index df2d8316..633700eb 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddApplicationTypeToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddApplicationTypeToClientMetadata.java
@@ -18,11 +18,11 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.ApplicationType;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationResponseContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* <p>Adds the application_type to the {@link OIDCClientRegistrationResponseContext}. The default, it the value does
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
index 3f26f530..24077523 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
@@ -34,6 +34,7 @@ import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.attribute.transcoding.TranscoderSupport;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultResponseClaimsSetLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
@@ -44,8 +45,10 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.service.ReloadableService;
import net.shibboleth.shared.service.ServiceableComponent;
@@ -54,7 +57,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
@@ -123,12 +125,19 @@ public class AddAttributesToClaimsSet extends AbstractOIDCResponseAction {
/** Constructor. */
AddAttributesToClaimsSet() {
- attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
- new ChildContextLookup<>(RelyingPartyContext.class));
+ final Function<ProfileRequestContext, AttributeContext> acls =
+ new ChildContextLookup<>(AttributeContext.class).compose(
+ new ChildContextLookup<>(RelyingPartyContext.class));
+ assert acls != null;
+ attributeContextLookupStrategy = acls;
+
responseClaimsSetLookupStrategy = new DefaultResponseClaimsSetLookupFunction();
- consentContextLookupStrategy =
+
+ final Function<ProfileRequestContext, OIDCAuthenticationResponseConsentContext> accls =
new ChildContextLookup<>(OIDCAuthenticationResponseConsentContext.class).compose(
new OIDCAuthenticationResponseContextLookupFunction());
+ assert accls != null;
+ consentContextLookupStrategy = accls;
alwaysIncludedAttributesLookupStrategy = new AlwaysIncludedAttributesLookupFunction();
deniedUserInfoAttributesLookupStrategy = new DeniedUserInfoAttributesLookupFunction();
@@ -306,6 +315,7 @@ public class AddAttributesToClaimsSet extends AbstractOIDCResponseAction {
try (final ServiceableComponent<AttributeTranscoderRegistry> component =
transcoderRegistry.getServiceableComponent()) {
+ assert attributeCtx != null;
for (final IdPAttribute attribute : attributeCtx.getIdPAttributes().values()) {
if (attribute != null && !attribute.getValues().isEmpty()) {
if (consentCtx != null && !consentCtx.getConsentedAttributes().contains(attribute.getId())) {
@@ -329,12 +339,16 @@ public class AddAttributesToClaimsSet extends AbstractOIDCResponseAction {
}
log.debug("{} Adding claim {} with value {}", getLogPrefix(), name, claim.get(name));
+ assert claimsSet != null;
claimsSet.setClaim(name, claim.get(name));
}
}
- log.debug("{} Claims set after mapping attributes to claims: {}", getLogPrefix(),
- claimsSet.toJSONObject().toJSONString());
+ if (log.isDebugEnabled()) {
+ assert claimsSet != null;
+ final String claimsSetValue = claimsSet.toJSONObject().toJSONString();
+ log.debug("{} Claims set after mapping attributes to claims: {}", getLogPrefix(), claimsSetValue);
+ }
}
/**
@@ -362,9 +376,14 @@ public class AddAttributesToClaimsSet extends AbstractOIDCResponseAction {
for (final TranscodingRule rule : transcodingRules) {
try {
// Check for claims to skip based on token type.
+ final Set<String> alwaysIncluded = alwaysIncludedAttributes == null ?
+ CollectionSupport.emptySet() : alwaysIncludedAttributes;
+ assert alwaysIncluded != null;
if (claimsSet instanceof IDTokenClaimsSet && !addToIDTokenByDefault
- && !alwaysIncludedAttributes.contains(attribute.getId())) {
- final AttributesMapContainer container = getOidcResponseContext().getMappedIdTokenRequestedClaims();
+ && !alwaysIncluded.contains(attribute.getId())) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ final AttributesMapContainer container = oidcResponseContext.getMappedIdTokenRequestedClaims();
if (container != null && container.get().containsKey(attribute.getId())) {
log.debug("{} Attribute {} is targeted for ID Token via claims request", getLogPrefix(),
attribute.getId());
@@ -372,11 +391,16 @@ public class AddAttributesToClaimsSet extends AbstractOIDCResponseAction {
log.debug("{} Attribute {} not targeted for ID Token", getLogPrefix(), attribute.getId());
continue;
}
- } else if (claimsSet instanceof UserInfo && deniedUserInfoAttributes.contains(attribute.getId())) {
- log.debug("{} Attribute {} not targeted for Userinfo Token", getLogPrefix(), attribute.getId());
- continue;
+ } else {
+ final Set<String> userInfoDenied = deniedUserInfoAttributes == null ?
+ CollectionSupport.emptySet() : deniedUserInfoAttributes;
+ assert userInfoDenied != null;
+ if (claimsSet instanceof UserInfo && userInfoDenied.contains(attribute.getId())) {
+ log.debug("{} Attribute {} not targeted for Userinfo Token", getLogPrefix(), attribute.getId());
+ continue;
+ }
}
-
+ assert rule != null;
final AttributeTranscoder<JSONObject> transcoder = TranscoderSupport.<JSONObject>getTranscoder(rule);
final JSONObject encodedAttribute =
transcoder.encode(profileRequestContext, attribute, JSONObject.class, rule);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthTimeToIDToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthTimeToIDToken.java
index c318bfd8..1333b3d9 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthTimeToIDToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthTimeToIDToken.java
@@ -14,15 +14,19 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
+import java.time.Instant;
+
import javax.annotation.Nonnull;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* Action that adds auth_time claim to a {@link IDTokenClaimsSet}.
*/
@@ -36,17 +40,22 @@ public class AddAuthTimeToIDToken extends AbstractOIDCResponseAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (getOidcResponseContext().getIDToken() == null) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ if (oidcResponseContext.getIDToken() == null) {
log.error("{} No id token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return;
}
- if (getOidcResponseContext().getAuthTime() != null) {
+
+ final IDTokenClaimsSet idTokenClaimsSet = oidcResponseContext.getIDToken();
+ assert idTokenClaimsSet != null;
+
+ final Instant authTime = oidcResponseContext.getAuthTime();
+ if (authTime != null) {
log.debug("{} Setting auth_time to id token", getLogPrefix());
- getOidcResponseContext().getIDToken().setClaim(IDTokenClaimsSet.AUTH_TIME_CLAIM_NAME,
- getOidcResponseContext().getAuthTime().getEpochSecond());
- log.debug("{} Updated token {}", getLogPrefix(),
- getOidcResponseContext().getIDToken().toJSONObject().toJSONString());
+ idTokenClaimsSet.setClaim(IDTokenClaimsSet.AUTH_TIME_CLAIM_NAME, authTime.getEpochSecond());
+ log.debug("{} Updated token {}", getLogPrefix(), idTokenClaimsSet.toJSONObject().toJSONString());
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthorizationCodeHashToIDToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthorizationCodeHashToIDToken.java
index 4f0d5bff..ca604d0d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthorizationCodeHashToIDToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAuthorizationCodeHashToIDToken.java
@@ -21,12 +21,13 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -67,8 +68,10 @@ public class AddAuthorizationCodeHashToIDToken extends AbstractOIDCSigningRespon
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
- if (getOidcResponseContext().getIDToken() == null) {
+ if (oidcResponseContext.getIDToken() == null) {
log.error("{} No id token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return;
@@ -79,10 +82,11 @@ public class AddAuthorizationCodeHashToIDToken extends AbstractOIDCSigningRespon
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
return;
}
+ final IDTokenClaimsSet idTokenClaimsSet = oidcResponseContext.getIDToken();
+ assert idTokenClaimsSet != null;
log.debug("{} Setting authz code hash to id token", getLogPrefix());
- getOidcResponseContext().getIDToken().setClaim(IDTokenClaimsSet.C_HASH_CLAIM_NAME, hashValue);
- log.debug("{} Updated token {}", getLogPrefix(),
- getOidcResponseContext().getIDToken().toJSONObject().toJSONString());
+ idTokenClaimsSet.setClaim(IDTokenClaimsSet.C_HASH_CLAIM_NAME, hashValue);
+ log.debug("{} Updated token {}", getLogPrefix(), idTokenClaimsSet.toJSONObject().toJSONString());
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddClientNameToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddClientNameToClientMetadata.java
index 6e87dda6..e9f37140 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddClientNameToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddClientNameToClientMetadata.java
@@ -21,11 +21,11 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.langtag.LangTag;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddContactsToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddContactsToClientMetadata.java
index 7913ce02..d768e810 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddContactsToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddContactsToClientMetadata.java
@@ -20,10 +20,11 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* Adds the contents of the contacts attribute from the input metadata to the output {@link OIDCClientMetadata}.
*/
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java
index 54877094..7f8d07cf 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java
@@ -26,15 +26,16 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.GrantType;
import net.shibboleth.oidc.profile.config.logic.AuthorizationCodeFlowEnabledPredicate;
import net.shibboleth.oidc.profile.config.logic.ImplicitFlowEnabledPredicate;
import net.shibboleth.oidc.profile.config.logic.RefreshTokensEnabledPredicate;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that adds the grant_type to the client metadata.
@@ -62,7 +63,7 @@ public class AddGrantTypeToClientMetadata extends AbstractOIDCClientMetadataPopu
@Nonnull private Predicate<ProfileRequestContext> refreshTokensPredicate;
/** Map of supported grant types and their corresponding predicates. */
- @Nonnull private Map<GrantType, Predicate<ProfileRequestContext>> supportedGrantTypes;
+ @NonnullAfterInit private Map<GrantType, Predicate<ProfileRequestContext>> supportedGrantTypes;
/**
* Constructor.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShell.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShell.java
index ed2f6f13..fdac76b2 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShell.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddIDTokenShell.java
@@ -29,15 +29,14 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationRes
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.navigate.AudienceRestrictionsLookupFunction;
import net.shibboleth.oidc.profile.config.navigate.IDTokenLifetimeLookupFunction;
-import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.Audience;
import com.nimbusds.oauth2.sdk.id.Issuer;
@@ -66,9 +65,6 @@ public class AddIDTokenShell extends AbstractOIDCResponseAction {
/** EntityID to populate into Issuer element. */
@Nullable private String issuerId;
- /** The RelyingPartyContext to operate on. */
- @Nullable private RelyingPartyContext rpCtx;
-
/** Audiences to add. */
@Nullable private Collection<String> audiences;
@@ -133,12 +129,13 @@ public class AddIDTokenShell extends AbstractOIDCResponseAction {
return false;
}
- audiences = audienceRestrictionsLookupStrategy.apply(profileRequestContext);
- if (audiences == null || audiences.isEmpty()) {
+ final Collection<String> restrictions = audienceRestrictionsLookupStrategy.apply(profileRequestContext);
+ if (restrictions == null || restrictions.isEmpty()) {
log.warn("{} No audiences returned for ID token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return false;
}
+ audiences = restrictions;
lifetime = idTokenLifetimeLookupStrategy.apply(profileRequestContext);
if (lifetime == null) {
@@ -154,19 +151,22 @@ public class AddIDTokenShell extends AbstractOIDCResponseAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final List<Audience> aud = new ArrayList<>();
+ assert audiences != null;
for (final String audience : audiences) {
aud.add(new Audience(audience));
}
final Date exp = Date.from(Instant.now().plus(lifetime));
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
final IDTokenClaimsSet idToken = new IDTokenClaimsSet(new Issuer(issuerId),
- new Subject(getOidcResponseContext().getSubject()), aud, exp, new Date());
- final String sid = getOidcResponseContext().getSessionId();
+ new Subject(oidcResponseContext.getSubject()), aud, exp, new Date());
+ final String sid = oidcResponseContext.getSessionId();
if (StringSupport.trimOrNull(sid) != null) {
idToken.setSessionID(new SessionID(sid));
}
log.debug("{} Setting ID token shell to response context {}", getLogPrefix(),
idToken.toJSONObject().toJSONString());
- getOidcResponseContext().setIDToken(idToken);
+ oidcResponseContext.setIDToken(idToken);
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddJwksToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddJwksToClientMetadata.java
index bd065f46..b6b38d7b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddJwksToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddJwksToClientMetadata.java
@@ -27,9 +27,7 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import com.google.common.base.Predicates;
import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSet;
@@ -37,6 +35,8 @@ import net.shibboleth.oidc.jwk.support.RemoteJwkUtils;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that adds the jwks or jwks_uri to the client metadata, if one of those were defined in the request.
@@ -62,6 +62,7 @@ public class AddJwksToClientMetadata extends AbstractOIDCClientMetadataPopulatio
*/
public AddJwksToClientMetadata() {
super();
+ validateRemoteJwkSetPredicate = PredicateSupport.alwaysTrue();
}
/**
@@ -74,7 +75,6 @@ public class AddJwksToClientMetadata extends AbstractOIDCClientMetadataPopulatio
ifDestroyedThrowDestroyedComponentException();
httpClient = Constraint.isNotNull(client, "HttpClient cannot be null");
- validateRemoteJwkSetPredicate = Predicates.alwaysTrue();
}
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddLogoUrisToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddLogoUrisToClientMetadata.java
index c7b7a07e..ae9a4d28 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddLogoUrisToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddLogoUrisToClientMetadata.java
@@ -21,10 +21,11 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.langtag.LangTag;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* This action adds the logo_uri(s) to the client metadata.
*/
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddMetadataStatementToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddMetadataStatementToClientMetadata.java
index ad01d0fb..1a9fb021 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddMetadataStatementToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddMetadataStatementToClientMetadata.java
@@ -22,12 +22,12 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.MetadataStatementsLookupFunction;
import net.shibboleth.idp.profile.ActionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that adds the trusted metadata_statement chain (containing OP's signed key) to the metadata_statement
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDToken.java
index 4cbe3f1c..af275f8d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDToken.java
@@ -22,13 +22,14 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.Nonce;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestNonceLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that adds nonce claim to a {@link IDTokenClaimsSet}.
@@ -65,17 +66,23 @@ public class AddNonceToIDToken extends AbstractOIDCResponseAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (getOidcResponseContext().getIDToken() == null) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
+ if (oidcResponseContext.getIDToken() == null) {
log.error("{} No id token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return;
}
+
+ final IDTokenClaimsSet idTokenClaimsSet = oidcResponseContext.getIDToken();
+ assert idTokenClaimsSet != null;
+
final Nonce nonce = requestNonceLookupStrategy.apply(profileRequestContext);
if (nonce != null) {
log.debug("{} Setting nonce to id token", getLogPrefix());
- getOidcResponseContext().getIDToken().setNonce(nonce);
- log.debug("{} Updated token {}", getLogPrefix(),
- getOidcResponseContext().getIDToken().toJSONObject().toJSONString());
+ idTokenClaimsSet.setNonce(nonce);
+ log.debug("{} Updated token {}", getLogPrefix(), idTokenClaimsSet.toJSONObject().toJSONString());
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddPolicyUrisToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddPolicyUrisToClientMetadata.java
index 711d49d7..dca81199 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddPolicyUrisToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddPolicyUrisToClientMetadata.java
@@ -21,10 +21,11 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.langtag.LangTag;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* This action adds the policy_uri(s) to the client metadata.
*/
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRedirectUrisToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRedirectUrisToClientMetadata.java
index 91a824e3..4388626b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRedirectUrisToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRedirectUrisToClientMetadata.java
@@ -17,8 +17,6 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
@@ -28,10 +26,6 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
*/
public class AddRedirectUrisToClientMetadata extends AbstractOIDCClientMetadataPopulationAction {
- /** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(AddRedirectUrisToClientMetadata.class);
-
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRemainingClaimsToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRemainingClaimsToClientMetadata.java
index 722b3471..31d3270c 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRemainingClaimsToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRemainingClaimsToClientMetadata.java
@@ -24,7 +24,6 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
@@ -32,6 +31,7 @@ import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationMetadataPolicyContext;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Adds the remaining claims from the input metadata to the output {@link OIDCClientMetadata}, which haven't been
@@ -54,9 +54,11 @@ public class AddRemainingClaimsToClientMetadata extends AbstractOIDCClientMetada
* Constructor.
*/
public AddRemainingClaimsToClientMetadata() {
- registrationMetadataPolicyContextLookupStrategy =
+ final Function<ProfileRequestContext, OIDCClientRegistrationMetadataPolicyContext> rmpcls =
new ChildContextLookup<>(OIDCClientRegistrationMetadataPolicyContext.class, false).compose(
new InboundMessageContextLookup());
+ assert rmpcls != null;
+ registrationMetadataPolicyContextLookupStrategy = rmpcls;
}
/**
@@ -86,12 +88,13 @@ public class AddRemainingClaimsToClientMetadata extends AbstractOIDCClientMetada
return false;
}
- metadataPolicy = metadataPolicyContext.getMetadataPolicy();
- if (metadataPolicy == null || metadataPolicy.isEmpty()) {
+ final Map<String, MetadataPolicy> policy = metadataPolicyContext.getMetadataPolicy();
+ if (policy == null || policy.isEmpty()) {
log.debug("{} No metadata policy found, nothing to do", getLogPrefix());
return false;
}
-
+ metadataPolicy = policy;
+
return true;
}
@@ -102,6 +105,7 @@ public class AddRemainingClaimsToClientMetadata extends AbstractOIDCClientMetada
final JSONObject initialOutput = getOutputMetadata().toJSONObject();
for (final String claim : input.keySet()) {
if (!initialOutput.containsKey(claim)) {
+ assert metadataPolicy != null;
if (metadataPolicy.containsKey(claim)) {
log.debug("{} added {} to the output metadata", getLogPrefix(), claim);
getOutputMetadata().setCustomField(claim, input.get(claim));
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
index 74538bf5..6601061a 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestObjectSecurityConfigurationToClientMetadata.java
@@ -24,7 +24,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JWEAlgorithm;
@@ -34,7 +33,9 @@ import net.shibboleth.oidc.jwa.support.SignatureConstants;
import net.shibboleth.oidc.profile.config.navigate.JWEDataEncryptionAlgorithmsLookupFunction;
import net.shibboleth.oidc.profile.config.navigate.JWEKeyTransportEncryptionAlgorithmsLookupFunction;
import net.shibboleth.oidc.profile.config.navigate.JWSSignatureAlgorithmsLookupFunction;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Verifies and adds the request object configuration details (request_object_signing_alg,
@@ -47,13 +48,13 @@ public class AddRequestObjectSecurityConfigurationToClientMetadata extends Abstr
private final Logger log = LoggerFactory.getLogger(AddRequestObjectSecurityConfigurationToClientMetadata.class);
/** Strategy to obtain list of supported signature algorithms. */
- @Nullable private Function<ProfileRequestContext,List<String>> signatureAlgorithmsLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,List<String>> signatureAlgorithmsLookupStrategy;
/** Strategy to obtain list of supported data encryption algorithms. */
- @Nullable private Function<ProfileRequestContext,List<String>> dataEncryptionAlgorithmsLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,List<String>> dataEncryptionAlgorithmsLookupStrategy;
/** Strategy to obtain list of supported key transport encryption algorithms. */
- @Nullable private Function<ProfileRequestContext,List<String>> keyTransportEncryptionAlgorithmsLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,List<String>> keyTransportEncryptionAlgorithmsLookupStrategy;
/** Whether signature algorithm none is allowed regardless of what list of Signature Validation Algs has. */
private boolean allowSignatureNone;
@@ -139,19 +140,29 @@ public class AddRequestObjectSecurityConfigurationToClientMetadata extends Abstr
return false;
}
- supportedSignatureValidationAlgs = signatureAlgorithmsLookupStrategy.apply(profileRequestContext);
- if (supportedSignatureValidationAlgs.isEmpty()) {
+ final List<String> validationAlgs = signatureAlgorithmsLookupStrategy.apply(profileRequestContext);
+ if (validationAlgs == null || validationAlgs.isEmpty()) {
log.warn("{} No supported signature validation algorithms resolved", getLogPrefix());
+ supportedSignatureValidationAlgs = CollectionSupport.emptyList();
+ } else {
+ supportedSignatureValidationAlgs = validationAlgs;
}
-
- supportedDecryptionAlgs = keyTransportEncryptionAlgorithmsLookupStrategy.apply(profileRequestContext);
- if (supportedDecryptionAlgs.isEmpty()) {
+
+
+ final List<String> decryptionAlgs = keyTransportEncryptionAlgorithmsLookupStrategy.apply(profileRequestContext);
+ if (decryptionAlgs == null || decryptionAlgs.isEmpty()) {
log.warn("{} No supported key transport decryption algorithms resolved", getLogPrefix());
+ supportedDecryptionAlgs = CollectionSupport.emptyList();
+ } else {
+ supportedDecryptionAlgs = decryptionAlgs;
}
- supportedDecryptionEncs = dataEncryptionAlgorithmsLookupStrategy.apply(profileRequestContext);
- if (supportedDecryptionEncs.isEmpty()) {
+ final List<String> decryptionEncs = dataEncryptionAlgorithmsLookupStrategy.apply(profileRequestContext);
+ if (decryptionEncs == null || decryptionEncs.isEmpty()) {
log.warn("{} No supported data decryption algorithms resolved", getLogPrefix());
+ supportedDecryptionEncs = CollectionSupport.emptyList();
+ } else {
+ supportedDecryptionEncs = decryptionEncs;
}
return true;
}
@@ -164,9 +175,13 @@ public class AddRequestObjectSecurityConfigurationToClientMetadata extends Abstr
final JWSAlgorithm reqRequestObjectSigAlg = getInputMetadata().getRequestObjectJWSAlg();
//"none" should be supported by every op. "none" cannot be found from the supported algs list.
if (reqRequestObjectSigAlg != null) {
- if ((SignatureConstants.ALGO_ID_SIGNATURE_NONE.equals(reqRequestObjectSigAlg.getName())
- && allowSignatureNone)
- || supportedSignatureValidationAlgs.contains(reqRequestObjectSigAlg.getName())) {
+ final boolean noneRequestedAndAllowed =
+ SignatureConstants.ALGO_ID_SIGNATURE_NONE.equals(reqRequestObjectSigAlg.getName())
+ && allowSignatureNone;
+ assert supportedSignatureValidationAlgs != null;
+
+ if (supportedSignatureValidationAlgs.contains(reqRequestObjectSigAlg.getName()) ||
+ noneRequestedAndAllowed) {
getOutputMetadata().setRequestObjectJWSAlg(reqRequestObjectSigAlg);
} else {
log.warn("{} The requested request_object_signing_alg {} is not supported", getLogPrefix(),
@@ -195,19 +210,23 @@ public class AddRequestObjectSecurityConfigurationToClientMetadata extends Abstr
getOutputMetadata().setRequestObjectJWEEnc(getInputMetadata().getRequestObjectJWEEnc());
}
- if (getOutputMetadata().getRequestObjectJWEAlg() != null
- && !supportedDecryptionAlgs.contains(getOutputMetadata().getRequestObjectJWEAlg().getName())) {
- log.warn("{} The requested response_object_encryption_alg {} is not supported", getLogPrefix(),
- getOutputMetadata().getRequestObjectJWEAlg());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- return;
+ if (getOutputMetadata().getRequestObjectJWEAlg() != null) {
+ assert supportedDecryptionAlgs != null;
+ if (!supportedDecryptionAlgs.contains(getOutputMetadata().getRequestObjectJWEAlg().getName())) {
+ log.warn("{} The requested response_object_encryption_alg {} is not supported", getLogPrefix(),
+ getOutputMetadata().getRequestObjectJWEAlg());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ return;
+ }
}
- if (getOutputMetadata().getRequestObjectJWEEnc() != null
- && !supportedDecryptionEncs.contains(getOutputMetadata().getRequestObjectJWEEnc().getName())) {
- log.warn("{} The requested response_object_encryption_enc {} is not supported", getLogPrefix(),
- getOutputMetadata().getRequestObjectJWEEnc());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- return;
+ if (getOutputMetadata().getRequestObjectJWEEnc() != null) {
+ assert supportedDecryptionEncs != null;
+ if (!supportedDecryptionEncs.contains(getOutputMetadata().getRequestObjectJWEEnc().getName())) {
+ log.warn("{} The requested response_object_encryption_enc {} is not supported", getLogPrefix(),
+ getOutputMetadata().getRequestObjectJWEEnc());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ return;
+ }
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadata.java
index ae6adc53..dbd545a1 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddRequestUrisToClientMetadata.java
@@ -17,8 +17,6 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
@@ -28,10 +26,6 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
*/
public class AddRequestUrisToClientMetadata extends AbstractOIDCClientMetadataPopulationAction {
- /** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(AddRequestUrisToClientMetadata.class);
-
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddResponseTypesToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddResponseTypesToClientMetadata.java
index 5d4b1c29..af6fd8c0 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddResponseTypesToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddResponseTypesToClientMetadata.java
@@ -26,7 +26,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.openid.connect.sdk.OIDCResponseTypeValue;
@@ -36,6 +35,7 @@ import net.shibboleth.oidc.profile.config.logic.ImplicitFlowEnabledPredicate;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that adds response_types to the OIDC client metadata.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddScopeToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddScopeToClientMetadata.java
index 3057a272..0667b9c3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddScopeToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddScopeToClientMetadata.java
@@ -18,13 +18,13 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.openid.connect.sdk.OIDCScopeValue;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Adds the {@link Scope} from the input metadata to the output {@link OIDCClientMetadata}. If the scope is null
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
index 758fdc5b..8f1f08db 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSecurityConfigurationToClientMetadata.java
@@ -24,7 +24,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.EncryptionMethod;
@@ -36,7 +35,9 @@ import net.shibboleth.oidc.jwa.support.SignatureConstants;
import net.shibboleth.oidc.profile.config.navigate.JWEDataEncryptionAlgorithmsLookupFunction;
import net.shibboleth.oidc.profile.config.navigate.JWEKeyTransportEncryptionAlgorithmsLookupFunction;
import net.shibboleth.oidc.profile.config.navigate.JWSSignatureAlgorithmsLookupFunction;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Verifies and adds the security configuration details (*_response_alg and *_response_enc) to the client metadata.
@@ -48,13 +49,13 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
private final Logger log = LoggerFactory.getLogger(AddSecurityConfigurationToClientMetadata.class);
/** Strategy to obtain list of supported signature algorithms. */
- @Nullable private Function<ProfileRequestContext,List<String>> signatureAlgorithmsLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,List<String>> signatureAlgorithmsLookupStrategy;
/** Strategy to obtain list of supported data encryption algorithms. */
- @Nullable private Function<ProfileRequestContext,List<String>> dataEncryptionAlgorithmsLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,List<String>> dataEncryptionAlgorithmsLookupStrategy;
/** Strategy to obtain list of supported key transport encryption algorithms. */
- @Nullable private Function<ProfileRequestContext,List<String>> keyTransportEncryptionAlgorithmsLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,List<String>> keyTransportEncryptionAlgorithmsLookupStrategy;
/**
* List of supported signing algorithms obtained from the security configuration.
@@ -125,19 +126,29 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
return false;
}
- supportedSigningAlgs = signatureAlgorithmsLookupStrategy.apply(profileRequestContext);
- if (supportedSigningAlgs.isEmpty()) {
- log.warn("{} No supported signature signing algorithms resolved", getLogPrefix());
+ final List<String> signingAlgs = signatureAlgorithmsLookupStrategy.apply(profileRequestContext);
+ if (signingAlgs == null || signingAlgs.isEmpty()) {
+ log.warn("{} No supported signature validation algorithms resolved", getLogPrefix());
+ supportedSigningAlgs = CollectionSupport.emptyList();
+ } else {
+ supportedSigningAlgs = signingAlgs;
}
-
- supportedEncryptionAlgs = keyTransportEncryptionAlgorithmsLookupStrategy.apply(profileRequestContext);
- if (supportedEncryptionAlgs.isEmpty()) {
- log.warn("{} No supported key transport encryption algorithms resolved", getLogPrefix());
+
+
+ final List<String> encryptionAlgs = keyTransportEncryptionAlgorithmsLookupStrategy.apply(profileRequestContext);
+ if (encryptionAlgs == null || encryptionAlgs.isEmpty()) {
+ log.warn("{} No supported key transport decryption algorithms resolved", getLogPrefix());
+ supportedEncryptionAlgs = CollectionSupport.emptyList();
+ } else {
+ supportedEncryptionAlgs = encryptionAlgs;
}
- supportedEncryptionEncs = dataEncryptionAlgorithmsLookupStrategy.apply(profileRequestContext);
- if (supportedEncryptionEncs.isEmpty()) {
- log.warn("{} No supported data encryption algorithms resolved", getLogPrefix());
+ final List<String> encryptionEncs = dataEncryptionAlgorithmsLookupStrategy.apply(profileRequestContext);
+ if (encryptionEncs == null || encryptionEncs.isEmpty()) {
+ log.warn("{} No supported data decryption algorithms resolved", getLogPrefix());
+ supportedEncryptionEncs = CollectionSupport.emptyList();
+ } else {
+ supportedEncryptionEncs = encryptionEncs;
}
return true;
}
@@ -155,6 +166,7 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
} else {
getOutputMetadata().setIDTokenJWSAlg(reqIdTokenSigAlg);
}
+ assert supportedSigningAlgs != null;
if (supportedSigningAlgs.contains(getOutputMetadata().getIDTokenJWSAlg().getName())) {
boolean implicitOrHybrid = false;
if (getOutputMetadata().getResponseTypes() != null) {
@@ -181,6 +193,7 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
final JWSAlgorithm reqUserInfoSigAlg = getInputMetadata().getUserInfoJWSAlg();
if (reqUserInfoSigAlg != null) {
+ assert supportedSigningAlgs != null;
if (supportedSigningAlgs.contains(reqUserInfoSigAlg.getName())) {
getOutputMetadata().setUserInfoJWSAlg(reqUserInfoSigAlg);
} else {
@@ -209,19 +222,23 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
getOutputMetadata().setIDTokenJWEEnc(getInputMetadata().getIDTokenJWEEnc());
}
- if (getOutputMetadata().getIDTokenJWEAlg() != null
- && !supportedEncryptionAlgs.contains(getOutputMetadata().getIDTokenJWEAlg().getName())) {
- log.warn("{} The requested id_token_encrypted_response_alg {} is not supported", getLogPrefix(),
- getOutputMetadata().getIDTokenJWEAlg());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- return;
+ if (getOutputMetadata().getIDTokenJWEAlg() != null) {
+ assert supportedEncryptionAlgs != null;
+ if (!supportedEncryptionAlgs.contains(getOutputMetadata().getIDTokenJWEAlg().getName())) {
+ log.warn("{} The requested id_token_encrypted_response_alg {} is not supported", getLogPrefix(),
+ getOutputMetadata().getIDTokenJWEAlg());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ return;
+ }
}
- if (getOutputMetadata().getIDTokenJWEEnc() != null
- && !supportedEncryptionEncs.contains(getOutputMetadata().getIDTokenJWEEnc().getName())) {
- log.warn("{} The requested id_token_encrypted_response_enc {} is not supported", getLogPrefix(),
- getOutputMetadata().getIDTokenJWEEnc());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- return;
+ if (getOutputMetadata().getIDTokenJWEEnc() != null) {
+ assert supportedEncryptionEncs != null;
+ if (!supportedEncryptionEncs.contains(getOutputMetadata().getIDTokenJWEEnc().getName())) {
+ log.warn("{} The requested id_token_encrypted_response_enc {} is not supported", getLogPrefix(),
+ getOutputMetadata().getIDTokenJWEEnc());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ return;
+ }
}
final JWEAlgorithm reqUserInfoEncAlg = getInputMetadata().getUserInfoJWEAlg();
@@ -242,19 +259,23 @@ public class AddSecurityConfigurationToClientMetadata extends AbstractOIDCClient
getOutputMetadata().setUserInfoJWEEnc(getInputMetadata().getUserInfoJWEEnc());
}
- if (getOutputMetadata().getUserInfoJWEAlg() != null
- && !supportedEncryptionAlgs.contains(getOutputMetadata().getUserInfoJWEAlg().getName())) {
- log.warn("{} The requested userinfo_encrypted_response_alg {} is not supported", getLogPrefix(),
- getOutputMetadata().getUserInfoJWEAlg());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- return;
+ if (getOutputMetadata().getUserInfoJWEAlg() != null) {
+ assert supportedEncryptionAlgs != null;
+ if (!supportedEncryptionAlgs.contains(getOutputMetadata().getUserInfoJWEAlg().getName())) {
+ log.warn("{} The requested userinfo_encrypted_response_alg {} is not supported", getLogPrefix(),
+ getOutputMetadata().getUserInfoJWEAlg());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ return;
+ }
}
- if (getOutputMetadata().getUserInfoJWEEnc() != null
- && !supportedEncryptionEncs.contains(getOutputMetadata().getUserInfoJWEEnc().getName())) {
- log.warn("{} The requested userinfo_encrypted_response_enc {} is not supported", getLogPrefix(),
- getOutputMetadata().getUserInfoJWEEnc());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- return;
+ if (getOutputMetadata().getUserInfoJWEEnc() != null) {
+ assert supportedEncryptionEncs != null;
+ if (!supportedEncryptionEncs.contains(getOutputMetadata().getUserInfoJWEEnc().getName())) {
+ log.warn("{} The requested userinfo_encrypted_response_enc {} is not supported", getLogPrefix(),
+ getOutputMetadata().getUserInfoJWEEnc());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ return;
+ }
}
// org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_MAC_HMAC_SHA512;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSubjectTypeToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSubjectTypeToClientMetadata.java
index 2e091f11..6c946a57 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSubjectTypeToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddSubjectTypeToClientMetadata.java
@@ -18,11 +18,11 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.SubjectType;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that adds the subject_type to the client metadata.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenDeliveryAttributesToClaimsSet.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenDeliveryAttributesToClaimsSet.java
index 9ddb3e0e..7e8c6856 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenDeliveryAttributesToClaimsSet.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenDeliveryAttributesToClaimsSet.java
@@ -23,13 +23,13 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationRes
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultResponseClaimsSetLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
@@ -69,9 +69,11 @@ public class AddTokenDeliveryAttributesToClaimsSet extends AbstractOIDCResponseA
/** Constructor. */
AddTokenDeliveryAttributesToClaimsSet() {
responseClaimsSetLookupStrategy = new DefaultResponseClaimsSetLookupFunction();
- tokenClaimsContextLookupStrategy =
+ final Function<ProfileRequestContext, OIDCAuthenticationResponseTokenClaimsContext> tccls =
new ChildContextLookup<>(OIDCAuthenticationResponseTokenClaimsContext.class).compose(
new OIDCAuthenticationResponseContextLookupFunction());
+ assert tccls != null;
+ tokenClaimsContextLookupStrategy = tccls;
}
/**
@@ -136,13 +138,25 @@ public class AddTokenDeliveryAttributesToClaimsSet extends AbstractOIDCResponseA
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- claimsSet.putAll(tokenClaimsCtx.getClaims());
+ assert tokenClaimsCtx != null;
+ final ClaimsSet tokenClaims = tokenClaimsCtx.getClaims();
+ assert claimsSet != null;
+ claimsSet.putAll(tokenClaims);
if (targetIDToken) {
- claimsSet.putAll(tokenClaimsCtx.getIdtokenClaims());
+ assert tokenClaimsCtx != null;
+ final ClaimsSet idTokenClaims = tokenClaimsCtx.getIdtokenClaims();
+ assert claimsSet != null;
+ claimsSet.putAll(idTokenClaims);
} else {
- claimsSet.putAll(tokenClaimsCtx.getUserinfoClaims());
+ assert tokenClaimsCtx != null;
+ final ClaimsSet userInfoClaims = tokenClaimsCtx.getUserinfoClaims();
+ assert claimsSet != null;
+ claimsSet.putAll(userInfoClaims);
+ }
+ if (log.isDebugEnabled()) {
+ assert claimsSet != null;
+ final String claimsSetString = claimsSet.toJSONObject().toJSONString();
+ log.debug("{} claims set after adding token delivery claims {}", getLogPrefix(), claimsSetString);
}
- log.debug("{} claims set after adding token delivery claims {}", getLogPrefix(),
- claimsSet.toJSONObject().toJSONString());
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenEndpointAuthMethodsToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenEndpointAuthMethodsToClientMetadata.java
index 1b4539a7..0e15faa1 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenEndpointAuthMethodsToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTokenEndpointAuthMethodsToClientMetadata.java
@@ -24,12 +24,12 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import net.shibboleth.oidc.profile.config.navigate.TokenEndpointAuthMethodLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that adds the token_endpoint_auth_method to the client metadata. If no method is requested, then
@@ -68,6 +68,7 @@ public class AddTokenEndpointAuthMethodsToClientMetadata extends AbstractOIDCCli
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final ClientAuthenticationMethod requestedMethod = getInputMetadata().getTokenEndpointAuthMethod() != null ?
getInputMetadata().getTokenEndpointAuthMethod() : ClientAuthenticationMethod.getDefault();
+ assert tokenEndpointAuthMethodsLookupStrategy != null;
final Set<ClientAuthenticationMethod> enabledMethods
= tokenEndpointAuthMethodsLookupStrategy.apply(profileRequestContext);
if (enabledMethods == null || !enabledMethods.contains(requestedMethod)) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTosUrisToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTosUrisToClientMetadata.java
index 9b565ba0..2bf2fc87 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTosUrisToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddTosUrisToClientMetadata.java
@@ -21,10 +21,11 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.langtag.LangTag;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* This action adds the tos_uri(s) to the client metadata.
*/
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java
index 03fadf12..bbb6778b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java
@@ -24,7 +24,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.EventContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ErrorObject;
import com.nimbusds.oauth2.sdk.ResponseMode;
@@ -40,6 +39,7 @@ import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.logic.IncludeIssuerInAuthenticationResponsePredicate;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildClientInformation.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildClientInformation.java
index 9a2f7e53..bf5a948a 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildClientInformation.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildClientInformation.java
@@ -26,7 +26,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
import com.nimbusds.oauth2.sdk.auth.Secret;
@@ -39,6 +38,7 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationResponseContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/CheckRedirectURIs.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/CheckRedirectURIs.java
index 4e66a1e8..54fa8ca1 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/CheckRedirectURIs.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/CheckRedirectURIs.java
@@ -38,7 +38,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.HttpClientSecuritySupport;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
@@ -52,6 +51,7 @@ import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* <p>The action that verifies the redirect_uris from the request. At least one must exist. Also, if
@@ -150,7 +150,7 @@ public class CheckRedirectURIs extends AbstractProfileAction {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
- final Object message = profileRequestContext.getInboundMessageContext().getMessage();
+ final Object message = profileRequestContext.ensureInboundMessageContext().getMessage();
if (message == null || !(message instanceof OIDCClientRegistrationRequest)) {
log.debug("{} No inbound message associated with this profile request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
@@ -165,6 +165,7 @@ public class CheckRedirectURIs extends AbstractProfileAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ assert request != null;
final OIDCClientMetadata metadata = request.getOIDCClientMetadata();
if (metadata == null) {
log.warn("{} No client metadata found in the request", getLogPrefix());
@@ -240,13 +241,17 @@ public class CheckRedirectURIs extends AbstractProfileAction {
*/
protected boolean verifySectorIdUri(final URI sectorIdUri, final Set<URI> redirectURIs) {
final ClassicHttpRequest get = ClassicRequestBuilder.get().setUri(sectorIdUri).build();
+ assert get != null;
final HttpClientContext clientContext = HttpClientContext.create();
+ assert clientContext != null;
HttpClientSecuritySupport.marshalSecurityParameters(clientContext, httpClientSecurityParameters, true);
HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(clientContext, get);
final String output;
try (final ClassicHttpResponse response = httpClient.executeOpen(null, get, clientContext)) {
- HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, get.getUri().getScheme());
+ final String scheme = get.getUri().getScheme();
+ assert scheme != null;
+ HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, scheme);
if (response == null) {
log.error("{} Could not get the sector_identifier_uri contents from {}", getLogPrefix(), sectorIdUri);
return false;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessage.java
index c08f085e..fee97707 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessage.java
@@ -23,7 +23,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.AuthorizationResponse;
import com.nimbusds.oauth2.sdk.AuthorizationSuccessResponse;
@@ -32,6 +31,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationResponse;
import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractOAuthAuthorizationResponseAction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseModeLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestStateLookupFunction;
@@ -39,6 +39,7 @@ import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.logic.IncludeIssuerInAuthenticationResponsePredicate;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -115,26 +116,28 @@ public class FormOutboundAuthenticationResponseMessage extends AbstractOAuthAuth
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
// Should not ever happen
- if (getOidcResponseContext().getRedirectURI() == null) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ if (oidcResponseContext.getRedirectURI() == null) {
log.error("{} redirect uri must be validated to form response", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return;
}
if (getAuthorizationRequest() instanceof AuthenticationRequest) {
final AuthenticationResponse resp = new AuthenticationSuccessResponse(
- getOidcResponseContext().getRedirectURI(),
- getOidcResponseContext().getAuthorizationCode(), getOidcResponseContext().getProcessedToken(),
- getOidcResponseContext().getAccessToken(),
+ oidcResponseContext.getRedirectURI(),
+ oidcResponseContext.getAuthorizationCode(), oidcResponseContext.getProcessedToken(),
+ oidcResponseContext.getAccessToken(),
new DefaultRequestStateLookupFunction().apply(profileRequestContext), null, issuer,
new DefaultRequestResponseModeLookupFunction().apply(profileRequestContext));
- profileRequestContext.getOutboundMessageContext().setMessage(resp);
+ profileRequestContext.ensureOutboundMessageContext().setMessage(resp);
} else {
final AuthorizationResponse resp = new AuthorizationSuccessResponse(
- getOidcResponseContext().getRedirectURI(),
- getOidcResponseContext().getAuthorizationCode(), getOidcResponseContext().getAccessToken(),
+ oidcResponseContext.getRedirectURI(),
+ oidcResponseContext.getAuthorizationCode(), oidcResponseContext.getAccessToken(),
new DefaultRequestStateLookupFunction().apply(profileRequestContext), issuer,
new DefaultRequestResponseModeLookupFunction().apply(profileRequestContext));
- profileRequestContext.getOutboundMessageContext().setMessage(resp);
+ profileRequestContext.ensureOutboundMessageContext().setMessage(resp);
}
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundDiscoveryResponse.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundDiscoveryResponse.java
index f7b1baaa..599fb451 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundDiscoveryResponse.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundDiscoveryResponse.java
@@ -21,16 +21,17 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.oidc.op.messaging.impl.OpenIDConfigurationSuccessResponse;
import net.shibboleth.idp.plugin.oidc.op.metadata.resolver.ProviderMetadataResolver;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.ResolverException;
/**
@@ -92,8 +93,11 @@ public class FormOutboundDiscoveryResponse extends AbstractProfileAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- profileRequestContext.getOutboundMessageContext().setMessage(
- new OpenIDConfigurationSuccessResponse(metadata.toJSONObject()));
+ assert metadata != null;
+ final JSONObject metadataContents = metadata.toJSONObject();
+ assert metadataContents != null;
+ profileRequestContext.ensureOutboundMessageContext().setMessage(
+ new OpenIDConfigurationSuccessResponse(metadataContents));
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundTokenResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundTokenResponseMessage.java
index e6c6b178..ed890332 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundTokenResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundTokenResponseMessage.java
@@ -21,7 +21,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AccessTokenResponse;
import com.nimbusds.oauth2.sdk.TokenResponse;
@@ -30,6 +29,9 @@ import com.nimbusds.oauth2.sdk.token.Tokens;
import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
import com.nimbusds.openid.connect.sdk.token.OIDCTokens;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* Action that forms outbound message based on token request and response context. Formed message is set to
* {@link ProfileRequestContext#getOutboundMessageContext()}.
@@ -55,30 +57,36 @@ public class FormOutboundTokenResponseMessage extends AbstractOIDCTokenResponseA
return false;
}
- accessToken = getOidcResponseContext().getAccessToken();
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
+ accessToken = oidcResponseContext.getAccessToken();
if (accessToken == null) {
log.error("{} unable to provide required access token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
- idToken = getOidcResponseContext().getProcessedToken();
+ idToken = oidcResponseContext.getProcessedToken();
return true;
}
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
+
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
final TokenResponse resp;
if (idToken != null) {
resp = new OIDCTokenResponse(
- new OIDCTokens(idToken, accessToken, getOidcResponseContext().getRefreshToken()));
+ new OIDCTokens(idToken, accessToken, oidcResponseContext.getRefreshToken()));
} else {
// No refresh tokens likely here, but just in case.
- resp = new AccessTokenResponse(new Tokens(accessToken, getOidcResponseContext().getRefreshToken()));
+ resp = new AccessTokenResponse(new Tokens(accessToken, oidcResponseContext.getRefreshToken()));
}
- profileRequestContext.getOutboundMessageContext().setMessage(resp);
+ profileRequestContext.ensureOutboundMessageContext().setMessage(resp);
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientID.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientID.java
index d84a7a1c..642b4773 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientID.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientID.java
@@ -26,17 +26,17 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationTokenClaimsContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.token.support.RegistrationClaimsSet;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.security.IdentifierGenerationStrategy;
import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
@@ -86,9 +86,11 @@ public class GenerateClientID extends AbstractProfileAction {
/** Constructor. */
public GenerateClientID() {
relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- oidcResponseContextLookupStrategy = new ChildContextLookup<>(
- OIDCClientRegistrationResponseContext.class).compose(
+ final Function<ProfileRequestContext,OIDCClientRegistrationResponseContext> orcls =
+ new ChildContextLookup<>(OIDCClientRegistrationResponseContext.class).compose(
new OutboundMessageContextLookup());
+ assert orcls != null;
+ oidcResponseContextLookupStrategy = orcls;
registrationTokenContextLookupStrategy = new DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction();
idGeneratorLookupStrategy = FunctionSupport.constant(new SecureRandomIdentifierGenerationStrategy());
xmlSafeIdentifier = true;
@@ -177,6 +179,7 @@ public class GenerateClientID extends AbstractProfileAction {
return false;
}
+ assert rpCtx != null;
if (rpCtx.getProfileConfig() == null) {
log.debug("{} No profile configuration associated with this profile request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
@@ -217,16 +220,20 @@ public class GenerateClientID extends AbstractProfileAction {
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
String clientId = null;
if (registrationTokenCtx != null) {
- clientId = registrationTokenCtx.getClaimsSet().getClientId();
+ final RegistrationClaimsSet claimsSet = registrationTokenCtx.getClaimsSet();
+ if (claimsSet != null) {
+ clientId = claimsSet.getClientId();
+ }
}
if (clientId != null) {
log.debug("{} Using client_id supplied by access token: {}", getLogPrefix(), clientId);
} else {
+ assert idGenerator != null;
clientId = idGenerator.generateIdentifier(xmlSafeIdentifier);
log.debug("{} Created a new client ID: {}", getLogPrefix(), clientId);
}
-
+ assert oidcResponseCtx != null;
oidcResponseCtx.setClientId(clientId);
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientSecret.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientSecret.java
index 434f9476..8c506245 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientSecret.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/GenerateClientSecret.java
@@ -27,12 +27,12 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationResponseContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.security.IdentifierGenerationStrategy;
import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
@@ -167,9 +167,12 @@ public class GenerateClientSecret extends AbstractProfileAction {
final Instant now = Instant.now();
final Instant expiration = now.plus(lifetime);
+ assert idGenerator != null;
final String clientSecret = idGenerator.generateIdentifier(xmlSafeIdentifier);
+ assert oidcResponseCtx != null;
oidcResponseCtx.setClientSecret(clientSecret);
if (expiration.isAfter(now)) {
+ assert oidcResponseCtx != null;
oidcResponseCtx.setClientSecretExpiresAt(expiration);
log.debug("{} Created a new client secret, expiring at {}", getLogPrefix(), expiration);
} else {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContext.java
index e6fdb0c9..21488b15 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContext.java
@@ -26,10 +26,10 @@ import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequest
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestMaxAgeLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedPromptLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.Prompt;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
index 76833b59..bde440db 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
@@ -21,6 +21,7 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.saml.profile.context.navigate.messaging.SAMLMetadataContextLookupFunction;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import java.net.URI;
import java.util.List;
@@ -58,10 +59,10 @@ import org.opensaml.saml.saml2.metadata.impl.EntityDescriptorBuilder;
import org.opensaml.saml.saml2.metadata.impl.ExtensionsBuilder;
import org.opensaml.saml.saml2.metadata.impl.SPSSODescriptorBuilder;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.langtag.LangTag;
import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
/**
@@ -114,13 +115,21 @@ public class InitializeOutboundAuthenticationResponseMessageContext
* Constructor.
*/
public InitializeOutboundAuthenticationResponseMessageContext() {
- oidcMetadataCtxLookupStrategy = new ChildContextLookup<>(OIDCMetadataContext.class).compose(
- new InboundMessageContextLookup());
+ final Function<ProfileRequestContext, OIDCMetadataContext> omcls =
+ new ChildContextLookup<>(OIDCMetadataContext.class).compose(
+ new InboundMessageContextLookup());
+ assert omcls != null;
+ oidcMetadataCtxLookupStrategy = omcls;
relyingPartyCtxLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- samlMetadataCtxLookupStrategy = FunctionSupport.compose(new SAMLMetadataContextLookupFunction(),
- new InboundMessageContextLookup());
- unregisteredClientIdLookupStrategy = FunctionSupport.compose(new DefaultClientIDLookupFunction(),
- new InboundMessageContextLookup());
+ final Function<ProfileRequestContext, SAMLMetadataContext> smcls =
+ FunctionSupport.compose(new SAMLMetadataContextLookupFunction(),
+ new InboundMessageContextLookup());
+ assert smcls != null;
+ samlMetadataCtxLookupStrategy = smcls;
+ final Function<ProfileRequestContext, ClientID> ucils =
+ FunctionSupport.compose(new DefaultClientIDLookupFunction(), new InboundMessageContextLookup());
+ assert ucils != null;
+ unregisteredClientIdLookupStrategy = ucils;
defaultLanguage = "en";
}
@@ -258,8 +267,11 @@ public class InitializeOutboundAuthenticationResponseMessageContext
final SPSSODescriptor spDescriptor = new SPSSODescriptorBuilder().buildObject();
if (oidcMetadataCtx != null) {
- entityDescriptor.setEntityID(oidcMetadataCtx.getClientInformation().getID().getValue());
- populateEntityDescriptor(entityDescriptor, spDescriptor);
+ final OIDCClientInformation clientInformation = oidcMetadataCtx.getClientInformation();
+ if (clientInformation != null) {
+ entityDescriptor.setEntityID(clientInformation.getID().getValue());
+ populateEntityDescriptor(entityDescriptor, spDescriptor, clientInformation);
+ }
} else {
final ClientID clientId = unregisteredClientIdLookupStrategy.apply(profileRequestContext);
if (clientId == null) {
@@ -273,14 +285,15 @@ public class InitializeOutboundAuthenticationResponseMessageContext
samlContext.setEntityDescriptor(entityDescriptor);
samlContext.setRoleDescriptor(spDescriptor);
+ assert relyingPartyCtx != null;
relyingPartyCtx.setRelyingPartyIdContextTree(samlContext);
}
// Checkstyle: CyclomaticComplexity OFF
protected void populateEntityDescriptor(final EntityDescriptor entityDescriptor,
- final SPSSODescriptor spDescriptor) {
- final OIDCClientMetadata oidcMetadata = oidcMetadataCtx.getClientInformation().getOIDCMetadata();
+ final SPSSODescriptor spDescriptor, @Nonnull final OIDCClientInformation clientInformation) {
+ final OIDCClientMetadata oidcMetadata = clientInformation.getOIDCMetadata();
final UIInfo uiInfo = new UIInfoBuilder().buildObject();
for (final LangTag tag : oidcMetadata.getLogoURIEntries().keySet()) {
final Logo logo = new LogoBuilder().buildObject();
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundRegistrationResponseMessageContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundRegistrationResponseMessageContext.java
index 72c1e17c..4d947a0e 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundRegistrationResponseMessageContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundRegistrationResponseMessageContext.java
@@ -22,13 +22,13 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationResponseContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that adds an outbound {@link MessageContext} and related OIDC context
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundResponseMessageContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundResponseMessageContext.java
index 26917fe0..3cdc2c28 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundResponseMessageContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundResponseMessageContext.java
@@ -19,11 +19,11 @@ import javax.annotation.Nonnull;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.Response;
import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that adds an outbound {@link MessageContext} typed to generic {@link Response} to
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRegistrationMetadataPolicyContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRegistrationMetadataPolicyContext.java
index 3bf0dae1..b2657be4 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRegistrationMetadataPolicyContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRegistrationMetadataPolicyContext.java
@@ -28,7 +28,6 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationMetadataPolicyContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCClientRegistrationTokenMetadataPolicyLookupFunction;
@@ -40,6 +39,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Initializes the {@link OIDCClientRegistrationMetadataPolicyContext} and attaches it as a subcontext for the incoming
@@ -79,9 +79,11 @@ public class InitializeRegistrationMetadataPolicyContext extends AbstractProfile
public InitializeRegistrationMetadataPolicyContext() {
profileMetadataPolicyLookupStrategy = new RegistrationMetadataPolicyLookupFunction();
tokenMetadataPolicyLookupStrategy = new DefaultOIDCClientRegistrationTokenMetadataPolicyLookupFunction();
- registrationPolicyContextCreationStrategy =
+ final Function<ProfileRequestContext,OIDCClientRegistrationMetadataPolicyContext> rpccs =
new ChildContextLookup<>(OIDCClientRegistrationMetadataPolicyContext.class, true).compose(
new InboundMessageContextLookup());
+ assert rpccs != null;
+ registrationPolicyContextCreationStrategy = rpccs;
metadataPolicyMergingStrategy = new DefaultMetadataPolicyMergingStrategy();
}
@@ -199,14 +201,15 @@ public class InitializeRegistrationMetadataPolicyContext extends AbstractProfile
final Pair<Map<String, MetadataPolicy>, Boolean> mergedResult =
metadataPolicyMergingStrategy.apply(profileMetadataPolicy, tokenMetadataPolicy);
-
- if (!mergedResult.getSecond()) {
+
+ final Boolean mergingResult = mergedResult != null ? mergedResult.getSecond() : null;
+ if (mergingResult == null || !mergingResult.booleanValue()) {
log.warn("{} Metadata policies from profile and token could not be merged", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return;
}
- final Map<String, MetadataPolicy> mergedPolicy = mergedResult.getFirst();
+ final Map<String, MetadataPolicy> mergedPolicy = mergedResult != null ? mergedResult.getFirst() : null;
if (!metadataPolicyValidationStrategy.test(mergedPolicy)) {
log.warn("{} Merged metadata policy is invalid", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRelyingPartyContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRelyingPartyContext.java
index 8ef77998..9f6426c6 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRelyingPartyContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRelyingPartyContext.java
@@ -30,13 +30,14 @@ import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
/**
* Action that adds a {@link RelyingPartyContext} to the current {@link ProfileRequestContext} tree via a creation
@@ -154,15 +155,21 @@ public class InitializeRelyingPartyContext extends AbstractProfileAction {
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
return;
}
-
- log.debug("Attaching RelyingPartyContext for {}", clientId.getValue());
- rpContext.setRelyingPartyId(clientId.getValue());
+ assert clientId != null;
+ final String clientIdValue = clientId.getValue();
+ log.debug("Attaching RelyingPartyContext for {}", clientIdValue);
+ rpContext.setRelyingPartyId(clientIdValue);
final OIDCMetadataContext oidcContext = oidcMetadataContextLookupStrategy.apply(profileRequestContext);
- if (oidcContext != null && oidcContext.getClientInformation() != null
- && clientId.equals(oidcContext.getClientInformation().getID())) {
- log.debug("{} Setting the rp context verified", getLogPrefix());
- rpContext.setVerified(true);
+ if (oidcContext != null) {
+ final OIDCClientInformation clientInformation = oidcContext.getClientInformation();
+ if (clientInformation != null) {
+ assert clientId != null;
+ if (clientId.equals(clientInformation.getID())) {
+ log.debug("{} Setting the rp context verified", getLogPrefix());
+ rpContext.setVerified(true);
+ }
+ }
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContext.java
index eebfb9f3..7464c332 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeSubjectContext.java
@@ -17,12 +17,14 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import javax.annotation.Nonnull;
import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* An action that creates an {@link SubjectContext} and attaches it to the current {@link ProfileRequestContext}.
@@ -40,8 +42,10 @@ public class InitializeSubjectContext extends AbstractOIDCTokenResponseAction {
if (!super.doPreExecute(profileRequestContext)) {
return false;
}
-
- if (getOidcResponseContext().getAuthorizationGrantClaimsSet() == null) {
+
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ if (oidcResponseContext.getAuthorizationGrantClaimsSet() == null) {
log.warn("{} Subject principal not resolved from prior authorization grant", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_SUBJECT);
return false;
@@ -55,7 +59,11 @@ public class InitializeSubjectContext extends AbstractOIDCTokenResponseAction {
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final SubjectContext subCtx = new SubjectContext();
- subCtx.setPrincipalName(getOidcResponseContext().getAuthorizationGrantClaimsSet().getPrincipal());
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ final TokenClaimsSet tokenClaimsSet = oidcResponseContext.getAuthorizationGrantClaimsSet();
+ assert tokenClaimsSet != null;
+ subCtx.setPrincipalName(tokenClaimsSet.getPrincipal());
// Replace existing context. Generally there will already be a prior context representing
// authentication of the client, so this replacement happens when the client is not the
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeUnverifiedRelyingPartyContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeUnverifiedRelyingPartyContext.java
index ccb7dcbd..e9f6a189 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeUnverifiedRelyingPartyContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeUnverifiedRelyingPartyContext.java
@@ -22,12 +22,12 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that adds a {@link RelyingPartyContext} to the current {@link ProfileRequestContext} tree via a creation
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDToken.java
index 986c0431..244add20 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ManipulateClaimsForIDToken.java
@@ -25,14 +25,15 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.navigate.IDTokenManipulationStrategyLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that can be used for manipulating id_token claims via configurable strategy (bi-function). If the
@@ -88,7 +89,9 @@ public class ManipulateClaimsForIDToken extends AbstractOIDCAuthenticationRespon
return false;
}
- idToken = getOidcResponseContext().getIDToken();
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ idToken = oidcResponseContext.getIDToken();
if (idToken == null) {
log.error("{} No id token", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
@@ -122,7 +125,9 @@ public class ManipulateClaimsForIDToken extends AbstractOIDCAuthenticationRespon
return;
}
log.debug("{} Replacing the id_token with the manipulated contents", getLogPrefix());
- getOidcResponseContext().setIDToken(newIdToken);
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ oidcResponseContext.setIDToken(newIdToken);
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/OIDCMetadataLookupHandler.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/OIDCMetadataLookupHandler.java
index 85a7cf4a..c6baa704 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/OIDCMetadataLookupHandler.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/OIDCMetadataLookupHandler.java
@@ -25,6 +25,7 @@ import net.shibboleth.oidc.metadata.criterion.ClientIDCriterion;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -32,7 +33,6 @@ import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.AbstractMessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
index 148ea975..c450ac36 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
@@ -21,19 +21,22 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.PreferredPrincipalContext;
import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedAcrLookupFunction;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.oidc.profile.config.navigate.AcrClaimAlwaysEssentialLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
import com.nimbusds.openid.connect.sdk.claims.ACR;
import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
+import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
@@ -116,14 +119,19 @@ public class ProcessRequestedAuthnContext extends AbstractOIDCAuthenticationResp
}
acrValues = acrLookupStrategy.apply(profileRequestContext);
- if (getOidcResponseContext().getRequestedClaims() != null
- && getOidcResponseContext().getRequestedClaims().getIDTokenClaimsRequest() != null) {
- for (final Entry entry :
- getOidcResponseContext().getRequestedClaims().getIDTokenClaimsRequest().getEntries()) {
- if (IDTokenClaimsSet.ACR_CLAIM_NAME.equals(entry.getClaimName())) {
- acrClaim = entry;
- break;
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ final OIDCClaimsRequest requestedClaims = oidcResponseContext.getRequestedClaims();
+ if (requestedClaims != null) {
+ final ClaimsSetRequest requestedIdTokenClaims = requestedClaims.getIDTokenClaimsRequest();
+ if (requestedIdTokenClaims != null) {
+ for (final Entry entry : requestedIdTokenClaims.getEntries()) {
+ if (IDTokenClaimsSet.ACR_CLAIM_NAME.equals(entry.getClaimName())) {
+ acrClaim = entry;
+ break;
+ }
}
+
}
}
if ((acrValues == null || acrValues.isEmpty()) && (acrClaim == null
@@ -152,20 +160,26 @@ public class ProcessRequestedAuthnContext extends AbstractOIDCAuthenticationResp
boolean isEssential = false;
if (acrValues != null && !acrValues.isEmpty()) {
for (final ACR acr : acrValues) {
- log.debug("{} Located acr value {} in request", getLogPrefix(), acr.getValue());
- principals.add(new AuthenticationContextClassReferencePrincipal(acr.getValue()));
+ assert acr != null;
+ final String acrValue = acr.getValue();
+ assert acrValue != null;
+ log.debug("{} Located acr value {} in request", getLogPrefix(), acrValue);
+ principals.add(new AuthenticationContextClassReferencePrincipal(acrValue));
}
} else if (acrClaim != null && acrClaim.getValueAsString() != null) {
isEssential = acrClaim.getClaimRequirement().equals(ClaimRequirement.ESSENTIAL);
log.debug("{} Located {} acr claim {} in id token section of claims request", getLogPrefix(),
acrClaim.getClaimRequirement().toString(), acrClaim.getValueAsString());
- principals.add(new AuthenticationContextClassReferencePrincipal(acrClaim.getValueAsString()));
+ final String acrClaimValue = acrClaim.getValueAsString();
+ assert acrClaimValue != null;
+ principals.add(new AuthenticationContextClassReferencePrincipal(acrClaimValue));
} else if (acrClaim != null && !(acrClaim.getValueAsString() != null
&& acrClaim.getValueAsString().isEmpty())) {
isEssential = acrClaim.getClaimRequirement().equals(ClaimRequirement.ESSENTIAL);
for (final String acr : acrClaim.getValuesAsListOfStrings()) {
log.debug("{} Located {} acr claim {} in id token section of claims request", getLogPrefix(),
acrClaim.getClaimRequirement().toString(), acr);
+ assert acr != null;
principals.add(new AuthenticationContextClassReferencePrincipal(acr));
}
}
@@ -177,12 +191,14 @@ public class ProcessRequestedAuthnContext extends AbstractOIDCAuthenticationResp
final RequestedPrincipalContext rpCtx = new RequestedPrincipalContext();
rpCtx.setOperator(AuthnContextComparisonTypeEnumeration.EXACT.toString());
rpCtx.setRequestedPrincipals(principals);
+ assert authenticationContext != null;
authenticationContext.addSubcontext(rpCtx, true);
log.debug("{} Created requested principal context", getLogPrefix());
return;
}
final PreferredPrincipalContext ppCtx = new PreferredPrincipalContext();
ppCtx.setPreferredPrincipals(principals);
+ assert authenticationContext != null;
authenticationContext.addSubcontext(ppCtx, true);
log.debug("{} Created preferred principal context", getLogPrefix());
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext.java
index ed06556f..95e1b16a 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContext.java
@@ -20,9 +20,10 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that sets authentication context class reference to work context {@link OIDCAuthenticationResponseContext}
@@ -45,7 +46,9 @@ public class SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContex
return false;
}
- if (getOidcResponseContext().getAuthorizationGrantClaimsSet() == null) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ if (oidcResponseContext.getAuthorizationGrantClaimsSet() == null) {
log.warn("{} No claims found from prior authorization grant", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
@@ -56,7 +59,11 @@ public class SetAuthenticationContextClassReferenceFromAuthzCodeToResponseContex
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- getOidcResponseContext().setAcr(getOidcResponseContext().getAuthorizationGrantClaimsSet().getACR());
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ final TokenClaimsSet tokenClaimsSet = oidcResponseContext.getAuthorizationGrantClaimsSet();
+ assert tokenClaimsSet != null;
+ oidcResponseContext.setAcr(tokenClaimsSet.getACR());
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java
index 31836254..a8e21b80 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationContextClassReferenceToResponseContext.java
@@ -18,8 +18,8 @@ import java.security.Principal;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import net.shibboleth.idp.authn.AuthenticationResult;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.impl.DefaultPrincipalDeterminationStrategy;
import net.shibboleth.idp.authn.context.AuthenticationContext;
@@ -30,11 +30,11 @@ import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePr
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Action that sets authentication context class reference to work context {@link OIDCAuthenticationResponseContext}
@@ -46,15 +46,6 @@ public class SetAuthenticationContextClassReferenceToResponseContext extends Abs
@Nonnull
private Logger log = LoggerFactory.getLogger(SetAuthenticationContextClassReferenceToResponseContext.class);
- /** Authentication context. */
- @Nullable private AuthenticationContext authCtx;
-
- /** requested principal context. */
- @Nullable private RequestedPrincipalContext requestedPrincipalContext;
-
- /** preferred principal context. */
- @Nullable private PreferredPrincipalContext preferredPrincipalContext;
-
/** Strategy used to determine the AuthnContextClassRef. */
@NonnullAfterInit
private Function<ProfileRequestContext, AuthenticationContextClassReferencePrincipal> classRefLookupStrategy;
@@ -93,15 +84,12 @@ public class SetAuthenticationContextClassReferenceToResponseContext extends Abs
return false;
}
- authCtx = profileRequestContext.getSubcontext(AuthenticationContext.class);
- if (authCtx == null) {
+ if (profileRequestContext.getSubcontext(AuthenticationContext.class) == null) {
log.error("{} No authentication context", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
return false;
}
-
- requestedPrincipalContext = authCtx.getSubcontext(RequestedPrincipalContext.class);
- preferredPrincipalContext = authCtx.getSubcontext(PreferredPrincipalContext.class);
+
return true;
}
@@ -112,27 +100,42 @@ public class SetAuthenticationContextClassReferenceToResponseContext extends Abs
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
String name = null;
- if (requestedPrincipalContext != null && requestedPrincipalContext.getMatchingPrincipal() != null
- && requestedPrincipalContext
- .getMatchingPrincipal() instanceof AuthenticationContextClassReferencePrincipal) {
- name = requestedPrincipalContext.getMatchingPrincipal().getName();
+ final RequestedPrincipalContext requestedPrincipalContext =
+ profileRequestContext.ensureSubcontext(AuthenticationContext.class)
+ .getSubcontext(RequestedPrincipalContext.class);
+
+ final PreferredPrincipalContext preferredPrincipalContext =
+ profileRequestContext.ensureSubcontext(AuthenticationContext.class)
+ .getSubcontext(PreferredPrincipalContext.class);
+
+ final Principal matchingPrincipal = requestedPrincipalContext != null ?
+ requestedPrincipalContext.getMatchingPrincipal() : null;
+ if (matchingPrincipal != null && matchingPrincipal instanceof AuthenticationContextClassReferencePrincipal) {
+ name = matchingPrincipal.getName();
log.debug("{} Setting acr based on requested ctx", getLogPrefix());
- } else if (preferredPrincipalContext != null && authCtx.getAuthenticationResult() != null) {
- for (final Principal acr : preferredPrincipalContext.getPreferredPrincipals()) {
- if (authCtx.getAuthenticationResult()
- .getSupportedPrincipals(AuthenticationContextClassReferencePrincipal.class).contains(acr)) {
- name = acr.getName();
- log.debug("{} Setting acr based on preferred ctx", getLogPrefix());
- break;
+ } else if (preferredPrincipalContext != null) {
+ final AuthenticationResult authenticationResult =
+ profileRequestContext.ensureSubcontext(AuthenticationContext.class).getAuthenticationResult();
+ if (authenticationResult != null) {
+ for (final Principal acr : preferredPrincipalContext.getPreferredPrincipals()) {
+ if (authenticationResult.getSupportedPrincipals(AuthenticationContextClassReferencePrincipal.class)
+ .contains(acr)) {
+ name = acr.getName();
+ log.debug("{} Setting acr based on preferred ctx", getLogPrefix());
+ break;
+ }
}
}
+
}
if (name == null) {
name = classRefLookupStrategy.apply(profileRequestContext).getName();
log.debug("{} Setting acr based on performed flow", getLogPrefix());
}
- if (name != null && !name.equals(AuthenticationContextClassReferencePrincipal.UNSPECIFIED)) {
- getOidcResponseContext().setAcr(name);
+ if (!name.equals(AuthenticationContextClassReferencePrincipal.UNSPECIFIED)) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ oidcResponseContext.setAcr(name);
log.debug("{} Setting acr to {}", getLogPrefix(), name);
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationTimeToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationTimeToResponseContext.java
index 39d00628..66f1fd01 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationTimeToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthenticationTimeToResponseContext.java
@@ -22,12 +22,12 @@ import javax.annotation.Nonnull;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultAuthTimeLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Action that sets authentication instant to work context {@link OIDCAuthenticationResponseContext} located under
@@ -70,7 +70,9 @@ public class SetAuthenticationTimeToResponseContext extends AbstractOIDCResponse
}
log.debug("{} Setting authentication time to {}", getLogPrefix(), value);
- getOidcResponseContext().setAuthTime(value);
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ oidcResponseContext.setAuthTime(value);
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContext.java
index 3515dbc0..943b714f 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentFromTokenToResponseContext.java
@@ -24,8 +24,6 @@ import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestCo
import net.shibboleth.shared.logic.Constraint;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Action that locates consent from authorization code / access token. For located consent
@@ -34,9 +32,6 @@ import org.slf4j.LoggerFactory;
*/
public class SetConsentFromTokenToResponseContext extends AbstractOIDCResponseAction {
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(SetConsentFromTokenToResponseContext.class);
-
/** Strategy used to obtain the consented attributes. */
@Nonnull private Function<ProfileRequestContext, List<Object>> consentedAttributesLookupStrategy;
@@ -64,8 +59,10 @@ public class SetConsentFromTokenToResponseContext extends AbstractOIDCResponseAc
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final List<Object> consentedAttributes = consentedAttributesLookupStrategy.apply(profileRequestContext);
if (consentedAttributes != null) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
final OIDCAuthenticationResponseConsentContext consentClaimsCtx =
- getOidcResponseContext().ensureSubcontext(OIDCAuthenticationResponseConsentContext.class);
+ oidcResponseContext.ensureSubcontext(OIDCAuthenticationResponseConsentContext.class);
consentClaimsCtx.getConsentedAttributes().addAll(consentedAttributes);
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContext.java
index 8ed8832c..281d490d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetConsentToResponseContext.java
@@ -24,7 +24,6 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
@@ -33,6 +32,7 @@ import net.shibboleth.oidc.profile.config.logic.AttributeConsentFlowEnabledPredi
import net.shibboleth.oidc.profile.config.logic.EncodeConsentPredicate;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.context.AttributeContext;
@@ -65,9 +65,12 @@ public class SetConsentToResponseContext extends AbstractOIDCResponseAction {
@Nullable private AttributeContext attributeCtx;
/** Constructor. */
- SetConsentToResponseContext() {
- attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
- new ChildContextLookup<>(RelyingPartyContext.class));
+ public SetConsentToResponseContext() {
+ final Function<ProfileRequestContext,AttributeContext> acls =
+ new ChildContextLookup<>(AttributeContext.class).compose(
+ new ChildContextLookup<>(RelyingPartyContext.class));
+ assert acls != null;
+ attributeContextLookupStrategy = acls;
consentEnabledPredicate = new AttributeConsentFlowEnabledPredicate();
encodeConsentPredicate = new EncodeConsentPredicate();
}
@@ -126,7 +129,7 @@ public class SetConsentToResponseContext extends AbstractOIDCResponseAction {
log.debug("{} No AttributeSubcontext available, nothing to do", getLogPrefix());
return false;
}
-
+ assert attributeCtx != null;
if (!attributeCtx.isConsented() && !encodeConsentPredicate.test(profileRequestContext)) {
log.debug("{} Consent is not being encoded into tokens, nothing to do", getLogPrefix());
return false;
@@ -139,9 +142,12 @@ public class SetConsentToResponseContext extends AbstractOIDCResponseAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
final OIDCAuthenticationResponseConsentContext oidcConsentCtx =
- getOidcResponseContext().ensureSubcontext(OIDCAuthenticationResponseConsentContext.class);
+ oidcResponseContext.ensureSubcontext(OIDCAuthenticationResponseConsentContext.class);
+ assert attributeCtx != null;
final Map<String, IdPAttribute> consented = attributeCtx.getIdPAttributes();
oidcConsentCtx.getConsentedAttributes().addAll(consented.keySet());
log.debug("{} Set to response context consented attributes {} and consentable attributes {}", getLogPrefix(),
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java
index 4299089e..92628d16 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRefreshTokenToResponseContext.java
@@ -29,7 +29,6 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.storage.RevocationCache;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -51,6 +50,7 @@ import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.security.DataSealer;
import net.shibboleth.shared.security.DataSealerException;
@@ -295,7 +295,9 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
return false;
}
- tokenClaimsSet = getOidcResponseContext().getAuthorizationGrantClaimsSet();
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ tokenClaimsSet = oidcResponseContext.getAuthorizationGrantClaimsSet();
if (tokenClaimsSet == null || !(tokenClaimsSet instanceof RefreshTokenClaimsSet)
&& !(tokenClaimsSet instanceof AuthorizeCodeClaimsSet)) {
log.error("{} No token to base refresh on", getLogPrefix());
@@ -323,30 +325,45 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final Instant chainExp = calculateChainExp();
- final Instant tokenExp = Instant.now().plus(refreshTokenTimeout);
-
- final String rootTokenId = StringSupport.trimOrNull(tokenClaimsSet.getRootTokenIdentifier()) == null ?
- tokenClaimsSet.getID() : tokenClaimsSet.getRootTokenIdentifier();
- final RefreshTokenClaimsSet claimsSet =
- new RefreshTokenClaimsSet.Builder(tokenClaimsSet, Instant.now(),
- chainExp.isBefore(tokenExp) ? chainExp : tokenExp, chainExp)
- .setJWTID(idGenerator, xmlSafeIdentifier)
- .setRootTokenIdentifier(rootTokenId)
- .build();
+ final TokenClaimsSet nonNullClaimsSet = tokenClaimsSet;
+ assert nonNullClaimsSet != null;
+
+ final Instant now = Instant.now();
+ assert now != null;
+ @Nonnull final Instant chainExp = calculateChainExp(nonNullClaimsSet);
+ final Instant tokenExp = now.plus(refreshTokenTimeout);
+ assert tokenExp != null;
+
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
+ final String rootTokenId = StringSupport.trimOrNull(nonNullClaimsSet.getRootTokenIdentifier()) == null ?
+ nonNullClaimsSet.getID() : nonNullClaimsSet.getRootTokenIdentifier();
+ final RefreshTokenClaimsSet.Builder builder = new RefreshTokenClaimsSet.Builder(nonNullClaimsSet, now,
+ chainExp.isBefore(tokenExp) ? chainExp : tokenExp, chainExp);
+
+ assert idGenerator != null;
+ builder.setJWTID(idGenerator, xmlSafeIdentifier);
+ builder.setRootTokenIdentifier(rootTokenId);
+ final RefreshTokenClaimsSet claimsSet = builder.build();
if (manipulationStrategy != null) {
log.debug("{} Manipulation strategy has been set, applying it to the claims set {}", getLogPrefix(),
claimsSet.serialize());
+ final JWTClaimsSet innerClaimsSet = claimsSet.getClaimsSet();
+ assert innerClaimsSet != null;
+ assert manipulationStrategy != null;
final Map<String, Object> result = manipulationStrategy.apply(profileRequestContext,
- claimsSet.getClaimsSet().toJSONObject());
+ innerClaimsSet.toJSONObject());
if (result == null) {
log.debug("{} Manipulation strategy returned null, leaving token claims set untouched.",
getLogPrefix());
} else {
log.debug("{} Applying the manipulated claims into the token claims set", getLogPrefix());
try {
- claimsSet.setClaimsSet(JWTClaimsSet.parse(result));
+ final JWTClaimsSet manipulatedClaimsSet = JWTClaimsSet.parse(result);
+ assert manipulatedClaimsSet != null;
+ claimsSet.setClaimsSet(manipulatedClaimsSet);
} catch (final ParseException e) {
log.error("{} The resulted claims set could not be transformed into ", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
@@ -358,7 +375,7 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
}
if (StringSupport.trimOrNull(refreshTokenType) == null) {
try {
- getOidcResponseContext().setRefreshToken(claimsSet.serialize(dataSealer));
+ oidcResponseContext.setRefreshToken(claimsSet.serialize(dataSealer));
} catch (final DataSealerException e) {
log.error("{} Refresh Token generation failed {}", getLogPrefix(), e.getMessage());
ActionSupport.buildEvent(profileRequestContext, EventIds.UNABLE_TO_ENCRYPT);
@@ -380,15 +397,16 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return;
}
- getOidcResponseContext().setRefreshToken(serializedToken);
+ oidcResponseContext.setRefreshToken(serializedToken);
}
log.debug("{} Setting refresh token {} as {} to response context ", getLogPrefix(), claimsSet.serialize(),
- getOidcResponseContext().getRefreshToken());
+ oidcResponseContext.getRefreshToken());
if (enforceRefreshTokenRotationCondition.test(profileRequestContext) &&
tokenClaimsSet instanceof RefreshTokenClaimsSet) {
final String jti = tokenClaimsSet.getID();
- final Duration lifetime = tokenRevocationLifetimeLookupStrategy.apply(tokenClaimsSet.getClaimsSet());
+ assert jti != null;
+ final Duration lifetime = tokenRevocationLifetimeLookupStrategy.apply(nonNullClaimsSet.getClaimsSet());
if (lifetime == null || Duration.ZERO.equals(lifetime)) {
log.error("{} Unable to fetch lifetime for the single token revocation", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
@@ -411,11 +429,11 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
* @param claimsSet the claims set input
* @return the existing value if exists, null otherwise
*/
- protected Instant getExistingChainExp(final JWTClaimsSet claimsSet) {
- if (claimsSet.getClaims().containsKey(RefreshTokenClaimsSet.KEY_CHAIN_EXPIRATION_TIME)) {
+ protected Instant getExistingChainExp(@Nonnull final TokenClaimsSet tokenClaimsSet) {
+ final JWTClaimsSet claimsSet = tokenClaimsSet.getClaimsSet();
+ if (claimsSet != null && claimsSet.getClaims().containsKey(RefreshTokenClaimsSet.KEY_CHAIN_EXPIRATION_TIME)) {
try {
- return tokenClaimsSet.getClaimsSet()
- .getDateClaim(RefreshTokenClaimsSet.KEY_CHAIN_EXPIRATION_TIME).toInstant();
+ return claimsSet.getDateClaim(RefreshTokenClaimsSet.KEY_CHAIN_EXPIRATION_TIME).toInstant();
} catch (ParseException e) {
log.warn("{} Could not parse the chain expiration time from the claims set", e);
}
@@ -427,12 +445,17 @@ public class SetRefreshTokenToResponseContext extends AbstractOIDCResponseAction
* Calculates the chain expiration time by taking the closest from the existing item in the claims set (if exists)
* and the value calculated via current profile configuration.
*
+ * @param tokenClaimsSet The claims set to operate on. If it doesn't contain authentication time, the chain
+ * expiration time is set to now.
+ *
* @return the instant to be used as the chain expiration time
*/
- protected Instant calculateChainExp() {
- final Instant chainExp = tokenClaimsSet.getAuthenticationTime().plus(refreshTokenChainLifetime);
- final Instant existingChainExp = getExistingChainExp(tokenClaimsSet.getClaimsSet());
+ @Nonnull protected Instant calculateChainExp(@Nonnull final TokenClaimsSet tokenClaimsSet) {
+ final Instant authnTime = tokenClaimsSet.getAuthenticationTime();
+ final Instant chainExp = authnTime != null ? authnTime.plus(refreshTokenChainLifetime) : Instant.now();
+ final Instant existingChainExp = getExistingChainExp(tokenClaimsSet);
if (existingChainExp == null) {
+ assert chainExp != null;
return chainExp;
}
return chainExp.isBefore(existingChainExp) ? chainExp : existingChainExp;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
index 6f661c42..7121a890 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
@@ -23,7 +23,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.collect.HashMultimap;
import com.google.common.collect.Multimap;
@@ -38,12 +37,14 @@ import net.shibboleth.idp.attribute.transcoding.AttributeTranscoder;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.attribute.transcoding.TranscoderSupport;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedClaimsLookupFunction;
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.service.ReloadableService;
import net.shibboleth.shared.service.ServiceException;
import net.shibboleth.shared.service.ServiceableComponent;
@@ -108,12 +109,15 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
+
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
final OIDCClaimsRequest cr = requestedClaimsLookupStrategy.apply(profileRequestContext);
- getOidcResponseContext().setRequestedClaims(cr);
+ oidcResponseContext.setRequestedClaims(cr);
if (cr == null) {
- getOidcResponseContext().setMappedIdTokenRequestedClaims(null);
- getOidcResponseContext().setMappedUserinfoRequestedClaims(null);
+ oidcResponseContext.setMappedIdTokenRequestedClaims(null);
+ oidcResponseContext.setMappedUserinfoRequestedClaims(null);
return;
}
@@ -126,6 +130,7 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
// out.
Multimap<String,IdPAttribute> results = HashMultimap.create();
+ assert results != null;
if (cr.getIDTokenClaimsRequest() != null) {
for (final ClaimsSetRequest.Entry entry : cr.getIDTokenClaimsRequest().getEntries()) {
@@ -137,10 +142,11 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
decodeAttribute(profileRequestContext, transcodingRules, wrapper, results);
}
}
- getOidcResponseContext().setMappedIdTokenRequestedClaims(results.isEmpty() ? null :
+ oidcResponseContext.setMappedIdTokenRequestedClaims(results.isEmpty() ? null :
new AttributesMapContainer(results));
results = HashMultimap.create();
+ assert results != null;
if (cr.getUserInfoClaimsRequest() != null) {
for (final ClaimsSetRequest.Entry entry : cr.getUserInfoClaimsRequest().getEntries()) {
@@ -152,7 +158,7 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
decodeAttribute(profileRequestContext, transcodingRules, wrapper, results);
}
}
- getOidcResponseContext().setMappedUserinfoRequestedClaims(results.isEmpty() ? null :
+ oidcResponseContext.setMappedUserinfoRequestedClaims(results.isEmpty() ? null :
new AttributesMapContainer(results));
} catch (final ServiceException e) {
@@ -174,6 +180,7 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
@Nonnull @NonnullElements @Live final Multimap<String,IdPAttribute> results) {
for (final TranscodingRule rule : rules) {
+ assert rule != null;
final AttributeTranscoder<JSONObject> transcoder = TranscoderSupport.getTranscoder(rule);
try {
final IdPAttribute decodedAttribute = transcoder.decode(profileRequestContext, input, rule);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContext.java
index 0b79305b..020fa8f7 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedSubjectToResponseContext.java
@@ -23,12 +23,15 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* Action that sets requested sub value to response context. Value may be in id token hint or in claims parameter (that
* may be in request object also). If value is in both, claims value will be used. Multiple values for subject in claims
@@ -40,7 +43,7 @@ public class SetRequestedSubjectToResponseContext extends AbstractOIDCAuthentica
@Nonnull private Logger log = LoggerFactory.getLogger(SetRequestedSubjectToResponseContext.class);
/** id token claims in requested claims. */
- @Nonnull private Collection<Entry> idTokenClaims;
+ @Nullable private Collection<Entry> idTokenClaims;
/** id token hint. */
@Nullable private JWT idTokenHint;
@@ -51,11 +54,14 @@ public class SetRequestedSubjectToResponseContext extends AbstractOIDCAuthentica
if (!super.doPreExecute(profileRequestContext)) {
return false;
}
-
- if (getOidcResponseContext().getRequestedClaims() != null) {
- final OIDCClaimsRequest claimsRequest = getOidcResponseContext().getRequestedClaims();
- if (claimsRequest.getIDTokenClaimsRequest() != null) {
- idTokenClaims = getOidcResponseContext().getRequestedClaims().getIDTokenClaimsRequest().getEntries();
+
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
+ if (oidcResponseContext.getRequestedClaims() != null) {
+ final OIDCClaimsRequest claimsRequest = oidcResponseContext.getRequestedClaims();
+ if (claimsRequest != null && claimsRequest.getIDTokenClaimsRequest() != null) {
+ idTokenClaims = claimsRequest.getIDTokenClaimsRequest().getEntries();
}
}
idTokenHint = getAuthenticationRequest().getIDTokenHint();
@@ -69,20 +75,26 @@ public class SetRequestedSubjectToResponseContext extends AbstractOIDCAuthentica
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (idTokenClaims != null && !idTokenClaims.isEmpty()) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
+ if (idTokenClaims != null) {
for (final Entry entry : idTokenClaims) {
if (IDTokenClaimsSet.SUB_CLAIM_NAME.equals(entry.getClaimName())) {
log.debug("{} Setting requested sub claim value {}", getLogPrefix(), entry.getValueAsString());
- getOidcResponseContext().setRequestedSubject(entry.getValueAsString());
+ oidcResponseContext.setRequestedSubject(entry.getValueAsString());
return;
}
}
}
try {
- if (idTokenHint != null && idTokenHint.getJWTClaimsSet() != null) {
- log.debug("{} Setting requested sub claim value {}", getLogPrefix(),
- idTokenHint.getJWTClaimsSet().getSubject());
- getOidcResponseContext().setRequestedSubject(idTokenHint.getJWTClaimsSet().getSubject());
+ if (idTokenHint != null) {
+ final JWTClaimsSet claimsSet = idTokenHint.getJWTClaimsSet();
+ if (claimsSet != null) {
+ log.debug("{} Setting requested sub claim value {}", getLogPrefix(),
+ claimsSet.getSubject());
+ oidcResponseContext.setRequestedSubject(claimsSet.getSubject());
+ }
}
} catch (final ParseException e) {
log.error("{} error parsing id token hint", getLogPrefix(), e);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetResponseStatusCodeFromEvent.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetResponseStatusCodeFromEvent.java
index eb12ef6b..2f6958aa 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetResponseStatusCodeFromEvent.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetResponseStatusCodeFromEvent.java
@@ -21,17 +21,18 @@ import java.util.Map;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.apache.hc.core5.http.HttpStatus;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.EventContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.CurrentOrPreviousEventLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* This action reads an event from the configured {@link EventContext} lookup strategy and sets the status code for
@@ -46,7 +47,7 @@ public class SetResponseStatusCodeFromEvent extends AbstractProfileAction {
@Nonnull private Function<ProfileRequestContext,EventContext> eventContextLookupStrategy;
/** Map of eventIds to status codes. */
- @Nullable private Map<String, Integer> mappedErrors;
+ @Nonnull private Map<String, Integer> mappedErrors;
/** The status code for unmapped events. */
private int defaultCode;
@@ -96,13 +97,21 @@ public class SetResponseStatusCodeFromEvent extends AbstractProfileAction {
log.error("{} No event to be included in the response, nothing to do", getLogPrefix());
return;
}
- final String event = eventCtx.getEvent().toString();
- if (mappedErrors.containsKey(event)) {
- log.debug("{} Found mapped event for {}", getLogPrefix(), event);
- getHttpServletResponse().setStatus(mappedErrors.get(event));
+ final HttpServletResponse httpServletResponse = getHttpServletResponse();
+ if (httpServletResponse == null) {
+ log.error("{} Cannot set response status code as httpServletResponse is not available", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return;
+ }
+ final Object event = eventCtx.getEvent();
+ assert event != null;
+ final String eventValue = event.toString();
+ if (mappedErrors.containsKey(eventValue)) {
+ log.debug("{} Found mapped event for {}", getLogPrefix(), eventValue);
+ httpServletResponse.setStatus(mappedErrors.get(eventValue));
} else {
- log.debug("{} No mapping found for {}, default status code {} set", getLogPrefix(), event, defaultCode);
- getHttpServletResponse().setStatus(defaultCode);
+ log.debug("{} No mapping found for {}, default status code {} set", getLogPrefix(), eventValue, defaultCode);
+ httpServletResponse.setStatus(defaultCode);
}
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSectorIdentifierForAttributeResolution.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSectorIdentifierForAttributeResolution.java
index 024a1c4e..8ff627a7 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSectorIdentifierForAttributeResolution.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSectorIdentifierForAttributeResolution.java
@@ -22,11 +22,11 @@ import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.SectorIdentifi
import net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultSubjectTypeStrategy;
import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.SubjectType;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSessionIdToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSessionIdToResponseContext.java
index fcef016f..d09736cb 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSessionIdToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSessionIdToResponseContext.java
@@ -21,11 +21,11 @@ import javax.annotation.Nonnull;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestSessionIdLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Action that locates session id using configurable lookup strategy. Located session id is set to
@@ -64,7 +64,9 @@ public class SetSessionIdToResponseContext extends AbstractOIDCResponseAction {
log.debug("{} Session id value did not exist", getLogPrefix());
} else {
log.debug("{} Setting session id value to {}", getLogPrefix(), sessionId);
- getOidcResponseContext().setSessionId(sessionId);
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ oidcResponseContext.setSessionId(sessionId);
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContext.java
index 306cb40d..4245e0e0 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetSubjectToResponseContext.java
@@ -17,16 +17,17 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestSubjectLookupFunction;
import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.SubjectType;
@@ -42,10 +43,7 @@ public class SetSubjectToResponseContext extends AbstractOIDCResponseAction {
@Nonnull private Function<ProfileRequestContext, String> subjectLookupStrategy;
/** Strategy used to determine the subject type to try. */
- @Nonnull private Function<ProfileRequestContext, SubjectType> subjectTypeStrategy;
-
- /** Subject type. */
- @Nonnull private SubjectType subjectType;
+ @Nullable private Function<ProfileRequestContext, SubjectType> subjectTypeStrategy;
/**
* Constructor.
@@ -83,9 +81,11 @@ public class SetSubjectToResponseContext extends AbstractOIDCResponseAction {
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_SUBJECT);
return;
}
- getOidcResponseContext().setSubject(subject);
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ oidcResponseContext.setSubject(subject);
if (subjectTypeStrategy != null) {
- getOidcResponseContext()
+ oidcResponseContext
.setSubjectType(SubjectType.PUBLIC.equals(subjectTypeStrategy.apply(profileRequestContext))
? "public" : "pairwise");
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesFromTokenToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesFromTokenToResponseContext.java
index 76acae93..d1284480 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesFromTokenToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesFromTokenToResponseContext.java
@@ -27,8 +27,6 @@ import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestUs
import net.shibboleth.shared.logic.Constraint;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
@@ -39,17 +37,14 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
**/
public class SetTokenDeliveryAttributesFromTokenToResponseContext extends AbstractOIDCResponseAction {
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(SetTokenDeliveryAttributesFromTokenToResponseContext.class);
-
/** Strategy used to obtain the delivery claims. */
@Nonnull private Function<ProfileRequestContext, ClaimsSet> deliveryClaimsLookupStrategy;
/** Strategy used to obtain the id token delivery claims. */
- @Nonnull private Function<ProfileRequestContext, ClaimsSet> idTokenDeliveryClaimsLookupStrategy;
+ @Nullable private Function<ProfileRequestContext, ClaimsSet> idTokenDeliveryClaimsLookupStrategy;
/** Strategy used to obtain the user info delivery claims. */
- @Nonnull private Function<ProfileRequestContext, ClaimsSet> userinfoDeliveryClaimsLookupStrategy;
+ @Nullable private Function<ProfileRequestContext, ClaimsSet> userinfoDeliveryClaimsLookupStrategy;
/**
* Constructor.
@@ -96,27 +91,29 @@ public class SetTokenDeliveryAttributesFromTokenToResponseContext extends Abstra
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- ClaimsSet claims = deliveryClaimsLookupStrategy.apply(profileRequestContext);
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ final ClaimsSet claims = deliveryClaimsLookupStrategy.apply(profileRequestContext);
if (claims != null) {
final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
- getOidcResponseContext().ensureSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
+ oidcResponseContext.ensureSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
tokenClaimsCtx.getClaims().putAll(claims);
}
if (idTokenDeliveryClaimsLookupStrategy != null) {
- claims = idTokenDeliveryClaimsLookupStrategy.apply(profileRequestContext);
- if (claims != null) {
- final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx = getOidcResponseContext()
+ final ClaimsSet idTokenClaims = idTokenDeliveryClaimsLookupStrategy.apply(profileRequestContext);
+ if (idTokenClaims != null) {
+ final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx = oidcResponseContext
.ensureSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
- tokenClaimsCtx.getIdtokenClaims().putAll(claims);
+ tokenClaimsCtx.getIdtokenClaims().putAll(idTokenClaims);
}
}
if (userinfoDeliveryClaimsLookupStrategy != null) {
- claims = userinfoDeliveryClaimsLookupStrategy.apply(profileRequestContext);
- if (claims != null) {
- final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx = getOidcResponseContext()
+ final ClaimsSet userInfoClaims = userinfoDeliveryClaimsLookupStrategy.apply(profileRequestContext);
+ if (userInfoClaims != null) {
+ final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx = oidcResponseContext
.ensureSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
- tokenClaimsCtx.getUserinfoClaims().putAll(claims);
+ tokenClaimsCtx.getUserinfoClaims().putAll(userInfoClaims);
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
index 69e8fc5a..9d0096b8 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetTokenDeliveryAttributesToResponseContext.java
@@ -42,6 +42,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.service.ReloadableService;
import net.shibboleth.shared.service.ServiceableComponent;
@@ -49,7 +50,6 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Action that checks for any released attributes marked for token delivery. For such attributes
@@ -99,8 +99,11 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
/** Constructor. */
SetTokenDeliveryAttributesToResponseContext() {
- attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
- new ChildContextLookup<>(RelyingPartyContext.class));
+ final Function<ProfileRequestContext,AttributeContext> acls =
+ new ChildContextLookup<>(AttributeContext.class).compose(
+ new ChildContextLookup<>(RelyingPartyContext.class));
+ assert acls != null;
+ attributeContextLookupStrategy = acls;
encodedAttributesLookupStrategy = new EncodedAttributesLookupFunction();
alwaysIncludedAttributesLookupStrategy = new AlwaysIncludedAttributesLookupFunction();
deniedUserInfoAttributesLookupStrategy = new DeniedUserInfoAttributesLookupFunction();
@@ -234,11 +237,14 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
try (final ServiceableComponent<AttributeTranscoderRegistry> component =
transcoderRegistry.getServiceableComponent()) {
+ assert attributeCtx != null;
for (final IdPAttribute attribute : attributeCtx.getIdPAttributes().values()) {
- if (attribute != null && !attribute.getValues().isEmpty() &&
- encodedAttributes.contains(attribute.getId())) {
- // This will generate the claims and add them to the appropriate claims sets.
- encodeAttribute(component.getComponent(), profileRequestContext, attribute);
+ if (attribute != null && !attribute.getValues().isEmpty()) {
+ assert encodedAttributes != null;
+ if (encodedAttributes.contains(attribute.getId())) {
+ // This will generate the claims and add them to the appropriate claims sets.
+ encodeAttribute(component.getComponent(), profileRequestContext, attribute);
+ }
}
}
} catch (final AttributeEncodingException e) {
@@ -261,7 +267,10 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
private void encodeAttribute(@Nonnull final AttributeTranscoderRegistry registry,
@Nonnull final ProfileRequestContext profileRequestContext, @Nonnull final IdPAttribute attribute)
throws AttributeEncodingException {
-
+
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
final Collection<TranscodingRule> transcodingRules = registry.getTranscodingRules(attribute, JSONObject.class);
if (transcodingRules.isEmpty()) {
log.debug("{} Attribute {} does not have any transcoding rules, nothing to do", getLogPrefix(),
@@ -270,18 +279,23 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
}
final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
- getOidcResponseContext().ensureSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
+ oidcResponseContext.ensureSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
final AttributesMapContainer requestedToIdTokenContainer =
- getOidcResponseContext().getMappedIdTokenRequestedClaims();
+ oidcResponseContext.getMappedIdTokenRequestedClaims();
for (final TranscodingRule rule : transcodingRules) {
+ assert rule != null;
try {
final AttributeTranscoder<JSONObject> transcoder = TranscoderSupport.<JSONObject>getTranscoder(rule);
final boolean requestedToIdToken = requestedToIdTokenContainer != null
&& requestedToIdTokenContainer.get().containsKey(attribute.getId());
- if (alwaysIncludedAttributes.contains(attribute.getId()) &&
- !deniedUserInfoAttributes.contains(attribute.getId())) {
+ assert alwaysIncludedAttributes != null;
+ final boolean alwaysIncluded = alwaysIncludedAttributes.contains(attribute.getId());
+ assert deniedUserInfoAttributes != null;
+ final boolean userInfoDenied = deniedUserInfoAttributes.contains(attribute.getId());
+
+ if (alwaysIncluded && !userInfoDenied) {
// Deliver for UserInfo and ID token
final JSONObject encodedAttribute =
transcoder.encode(profileRequestContext, attribute, JSONObject.class, rule);
@@ -289,7 +303,7 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
encodedAttribute.keySet().forEach(
k -> tokenClaimsCtx.getClaims().setClaim(k, encodedAttribute.get(k)));
}
- } else if (alwaysIncludedAttributes.contains(attribute.getId())) {
+ } else if (alwaysIncluded) {
// Deliver only for ID token
final JSONObject encodedAttribute =
transcoder.encode(profileRequestContext, attribute, JSONObject.class, rule);
@@ -297,7 +311,7 @@ public class SetTokenDeliveryAttributesToResponseContext extends AbstractOIDCRes
encodedAttribute.keySet().forEach(
k -> tokenClaimsCtx.getIdtokenClaims().setClaim(k, encodedAttribute.get(k)));
}
- } else if (!deniedUserInfoAttributes.contains(attribute.getId())) {
+ } else if (!userInfoDenied) {
// Deliver only for UserInfo token, unless requested in ID token too
final JSONObject encodedAttribute =
transcoder.encode(profileRequestContext, attribute, JSONObject.class, rule);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/StoreClientInformation.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/StoreClientInformation.java
index 336bcf87..eef8bfaa 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/StoreClientInformation.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/StoreClientInformation.java
@@ -21,13 +21,10 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.client.ClientInformation;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
@@ -36,12 +33,14 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformationResponse;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationTokenClaimsContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.token.support.RegistrationClaimsSet;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.ClientInformationManager;
import net.shibboleth.oidc.metadata.ClientInformationManagerException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that stores the {@link ClientInformation} from the {@link OIDCClientRegistrationResponseContext} to the
@@ -68,15 +67,8 @@ public class StoreClientInformation extends AbstractProfileAction {
/** The response message. */
@Nullable private OIDCClientInformationResponse response;
- /**
- * Strategy used to locate the {@link OIDCClientRegistrationResponseContext} associated with a given
- * {@link MessageContext}.
- */
- @Nonnull private Function<MessageContext,OIDCClientRegistrationResponseContext> oidcResponseContextLookupStrategy;
-
/** Constructor. */
public StoreClientInformation() {
- oidcResponseContextLookupStrategy = new ChildContextLookup<>(OIDCClientRegistrationResponseContext.class);
registrationTokenContextLookupStrategy = new DefaultOIDCClientRegistrationTokenClaimsContextLookupFunction();
}
@@ -110,21 +102,6 @@ public class StoreClientInformation extends AbstractProfileAction {
clientInformationManager = Constraint.isNotNull(manager, "The client information manager cannot be null!");
}
- /**
- * Set the strategy used to locate the {@link OIDCClientRegistrationResponseContext} associated with a given
- * {@link MessageContext}.
- *
- * @param strategy strategy used to locate the {@link OIDCClientRegistrationResponseContext} associated with a
- * given {@link MessageContext}
- */
- public void setOidcResponseContextLookupStrategy(
- @Nonnull final Function<MessageContext,OIDCClientRegistrationResponseContext> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
-
- oidcResponseContextLookupStrategy = Constraint.isNotNull(strategy,
- "OIDCClientRegistrationResponseContext lookup strategy cannot be null");
- }
-
/**
* Set the strategy used to locate the {@link OIDCClientRegistrationTokenClaimsContext} associated with a given
* request.
@@ -162,7 +139,7 @@ public class StoreClientInformation extends AbstractProfileAction {
return false;
}
- final Object message = profileRequestContext.getOutboundMessageContext().getMessage();
+ final Object message = profileRequestContext.ensureOutboundMessageContext().getMessage();
if (message == null || !(message instanceof OIDCClientInformationResponse)) {
log.error("{} Unable to locate outbound message", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
@@ -182,18 +159,32 @@ public class StoreClientInformation extends AbstractProfileAction {
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ assert response != null;
final OIDCClientInformation clientInformation = response.getOIDCClientInformation();
+ if (clientInformation == null) {
+ log.error("{} Unable to locate client information from the response message", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
+ return;
+ }
Duration lifetime = registrationValidityPeriodStrategy != null ?
registrationValidityPeriodStrategy.apply(profileRequestContext) : null;
-
- final boolean replace = registrationTokenCtx != null ?
- registrationTokenCtx.getClaimsSet().isReplacement() : false;
+
+ final boolean replace;
+ if (registrationTokenCtx != null) {
+ final RegistrationClaimsSet claimsSet = registrationTokenCtx.getClaimsSet();
+ assert claimsSet != null;
+ replace = claimsSet.isReplacement();
+
+ } else {
+ replace = false;
+ }
log.debug("{} Storing client information (replace = {})", getLogPrefix(), replace);
try {
if (lifetime != null && lifetime.isZero()) {
log.debug("{} Registration won't expire, lifetime set to 0", getLogPrefix());
+ assert clientInformationManager != null;
clientInformationManager.storeClientInformation(clientInformation, null, replace);
} else {
if (lifetime == null) {
@@ -202,6 +193,7 @@ public class StoreClientInformation extends AbstractProfileAction {
}
final Instant expiration = Instant.now().plus(lifetime);
log.debug("{} Registration will expire on {}", getLogPrefix(), expiration);
+ assert clientInformationManager != null;
clientInformationManager.storeClientInformation(clientInformation, expiration, replace);
}
} catch (final ClientInformationManagerException e) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
index b7ce2e87..9bebc8ec 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
@@ -31,12 +31,12 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.storage.ReplayCache;
import org.opensaml.storage.RevocationCache;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.AuthorizationCodeGrant;
import com.nimbusds.oauth2.sdk.AuthorizationGrant;
import com.nimbusds.oauth2.sdk.GrantType;
import com.nimbusds.oauth2.sdk.RefreshTokenGrant;
+import com.nimbusds.oauth2.sdk.id.ClientID;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultChainRevocationLifetimeLookupStrategy;
@@ -55,6 +55,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.security.DataSealer;
import net.shibboleth.shared.security.DataSealerException;
@@ -253,13 +254,23 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
final AuthorizationCodeGrant codeGrant = (AuthorizationCodeGrant) grant;
if (codeGrant.getAuthorizationCode() != null && codeGrant.getAuthorizationCode().getValue() != null) {
try {
+ final String codeValue = codeGrant.getAuthorizationCode().getValue();
+ assert codeValue != null;
final AuthorizeCodeClaimsSet authzCodeClaimsSet =
- AuthorizeCodeClaimsSet.parse(codeGrant.getAuthorizationCode().getValue(), dataSealer);
+ AuthorizeCodeClaimsSet.parse(codeValue, dataSealer);
+ assert authzCodeClaimsSet != null;
+ final String jti = authzCodeClaimsSet.getID();
+ if (jti == null) {
+ log.warn("{} Invalid contents in the authz code grant: no JTI", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
+ return;
+ }
log.debug("{} Authz code unwrapped {}", getLogPrefix(), authzCodeClaimsSet.serialize());
- if (!replayCache.check(getClass().getName(), authzCodeClaimsSet.getID(),
- authzCodeClaimsSet.getExp())) {
- log.error("{} Replay detected of authz code {}", getLogPrefix(), authzCodeClaimsSet.getID());
- if (!revokeChain(authzCodeClaimsSet.getID(),
+ final String cacheContext = getClass().getName();
+ assert cacheContext != null;
+ if (!replayCache.check(cacheContext, jti, authzCodeClaimsSet.getExp())) {
+ log.error("{} Replay detected of authz code {}", getLogPrefix(), jti);
+ if (!revokeChain(jti,
chainRevocationLifetimeLookupStrategy.apply(profileRequestContext))) {
log.warn("{} Fatal error, unable to save replayed code to revocation cache",
getLogPrefix());
@@ -283,8 +294,10 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
final RefreshTokenGrant refreshTokentokenGrant = (RefreshTokenGrant) grant;
if (refreshTokentokenGrant.getRefreshToken() != null
&& refreshTokentokenGrant.getRefreshToken().getValue() != null) {
+ final String tokenValue = refreshTokentokenGrant.getRefreshToken().getValue();
+ assert tokenValue != null;
final RefreshTokenClaimsSet refreshTokenClaimsSet = deserializeRefreshToken(profileRequestContext,
- refreshTokentokenGrant.getRefreshToken().getValue());
+ tokenValue);
if (refreshTokenClaimsSet == null) {
log.warn("{} Unwrapping refresh token failed", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
@@ -299,13 +312,16 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
} else {
rootJtiToUse = rootJti;
}
+ assert rootJtiToUse != null;
+ final String claimsSetJti = refreshTokenClaimsSet.getID();
+ assert claimsSetJti != null;
if (revocationCache.isRevoked(RevocationCacheContexts.AUTHORIZATION_CODE, rootJtiToUse)) {
log.error("{} Authz code {} and all derived tokens have been revoked", getLogPrefix(),
rootJtiToUse);
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
} else if (revocationCache.isRevoked(RevocationCacheContexts.SINGLE_ACCESS_OR_REFRESH_TOKENS,
- refreshTokenClaimsSet.getID())) {
+ claimsSetJti)) {
log.error("{} The refresh token {} has been revoked. Revoking the full chain now.",
getLogPrefix(), refreshTokenClaimsSet.getID());
if (!revokeChain(rootJtiToUse,
@@ -318,15 +334,17 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
- if (refreshTokenClaimsSet.getChainExp() != null
- && refreshTokenClaimsSet.getChainExp().isBefore(Instant.now())) {
+ final Instant chainExp = refreshTokenClaimsSet.getChainExp();
+ if (chainExp != null && chainExp.isBefore(Instant.now())) {
log.warn("{} Refresh token chain has expired on {}", getLogPrefix(),
refreshTokenClaimsSet.getChainExp());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
tokenClaimsSet = refreshTokenClaimsSet;
- if (Instant.now().isAfter(tokenClaimsSet.getAuthenticationTime().plus(refreshTokenChainLifetime))) {
+ final Instant authnTime = tokenClaimsSet.getAuthenticationTime();
+ assert authnTime != null;
+ if (Instant.now().isAfter(authnTime.plus(refreshTokenChainLifetime))) {
log.warn("{} Refresh token chain is expired, the authentication instant was {}", getLogPrefix(),
tokenClaimsSet.getAuthenticationTime());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
@@ -348,13 +366,19 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
- if (!tokenClaimsSet.getClientID().getValue().equals(rpCtx.getRelyingPartyId())) {
+ final ClientID clientId = tokenClaimsSet.getClientID();
+ assert clientId != null;
+ assert rpCtx != null;
+ final String relyingPartyId = rpCtx.getRelyingPartyId();
+ if (!clientId.getValue().equals(relyingPartyId)) {
log.warn("{} Token issued to client {}, invalid for {}", getLogPrefix(),
- tokenClaimsSet.getClientID().getValue(), rpCtx.getRelyingPartyId());
+ clientId.getValue(), relyingPartyId);
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
- getOidcResponseContext().setAuthorizationGrantClaimsSet(tokenClaimsSet);
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ oidcResponseContext.setAuthorizationGrantClaimsSet(tokenClaimsSet);
}
// Checkstyle: CyclomaticComplexity|MethodLength|ReturnCount ON
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantType.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantType.java
index d16354e2..8e48d217 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantType.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrantType.java
@@ -24,14 +24,15 @@ import javax.annotation.Nullable;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.AuthorizationGrant;
import com.nimbusds.oauth2.sdk.GrantType;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.profile.config.navigate.GrantTypesLookupFunction;
import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that validates the grant type is registered to the requesting RP. This action is used in Token end point to
@@ -75,7 +76,12 @@ public class ValidateGrantType extends AbstractOIDCTokenResponseAction {
final Set<GrantType> registeredTypes;
final OIDCMetadataContext metadataCtx = getMetadataContext();
if (metadataCtx != null) {
- registeredTypes = getMetadataContext().getClientInformation().getMetadata().getGrantTypes();
+ final OIDCClientInformation clientInformation = metadataCtx.getClientInformation();
+ if (clientInformation != null && clientInformation.getMetadata() != null) {
+ registeredTypes = clientInformation.getMetadata().getGrantTypes();
+ } else {
+ registeredTypes = null;
+ }
} else {
registeredTypes = null;
}
@@ -85,10 +91,13 @@ public class ValidateGrantType extends AbstractOIDCTokenResponseAction {
if (registeredTypes != null && !registeredTypes.contains(grant.getType())) {
log.error("{} Grant type {} not registered for client", getLogPrefix(), grant.getType().getValue());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT_TYPE);
- } else if (!enabledTypes.contains(grant.getType())) {
- log.error("{} Grant type {} not enabled in profile configuration", getLogPrefix(),
- grant.getType().getValue());
- ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT_TYPE);
+ } else {
+ assert enabledTypes != null;
+ if (!enabledTypes.contains(grant.getType())) {
+ log.error("{} Grant type {} not enabled in profile configuration", getLogPrefix(),
+ grant.getType().getValue());
+ ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT_TYPE);
+ }
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java
index 86b2f317..b4cd49cc 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidatePKCE.java
@@ -25,14 +25,17 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.util.Base64URL;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestCodeVerifierLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
+import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.oidc.profile.config.logic.AllowPKCEPlainPredicate;
import net.shibboleth.oidc.profile.config.logic.ForcePKCEPredicate;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
@@ -119,13 +122,16 @@ public class ValidatePKCE extends AbstractOIDCResponseAction {
if (!super.doPreExecute(profileRequestContext)) {
return false;
}
- if (getOidcResponseContext().getAuthorizationGrantClaimsSet() == null) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ if (oidcResponseContext.getAuthorizationGrantClaimsSet() == null) {
log.warn("{} No validated authorization grant claims set available", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
- if (!AuthorizeCodeClaimsSet.VALUE_TYPE_AC.equals(
- getOidcResponseContext().getAuthorizationGrantClaimsSet().getType())) {
+ final TokenClaimsSet tokenClaimsSet = oidcResponseContext.getAuthorizationGrantClaimsSet();
+ assert tokenClaimsSet != null;
+ if (!AuthorizeCodeClaimsSet.VALUE_TYPE_AC.equals(tokenClaimsSet.getType())) {
log.debug("{} No authorization code presented, PKCE not applied, nothing to do", getLogPrefix());
return false;
}
@@ -133,9 +139,9 @@ public class ValidatePKCE extends AbstractOIDCResponseAction {
forcePKCE = forcePKCECondition.test(profileRequestContext);
plainPKCE = allowPKCEPlainCondition.test(profileRequestContext);
- codeChallenge = getOidcResponseContext().getAuthorizationGrantClaimsSet().getCodeChallenge();
+ codeChallenge = tokenClaimsSet.getCodeChallenge();
// Checks whether PKCE needs to be validated.
- if ((codeChallenge == null || codeChallenge.isEmpty()) && !forcePKCE) {
+ if (StringSupport.trimOrNull(codeChallenge) == null && !forcePKCE) {
log.debug("{} No PKCE code challenge in request, nothing to do", getLogPrefix());
return false;
}
@@ -147,7 +153,7 @@ public class ValidatePKCE extends AbstractOIDCResponseAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (codeChallenge == null || codeChallenge.isEmpty()) {
+ if (StringSupport.trimOrNull(codeChallenge) == null) {
// The authorize-flow already verifies this via ValidateCodeChallenge, but double-checking
log.warn(
"{} No PKCE code challenge presented in authentication request" +
@@ -155,26 +161,30 @@ public class ValidatePKCE extends AbstractOIDCResponseAction {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return;
}
- if (codeVerifier == null || codeVerifier.isEmpty()) {
+ final String nonNullChallenge = codeChallenge;
+ assert nonNullChallenge != null;
+ if (StringSupport.trimOrNull(codeVerifier) == null) {
log.warn("{} No PKCE code verifier for code challenge presented in token request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return;
}
- if (codeChallenge.startsWith("plain")) {
+ final String nonNullVerifier = codeVerifier;
+ assert nonNullVerifier != null;
+ if (nonNullChallenge.startsWith("plain")) {
if (!plainPKCE) {
log.warn("{} Plain PKCE code challenge method not allowed", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return;
}
- final String codeChallengeValue = codeChallenge.substring("plain".length());
- if (!codeVerifier.equals(codeChallengeValue)) {
+ final String codeChallengeValue = nonNullChallenge.substring("plain".length());
+ if (!nonNullVerifier.equals(codeChallengeValue)) {
log.warn("{} PKCE code challenge {} not matching code verifier {}", getLogPrefix(), codeChallengeValue,
codeVerifier);
ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_AUTHN_ERROR);
return;
}
- } else if (codeChallenge.startsWith("S256")) {
- final String codeChallengeValue = codeChallenge.substring("S256".length());
+ } else if (nonNullChallenge.startsWith("S256")) {
+ final String codeChallengeValue = nonNullChallenge.substring("S256".length());
MessageDigest md = null;
try {
md = MessageDigest.getInstance("SHA-256");
@@ -184,7 +194,7 @@ public class ValidatePKCE extends AbstractOIDCResponseAction {
ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_AUTHN_ERROR);
return;
}
- final byte[] hash = md.digest(codeVerifier.getBytes(Charset.forName("utf-8")));
+ final byte[] hash = md.digest(nonNullVerifier.getBytes(Charset.forName("utf-8")));
final String codeChallengeComparisonValue = Base64URL.encode(hash).toString();
if (!codeChallengeComparisonValue.equals(codeChallengeValue)) {
log.warn("{} PKCE code challenge {} not matching code verifier {}({})", getLogPrefix(),
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationAccessToken.java
index ced116c5..2b16ecb1 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationAccessToken.java
@@ -27,7 +27,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.storage.RevocationCache;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
@@ -42,6 +41,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.security.DataSealer;
import net.shibboleth.shared.security.DataSealerException;
@@ -82,9 +82,11 @@ public class ValidateRegistrationAccessToken extends AbstractOIDCRequestAction<O
*/
public ValidateRegistrationAccessToken() {
relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- registrationClaimsContextCreationStrategy =
+ final Function<ProfileRequestContext,OIDCClientRegistrationTokenClaimsContext> rcccs =
new ChildContextLookup<>(OIDCClientRegistrationTokenClaimsContext.class, true).compose(
new InboundMessageContextLookup());
+ assert rcccs != null;
+ registrationClaimsContextCreationStrategy = rcccs;
}
/**
@@ -192,6 +194,7 @@ public class ValidateRegistrationAccessToken extends AbstractOIDCRequestAction<O
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final RegistrationClaimsSet claimsSet;
try {
+ assert accessToken != null;
final String unwrapped = dataSealer.unwrap(accessToken);
log.debug("{} Access token unwrapped into {}", getLogPrefix(), unwrapped);
claimsSet = objectMapper.readValue(unwrapped, RegistrationClaimsSet.class);
@@ -208,7 +211,8 @@ public class ValidateRegistrationAccessToken extends AbstractOIDCRequestAction<O
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
- if (revocationCache.isRevoked(RevocationCacheContexts.REGISTRATION_ACCESS_TOKEN, claimsSet.getJti())) {
+ final String jti = claimsSet.getJti();
+ if (jti != null && revocationCache.isRevoked(RevocationCacheContexts.REGISTRATION_ACCESS_TOKEN, jti)) {
log.error("{} Registration access token {} has been revoked", getLogPrefix(),
claimsSet.getJti());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
@@ -218,7 +222,9 @@ public class ValidateRegistrationAccessToken extends AbstractOIDCRequestAction<O
if (relyingPartyId != null) {
log.debug("{} Registration access token {} carries relying party identifier {}", getLogPrefix(),
claimsSet.getJti(), relyingPartyId);
+ assert relyingPartyContext != null;
relyingPartyContext.setVerified(true);
+ assert relyingPartyContext != null;
relyingPartyContext.setRelyingPartyId(relyingPartyId);
} else {
log.debug("{} Registration access token {} carries no relying party identifier", getLogPrefix(),
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java
index aff96bad..0df17edd 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java
@@ -27,7 +27,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
@@ -40,6 +39,7 @@ import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.oidc.metadata.policy.impl.DefaultMetadataPolicyEnforcer;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Validates the incoming dynamic client registration request against the metadata policy stored in the
@@ -132,6 +132,7 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
return false;
}
+ assert registrationMetadataPolicyContext != null;
metadataPolicy = registrationMetadataPolicyContext.getMetadataPolicy();
if (metadataPolicy == null) {
log.debug("{} No metadata policy associated with this request", getLogPrefix());
@@ -145,29 +146,38 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (metadataPolicy.isEmpty()) {
+ assert metadataPolicy != null;
+ final Map<String, MetadataPolicy> nonNullPolicy = metadataPolicy;
+ if (nonNullPolicy.isEmpty()) {
log.debug("{} No metadata policy content found, setting the request as policy enforced", getLogPrefix());
- registrationMetadataPolicyContext.setPolicyEnforcedMetadata(request.getOIDCClientMetadata());
+ assert request != null;
+ final OIDCClientMetadata metadata = request.getOIDCClientMetadata();
+ assert metadata != null;
+ assert registrationMetadataPolicyContext != null;
+ registrationMetadataPolicyContext.setPolicyEnforcedMetadata(metadata);
return;
}
log.debug("{} Metadata policy used for request validation: {}", getLogPrefix(), metadataPolicy);
boolean compliant = true;
+ assert request != null;
final JSONObject requestMetadata = request.getOIDCClientMetadata().toJSONObject();
- for (final String claim : metadataPolicy.keySet()) {
- final MetadataPolicy policy = metadataPolicy.get(claim);
+ for (final String claim : nonNullPolicy.keySet()) {
+ final MetadataPolicy policy = nonNullPolicy.get(claim);
final Object value = requestMetadata.get(claim);
log.debug("{} Claim {} set in policy included in the request: {}", getLogPrefix(), claim,
value == null);
final Pair<Object,Boolean> result = metadataPolicyEnforcer.apply(value, policy);
- if (!result.getSecond()) {
+ final Boolean enforcerResult = result != null ? result.getSecond() : null;
+ if (enforcerResult == null || !enforcerResult.booleanValue()) {
log.warn("{} Metadata claim {} is not compliant with the policy", getLogPrefix(), claim);
compliant = false;
} else {
log.trace("{} Validation result is OK for claim {}", getLogPrefix(), claim);
- requestMetadata.put(claim, result.getFirst());
+ final Object enforcedValue = result != null ? result.getFirst() : null;
+ requestMetadata.put(claim, enforcedValue);
}
}
@@ -178,6 +188,8 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
try {
final OIDCClientMetadata enforcedMetadata = OIDCClientMetadata.parse(requestMetadata);
+ assert enforcedMetadata != null;
+ assert registrationMetadataPolicyContext != null;
registrationMetadataPolicyContext.setPolicyEnforcedMetadata(enforcedMetadata);
log.debug("{} The enforced metadata stored in context", getLogPrefix());
} catch (final ParseException e) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/VerifyRequestedSubjectIdentifier.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/VerifyRequestedSubjectIdentifier.java
index c153df24..2d91e987 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/VerifyRequestedSubjectIdentifier.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/VerifyRequestedSubjectIdentifier.java
@@ -19,9 +19,10 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action verifies that produced subject equals to requested subject if such exists.
@@ -35,8 +36,11 @@ public class VerifyRequestedSubjectIdentifier extends AbstractOIDCAuthentication
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final String requestedSubject = getOidcResponseContext().getRequestedSubject();
- final String generatedSubject = getOidcResponseContext().getSubject();
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+
+ final String requestedSubject = oidcResponseContext.getRequestedSubject();
+ final String generatedSubject = oidcResponseContext.getSubject();
if (requestedSubject == null) {
log.debug("{} No requested subject, nothing to do", getLogPrefix());
return;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java
index 0ddbbad4..8ee5800f 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeConsentEnabledInTokenClaimsSetPredicate.java
@@ -33,15 +33,20 @@ public class AttributeConsentEnabledInTokenClaimsSetPredicate extends AbstractRe
/** {@inheritDoc} */
public boolean test(@Nullable final ProfileRequestContext input) {
+ if (input == null) {
+ return false;
+ }
final MessageContext outboundMessageCtx = input.getOutboundMessageContext();
if (outboundMessageCtx != null) {
final OIDCAuthenticationResponseContext oidcResponseContext =
outboundMessageCtx.getSubcontext(OIDCAuthenticationResponseContext.class);
- if (oidcResponseContext != null && oidcResponseContext.getAuthorizationGrantClaimsSet() != null) {
- return oidcResponseContext.getAuthorizationGrantClaimsSet().isConsentEnabled();
+ if (oidcResponseContext != null) {
+ final TokenClaimsSet tokenClaimsSet = oidcResponseContext.getAuthorizationGrantClaimsSet();
+ if (tokenClaimsSet != null) {
+ return tokenClaimsSet.isConsentEnabled();
+ }
}
}
return false;
}
-
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeResolutionSubjectLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeResolutionSubjectLookupFunction.java
index 032685cc..285f5e70 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeResolutionSubjectLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/AttributeResolutionSubjectLookupFunction.java
@@ -35,6 +35,7 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.service.ReloadableService;
import net.shibboleth.shared.service.ServiceException;
import net.shibboleth.shared.service.ServiceableComponent;
@@ -43,7 +44,6 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* A function that returns subject identifier from filtered claims. Encoded value of the first attribute that would be
@@ -76,8 +76,11 @@ public class AttributeResolutionSubjectLookupFunction extends AbstractIdentifiab
* Constructor.
*/
AttributeResolutionSubjectLookupFunction() {
- attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
- new ChildContextLookup<>(RelyingPartyContext.class));
+ final Function<ProfileRequestContext, AttributeContext> acls =
+ new ChildContextLookup<>(AttributeContext.class).compose(
+ new ChildContextLookup<>(RelyingPartyContext.class));
+ assert acls != null;
+ attributeContextLookupStrategy = acls;
}
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultAuthorizationRequestTypeValidationStrategy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultAuthorizationRequestTypeValidationStrategy.java
index 89875a33..5adae36e 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultAuthorizationRequestTypeValidationStrategy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultAuthorizationRequestTypeValidationStrategy.java
@@ -17,15 +17,16 @@ package net.shibboleth.idp.plugin.oidc.op.profile.logic;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.base.Predicates;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
/**
* Validation strategy for the inbound message. This predicate returns true if the message is an instance of
@@ -44,7 +45,7 @@ public class DefaultAuthorizationRequestTypeValidationStrategy implements Predic
* Constructor.
*/
public DefaultAuthorizationRequestTypeValidationStrategy() {
- requireAuthenticationRequest = Predicates.alwaysTrue();
+ requireAuthenticationRequest = PredicateSupport.alwaysTrue();
}
/**
@@ -59,7 +60,10 @@ public class DefaultAuthorizationRequestTypeValidationStrategy implements Predic
/** {@inheritDoc} */
@Override
- public boolean test(@Nonnull final ProfileRequestContext input) {
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ if (input == null) {
+ return false;
+ }
final MessageContext messageContext = input.getInboundMessageContext();
if (messageContext == null || messageContext.getMessage() == null) {
return false;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultChainRevocationLifetimeLookupStrategy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultChainRevocationLifetimeLookupStrategy.java
index 242ef30b..885b9cd6 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultChainRevocationLifetimeLookupStrategy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultChainRevocationLifetimeLookupStrategy.java
@@ -21,10 +21,10 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.profile.config.navigate.RevocationLifetimeLookupFunction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Default lookup function for fetching the chain revocation lifetime. This inherits the functionality of
@@ -44,7 +44,9 @@ public class DefaultChainRevocationLifetimeLookupStrategy extends RevocationLife
* Constructor.
*/
public DefaultChainRevocationLifetimeLookupStrategy() {
- clockSkew = Duration.ofMinutes(5);
+ final Duration skew = Duration.ofMinutes(5);
+ assert skew != null;
+ clockSkew = skew;
}
/**
@@ -53,7 +55,9 @@ public class DefaultChainRevocationLifetimeLookupStrategy extends RevocationLife
* @param skew clock skew to set
*/
public void setClockSkew(@Nonnull final Duration skew) {
- clockSkew = Constraint.isNotNull(skew, "Clock skew cannot be null").abs();
+ final Duration newValue = Constraint.isNotNull(skew, "Clock skew cannot be null").abs();
+ assert newValue != null;
+ clockSkew = newValue;
}
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultMetadataPolicyCriteriaLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultMetadataPolicyCriteriaLookupFunction.java
index 561a2489..f88dcb5b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultMetadataPolicyCriteriaLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultMetadataPolicyCriteriaLookupFunction.java
@@ -21,11 +21,11 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.plugin.oidc.op.cli.IssueRegistrationAccessTokenArguments;
import net.shibboleth.idp.profile.context.navigate.SpringFlowScopeLookupFunction;
import net.shibboleth.oidc.metadata.criterion.ResourceLocationCriterion;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -42,7 +42,7 @@ public class DefaultMetadataPolicyCriteriaLookupFunction implements Function<Pro
/** {@inheritDoc} */
@Override @Nullable
- public CriteriaSet apply(@Nonnull final ProfileRequestContext profileRequestContext) {
+ public CriteriaSet apply(@Nullable final ProfileRequestContext profileRequestContext) {
final String location = new SpringFlowScopeLookupFunction(
IssueRegistrationAccessTokenArguments.URL_PARAM_POLICY_LOCATION).apply(profileRequestContext);
if (StringSupport.trimOrNull(location) == null) {
@@ -50,6 +50,7 @@ public class DefaultMetadataPolicyCriteriaLookupFunction implements Function<Pro
return null;
}
log.trace("Found a location {} to be included in the criteria set", location);
+ assert location != null;
final ResourceLocationCriterion criterion = new ResourceLocationCriterion(location);
return new CriteriaSet(criterion);
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultMetadataPolicyMergingStrategy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultMetadataPolicyMergingStrategy.java
index f8c6dfc4..27fb5c15 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultMetadataPolicyMergingStrategy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultMetadataPolicyMergingStrategy.java
@@ -26,12 +26,12 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.oidc.metadata.policy.impl.MetadataPolicyHelper;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.logic.ConstraintViolationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* <p>A function that merges two maps of metadata policies according to the rules specified in the OIDC federation spec
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultRootTokenIdentifierLookupStrategy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultRootTokenIdentifierLookupStrategy.java
index 2bfafab0..39f74458 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultRootTokenIdentifierLookupStrategy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultRootTokenIdentifierLookupStrategy.java
@@ -21,11 +21,11 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultSubjectTypeStrategy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultSubjectTypeStrategy.java
index 39c6f3e7..d5ca29d4 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultSubjectTypeStrategy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultSubjectTypeStrategy.java
@@ -25,20 +25,15 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.logic.Constraint;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.SubjectType;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
/**
* Function to decide on subject type. Subject type is located from client's registration data.
*/
public class DefaultSubjectTypeStrategy implements Function<ProfileRequestContext, SubjectType> {
- /** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(DefaultSubjectTypeStrategy.class);
-
/** Strategy function to lookup OIDC metadata context . */
@Nonnull
private Function<ProfileRequestContext, OIDCMetadataContext> oidcMetadataContextLookupStrategy;
@@ -77,8 +72,11 @@ public class DefaultSubjectTypeStrategy implements Function<ProfileRequestContex
SubjectType type = null;
final OIDCMetadataContext ctx = oidcMetadataContextLookupStrategy.apply(input);
- if (ctx != null && ctx.getClientInformation() != null && ctx.getClientInformation().getOIDCMetadata() != null) {
- type = ctx.getClientInformation().getOIDCMetadata().getSubjectType();
+ if (ctx != null) {
+ final OIDCClientInformation clientInformation = ctx.getClientInformation();
+ if (clientInformation != null && clientInformation.getOIDCMetadata() != null) {
+ type = clientInformation.getOIDCMetadata().getSubjectType();
+ }
}
return type == null ? SubjectType.PUBLIC : type;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultTokenRevocationLifetimeLookupStrategy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultTokenRevocationLifetimeLookupStrategy.java
index 2ddcf26c..bd53cbba 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultTokenRevocationLifetimeLookupStrategy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultTokenRevocationLifetimeLookupStrategy.java
@@ -23,11 +23,11 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Default lookup function for fetching the token revocation lifetime from the given claims set. If an expiration
@@ -51,7 +51,9 @@ public class DefaultTokenRevocationLifetimeLookupStrategy implements Function<JW
* Constructor.
*/
public DefaultTokenRevocationLifetimeLookupStrategy() {
- clockSkew = Duration.ofMinutes(5);
+ final Duration skew = Duration.ofMinutes(5);
+ assert skew != null;
+ clockSkew = skew;
}
/**
@@ -60,7 +62,9 @@ public class DefaultTokenRevocationLifetimeLookupStrategy implements Function<JW
* @param skew clock skew to set
*/
public void setClockSkew(@Nonnull final Duration skew) {
- clockSkew = Constraint.isNotNull(skew, "Clock skew cannot be null").abs();
+ final Duration newValue = Constraint.isNotNull(skew, "Clock skew cannot be null").abs();
+ assert newValue != null;
+ clockSkew = newValue;
}
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultUnregisteredClientPolicyValidator.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultUnregisteredClientPolicyValidator.java
index 0f201f09..d2bfa962 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultUnregisteredClientPolicyValidator.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultUnregisteredClientPolicyValidator.java
@@ -23,13 +23,13 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
import net.shibboleth.oidc.metadata.policy.impl.DefaultMetadataPolicyValidator;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Default validator for the unregistered client policies. Scope must be specified via value and/or custom operators.
@@ -125,7 +125,10 @@ public class DefaultUnregisteredClientPolicyValidator extends AbstractInitializa
* @param policy The policy to be verified.
* @return true if verified, false otherwise.
*/
- protected boolean verifyScopePolicy(@Nonnull final MetadataPolicy policy) {
+ protected boolean verifyScopePolicy(@Nullable final MetadataPolicy policy) {
+ if (policy == null) {
+ return true;
+ }
if (policy.getOneOfValues() != null || policy.getRegexp() != null) {
log.error("Only 'value' or custom operators should be used together with 'scope' in the policy");
return false;
@@ -142,7 +145,10 @@ public class DefaultUnregisteredClientPolicyValidator extends AbstractInitializa
* @param policy The policy to be verified.
* @return true if verified, false otherwise.
*/
- protected boolean verifyResponseTypePolicy(@Nonnull final MetadataPolicy policy) {
+ protected boolean verifyResponseTypePolicy(@Nullable final MetadataPolicy policy) {
+ if (policy == null) {
+ return true;
+ }
if (policy.getRegexp() != null || policy.getValue() != null) {
log.error("Only 'one_of' or custom operators should be used together with 'response_type' in the policy");
return false;
@@ -160,7 +166,10 @@ public class DefaultUnregisteredClientPolicyValidator extends AbstractInitializa
* @param policy The policy to be verified.
* @return true if verified, false otherwise.
*/
- protected boolean verifyRedirectUriPolicy(@Nonnull final MetadataPolicy policy) {
+ protected boolean verifyRedirectUriPolicy(@Nullable final MetadataPolicy policy) {
+ if (policy == null) {
+ return true;
+ }
if (policy.getValue() != null) {
log.error("'value' cannot be specified for 'redirect_uri' in the policy");
return false;
@@ -178,7 +187,10 @@ public class DefaultUnregisteredClientPolicyValidator extends AbstractInitializa
* @param policy The policy to be verified.
* @return true if verified, false otherwise.
*/
- protected boolean verifyClientIdPolicy(@Nonnull final MetadataPolicy policy) {
+ protected boolean verifyClientIdPolicy(@Nullable final MetadataPolicy policy) {
+ if (policy == null) {
+ return true;
+ }
if (policy.getValue() != null) {
log.error("'value' cannot be specified for 'client_id' in the policy");
return false;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultUnregisteredClientResponseTypesLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultUnregisteredClientResponseTypesLookupFunction.java
index 26dbc593..4e1ee5bc 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultUnregisteredClientResponseTypesLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultUnregisteredClientResponseTypesLookupFunction.java
@@ -22,6 +22,7 @@ import java.util.function.Function;
import java.util.stream.Collectors;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -30,6 +31,7 @@ import com.nimbusds.oauth2.sdk.ResponseType;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
import net.shibboleth.oidc.profile.config.navigate.UnregisteredClientPolicyLookupFunction;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.StringSupport;
@@ -67,11 +69,11 @@ public class DefaultUnregisteredClientResponseTypesLookupFunction extends Abstra
"Unregistered client policy lookup strategy cannot be null");
}
- @Override @Nonnull
- public Set<ResponseType> apply(@Nonnull final ProfileRequestContext input) {
+ @Override @Nullable
+ public Set<ResponseType> apply(@Nullable final ProfileRequestContext input) {
final Map<String, UnregisteredClientPolicy> policies = unregisteredClientPolicyLookupStrategy.apply(input);
if (policies == null || policies.isEmpty()) {
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
return Optional.ofNullable((MetadataPolicy) policies.get("response_type"))
.map(policy -> policy.getOneOfValues())
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/MetadataValueEqualsCondition.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/MetadataValueEqualsCondition.java
index f1e0ae61..db6907f6 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/MetadataValueEqualsCondition.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/MetadataValueEqualsCondition.java
@@ -22,6 +22,8 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
+
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
@@ -112,11 +114,14 @@ public class MetadataValueEqualsCondition extends AbstractIdentifiableInitializa
@Override
public boolean test(@Nullable final ProfileRequestContext input) {
final OIDCMetadataContext oidcMetadataCtx = oidcMetadataContextLookupStrategy.apply(input);
- if (oidcMetadataCtx == null || oidcMetadataCtx.getClientInformation() == null) {
- return false;
+ if (oidcMetadataCtx != null) {
+ final OIDCClientInformation clientInformation = oidcMetadataCtx.getClientInformation();
+ if (clientInformation != null && clientInformation.getOIDCMetadata() != null) {
+ final Object value = clientInformation.getOIDCMetadata().toJSONObject().get(metadataKey);
+ return metadataValue.equals(value != null ? value : defaultValue);
+ }
}
- final Object value = oidcMetadataCtx.getClientInformation().getOIDCMetadata().toJSONObject().get(metadataKey);
- return metadataValue.equals(value != null ? value : defaultValue);
+ return false;
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/SubjectActivationCondition.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/SubjectActivationCondition.java
index f704f576..397db02d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/SubjectActivationCondition.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/SubjectActivationCondition.java
@@ -33,6 +33,9 @@ public class SubjectActivationCondition implements Predicate<ProfileRequestConte
/** {@inheritDoc} */
@Override
public boolean test(@Nullable final ProfileRequestContext input) {
+ if (input == null) {
+ return true;
+ }
final MessageContext outboundMessageCtx = input.getOutboundMessageContext();
if (outboundMessageCtx == null) {
return true;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/spring/relyingparty/metadata/impl/ProviderMetadataResolverServiceStrategy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/spring/relyingparty/metadata/impl/ProviderMetadataResolverServiceStrategy.java
index 64aa35be..5527028d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/spring/relyingparty/metadata/impl/ProviderMetadataResolverServiceStrategy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/spring/relyingparty/metadata/impl/ProviderMetadataResolverServiceStrategy.java
@@ -42,6 +42,9 @@ public class ProviderMetadataResolverServiceStrategy extends AbstractIdentifiabl
/** {@inheritDoc} */
@Nonnull
public AbstractServiceableComponent<ProviderMetadataResolver> apply(@Nullable final ApplicationContext appContext) {
+ if (appContext == null) {
+ throw new ServiceException("The application context is null");
+ }
final Collection<ServiceableProviderMetadataProvider> resolvers =
appContext.getBeansOfType(ServiceableProviderMetadataProvider.class).values();
@@ -51,7 +54,9 @@ public class ProviderMetadataResolverServiceStrategy extends AbstractIdentifiabl
}
if (1 == resolvers.size()) {
// done
- return resolvers.iterator().next();
+ final AbstractServiceableComponent<ProviderMetadataResolver> result = resolvers.iterator().next();
+ assert result != null;
+ return result;
}
throw new ServiceException(
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/jwt/claims/impl/ChainExpiryClaimsValidator.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/jwt/claims/impl/ChainExpiryClaimsValidator.java
index e743b2a9..e12f6a25 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/jwt/claims/impl/ChainExpiryClaimsValidator.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/jwt/claims/impl/ChainExpiryClaimsValidator.java
@@ -23,8 +23,6 @@ import java.util.Date;
import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -41,9 +39,6 @@ import net.shibboleth.shared.logic.Constraint;
@ThreadSafeAfterInit
public class ChainExpiryClaimsValidator extends AbstractClaimsValidator {
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(ChainExpiryClaimsValidator.class);
-
/**
* Positive clock skew adjustment to consider when checking JWT expiration
* (Default value: 60 seconds).
@@ -52,7 +47,9 @@ public class ChainExpiryClaimsValidator extends AbstractClaimsValidator {
/** Constructor.*/
public ChainExpiryClaimsValidator() {
- clockSkew = Duration.ofSeconds(60);
+ final Duration skew = Duration.ofSeconds(60);
+ assert skew != null;
+ clockSkew = skew;
}
/**
@@ -63,7 +60,9 @@ public class ChainExpiryClaimsValidator extends AbstractClaimsValidator {
public void setClockSkew(@Nonnull final Duration skew) {
ifInitializedThrowUnmodifiabledComponentException();
- clockSkew = Constraint.isNotNull(skew, "Clock skew cannot be null");
+ final Duration newValue = Constraint.isNotNull(skew, "Clock skew cannot be null").abs();
+ assert newValue != null;
+ clockSkew = newValue;
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/jwt/claims/impl/RootTokenIdRevocationValidator.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/jwt/claims/impl/RootTokenIdRevocationValidator.java
index 314f217d..0a0f4884 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/jwt/claims/impl/RootTokenIdRevocationValidator.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/security/jwt/claims/impl/RootTokenIdRevocationValidator.java
@@ -91,7 +91,9 @@ public class RootTokenIdRevocationValidator extends AbstractClaimsValidator {
if (StringSupport.trimOrNull(rootJtiToUse) == null) {
throw new JWTValidationException("Claims set is missing required JWT identifier claim");
}
-
+
+ assert context != null;
+ assert rootJtiToUse != null;
if (revocationCache.isRevoked(context, rootJtiToUse)) {
throw new JWTValidationException("Claims set with root ID '" + rootJtiToUse + "' has been revoked");
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionCreationStrategy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionCreationStrategy.java
index 0ee73b98..8a0e24b4 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionCreationStrategy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionCreationStrategy.java
@@ -24,10 +24,10 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
+import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
@@ -41,6 +41,7 @@ import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -125,8 +126,11 @@ public class OIDCRPSessionCreationStrategy extends AbstractInitializableComponen
log.debug("ClientID/RelyingPartyId cannot be null, no OIDCRPSession created.");
return null;
}
-
+ final String clientIdentifierValue = clientIdentifier.getValue();
+ assert clientIdentifierValue != null;
+
final Instant now = Instant.now();
+ assert now != null;
final String issuer = getIssuer(tokenClaimsSet, idTokenClaimsSet);
if (issuer == null) {
log.debug("Issuer cannot be null, no OIDCRPSession created.");
@@ -159,11 +163,13 @@ public class OIDCRPSessionCreationStrategy extends AbstractInitializableComponen
}
final boolean supportsLogoutPropagation = isSupportsLogoutPropagation(profileRequestContext);
+ final Instant expiration = now.plus(sessionLifetime);
+ assert expiration != null;
return new OIDCRPSession.Builder()
- .serviceId(clientIdentifier.getValue())
+ .serviceId(clientIdentifierValue)
.creationInstant(now)
- .expirationInstant(now.plus(sessionLifetime))
+ .expirationInstant(expiration)
.issuer(issuer)
.rootTokenIdentifier(rootTokenIdentifier)
.sessionIdentifier(sessionIdentifier)
@@ -235,13 +241,15 @@ public class OIDCRPSessionCreationStrategy extends AbstractInitializableComponen
* @param profileRequestContext The profile request context
* @return true iff the attached metadata contains a front- or back-channel logout URI
*/
- protected boolean isSupportsLogoutPropagation(@Nonnull final ProfileRequestContext profileRequestContext) {
+ protected boolean isSupportsLogoutPropagation(@Nullable final ProfileRequestContext profileRequestContext) {
final OIDCMetadataContext oidcMetadataContext = oidcMetadataContextLookupStrategy.apply(profileRequestContext);
if (oidcMetadataContext == null || oidcMetadataContext.getClientInformation() == null) {
log.debug("No metadata found, does not support propagation");
return false;
}
- final OIDCClientMetadata metadata = oidcMetadataContext.getClientInformation().getOIDCMetadata();
+ final OIDCClientInformation clientInformation = oidcMetadataContext.getClientInformation();
+ assert clientInformation != null;
+ final OIDCClientMetadata metadata = clientInformation.getOIDCMetadata();
final boolean result =
metadata.getBackChannelLogoutURI() != null || metadata.getFrontChannelLogoutURI() != null;
return result;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionSerializer.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionSerializer.java
index 14902ec0..38edea3b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionSerializer.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionSerializer.java
@@ -28,6 +28,7 @@ import net.shibboleth.idp.session.SPSession;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.logic.Constraint;
/**
* A serializer for {@link OIDCRPSession} objects.
@@ -65,14 +66,20 @@ public class OIDCRPSessionSerializer extends AbstractSPSessionSerializer {
@Nonnull
protected SPSession doDeserialize(@Nonnull final JsonObject obj, @Nonnull @NotEmpty final String id,
@Nonnull final Instant creation, @Nonnull final Instant expiration) {
+ final String issuer = Constraint.isNotEmpty(obj.getString(TokenClaimsSet.KEY_ISSUER, null),
+ "Issuer cannot be empty");
+ final String sessionId = Constraint.isNotEmpty(obj.getString(TokenClaimsSet.KEY_SESSION_ID, null),
+ "Session ID cannot be empty");
+ final String subject = Constraint.isNotEmpty(obj.getString(TokenClaimsSet.KEY_SUBJECT, null),
+ "Subject cannot be empty");
return new OIDCRPSession.Builder()
.serviceId(id)
.creationInstant(creation)
.expirationInstant(expiration)
- .issuer(obj.getString(TokenClaimsSet.KEY_ISSUER, null))
+ .issuer(issuer)
.rootTokenIdentifier(obj.getString(TokenClaimsSet.KEY_ROOT_JTI, null))
- .sessionIdentifier(obj.getString(TokenClaimsSet.KEY_SESSION_ID, null))
- .subject(obj.getString(TokenClaimsSet.KEY_SUBJECT, null))
+ .sessionIdentifier(sessionId)
+ .subject(subject)
.supportLogoutPropagation(obj.getBoolean(LOGOUT_PROP_FIELD, true))
.build();
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseAction.java
index a49e588e..037eef99 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoResponseAction.java
@@ -15,18 +15,19 @@
package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.UserInfoRequest;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
*
@@ -43,7 +44,7 @@ abstract class AbstractOIDCUserInfoResponseAction extends AbstractOIDCUserInfoVa
private Logger log = LoggerFactory.getLogger(AbstractOIDCUserInfoResponseAction.class);
/** OIDC Metadata context. */
- @Nonnull
+ @Nullable
private OIDCMetadataContext oidcMetadataContext;
/**
@@ -51,7 +52,7 @@ abstract class AbstractOIDCUserInfoResponseAction extends AbstractOIDCUserInfoVa
*
* @return The OIDC Metadata context.
*/
- public OIDCMetadataContext getMetadataContext() {
+ @Nullable public OIDCMetadataContext getMetadataContext() {
return oidcMetadataContext;
}
@@ -62,7 +63,8 @@ abstract class AbstractOIDCUserInfoResponseAction extends AbstractOIDCUserInfoVa
if (!super.doPreExecute(profileRequestContext)) {
return false;
}
- oidcMetadataContext = profileRequestContext.getInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
+ oidcMetadataContext =
+ profileRequestContext.ensureInboundMessageContext().getSubcontext(OIDCMetadataContext.class);
if (oidcMetadataContext == null) {
log.error("{} No metadata found for relying party", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java
index c3157f83..446d5097 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AbstractOIDCUserInfoValidationResponseAction.java
@@ -15,17 +15,18 @@
package net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.UserInfoRequest;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
*
@@ -41,7 +42,7 @@ abstract class AbstractOIDCUserInfoValidationResponseAction extends AbstractOIDC
private Logger log = LoggerFactory.getLogger(AbstractOIDCUserInfoValidationResponseAction.class);
/** oidc response context. */
- @Nonnull
+ @Nullable
private OIDCAuthenticationResponseContext oidcResponseContext;
/**
@@ -49,7 +50,7 @@ abstract class AbstractOIDCUserInfoValidationResponseAction extends AbstractOIDC
*
* @return ctx.
*/
- @Nonnull
+ @Nullable
public OIDCAuthenticationResponseContext getOidcResponseContext() {
return oidcResponseContext;
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShell.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShell.java
index 69ce07c1..3917424c 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShell.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/AddUserInfoShell.java
@@ -27,12 +27,12 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.oauth2.sdk.id.Issuer;
@@ -55,7 +55,7 @@ public class AddUserInfoShell extends AbstractOIDCResponseAction {
@NonnullAfterInit private Function<ProfileRequestContext,String> issuerLookupStrategy;
/** OP ID to populate into Issuer element. */
- @Nonnull
+ @Nullable
private String issuerId;
/**
@@ -154,14 +154,17 @@ public class AddUserInfoShell extends AbstractOIDCResponseAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final UserInfo userInfo = new UserInfo(new Subject(getOidcResponseContext().getSubject()));
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ final UserInfo userInfo = new UserInfo(new Subject(oidcResponseContext.getSubject()));
if (userInfoSigAlgStrategy.apply(profileRequestContext) != null) {
+ assert rpCtx != null;
userInfo.setClaim("aud",rpCtx.getRelyingPartyId());
userInfo.setIssuer(new Issuer(issuerId));
}
log.debug("{} Setting userinfo response shell to response context {}", getLogPrefix(),
userInfo.toJSONObject().toJSONString());
- getOidcResponseContext().setUserInfo(userInfo);
+ oidcResponseContext.setUserInfo(userInfo);
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/FormOutboundUserInfoResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/FormOutboundUserInfoResponseMessage.java
index 60f33ab9..6ef0807a 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/FormOutboundUserInfoResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/FormOutboundUserInfoResponseMessage.java
@@ -20,11 +20,11 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCTokenResponseAction;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that forms outbound message based on response context. Formed message is set to
@@ -42,18 +42,20 @@ public class FormOutboundUserInfoResponseMessage extends AbstractOIDCTokenRespon
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
final UserInfoSuccessResponse resp;
- if (getOidcResponseContext().getProcessedToken() != null) {
- resp = new UserInfoSuccessResponse(getOidcResponseContext().getProcessedToken());
- } else if (getOidcResponseContext().getUserInfo() != null) {
- resp = new UserInfoSuccessResponse(getOidcResponseContext().getUserInfo());
+ if (oidcResponseContext.getProcessedToken() != null) {
+ resp = new UserInfoSuccessResponse(oidcResponseContext.getProcessedToken());
+ } else if (oidcResponseContext.getUserInfo() != null) {
+ resp = new UserInfoSuccessResponse(oidcResponseContext.getUserInfo());
} else {
log.error("{} No content to form userinfo response", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return;
}
- profileRequestContext.getOutboundMessageContext().setMessage(resp);
+ profileRequestContext.ensureOutboundMessageContext().setMessage(resp);
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ParseAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ParseAccessToken.java
index 076a7a5f..0b6bc1bf 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ParseAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ParseAccessToken.java
@@ -29,7 +29,6 @@ import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.security.credential.UsageType;
import org.opensaml.security.criteria.UsageCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jwt.SignedJWT;
@@ -43,6 +42,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
import net.shibboleth.shared.security.DataSealer;
@@ -149,15 +149,15 @@ public class ParseAccessToken extends AbstractOIDCUserInfoValidationResponseActi
final Collection<Credential> credList = new ArrayList<>();
final CriteriaSet criteriaSet = new CriteriaSet(new UsageCriterion(UsageType.SIGNING));
try {
+ assert credentialResolver != null;
final Iterable<Credential> creds = credentialResolver.resolve(criteriaSet);
- if (creds != null) {
- creds.forEach(credList::add);
- }
+ creds.forEach(credList::add);
} catch (final ResolverException e) {
log.error("{} Failure resolving signing credentials, can't verify JWT signature", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
return;
}
+ assert signedJWT != null;
final String errorEventId = JWTSignatureValidationUtil.validateSignatureEx(credList, signedJWT,
OidcEventIds.INVALID_GRANT);
if (errorEventId != null) {
@@ -168,7 +168,9 @@ public class ParseAccessToken extends AbstractOIDCUserInfoValidationResponseActi
}
log.debug("{} Access token {} parsed", getLogPrefix(), accessTokenClaimsSet.getID());
- getOidcResponseContext().setAuthorizationGrantClaimsSet(accessTokenClaimsSet);
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ oidcResponseContext.setAuthorizationGrantClaimsSet(accessTokenClaimsSet);
}
// Checkstyle: CyclomaticComplexity ON
@@ -182,9 +184,13 @@ public class ParseAccessToken extends AbstractOIDCUserInfoValidationResponseActi
*/
@Nullable protected AccessTokenClaimsSet parseAccessToken(@Nonnull @NotEmpty final AccessToken token) {
+ final String tokenValue = token.getValue();
+ assert tokenValue != null;
// Try parsing as a JWT.
try {
- signedJWT = SignedJWT.parse(token.getValue());
+ signedJWT = SignedJWT.parse(tokenValue);
+ assert signedJWT != null;
+ assert dataSealer != null;
return AccessTokenClaimsSet.parse(signedJWT, dataSealer);
} catch (final DataSealerException | ParseException e) {
@@ -192,7 +198,8 @@ public class ParseAccessToken extends AbstractOIDCUserInfoValidationResponseActi
// Fall back to opaque.
try {
- return AccessTokenClaimsSet.parse(token.getValue(), dataSealer);
+ assert dataSealer != null;
+ return AccessTokenClaimsSet.parse(tokenValue, dataSealer);
} catch (final DataSealerException | ParseException e) {
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java
index e586d3ac..c51c5ed1 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java
@@ -23,7 +23,8 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
@@ -34,6 +35,7 @@ import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.oidc.profile.config.navigate.IssuedClaimsValidatorLookupFunction;
import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Action that validates the claims pulled from an access token as usable for access
@@ -95,17 +97,21 @@ public class ValidateAccessToken extends AbstractOIDCUserInfoValidationResponseA
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final TokenClaimsSet tokenClaims = getOidcResponseContext().getAuthorizationGrantClaimsSet();
+ final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
+ assert oidcResponseContext != null;
+ final TokenClaimsSet tokenClaims = oidcResponseContext.getAuthorizationGrantClaimsSet();
if (!(tokenClaims instanceof AccessTokenClaimsSet) || tokenClaims.getClaimsSet() == null) {
log.error("{} Claims validation failed, unable to locate access token claims set to validate",
getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ACCESS_TOKEN);
return;
}
-
- log.debug("{} Validating parsed/decoded claims set: {}", getLogPrefix(), tokenClaims.getClaimsSet().toString());
+ final JWTClaimsSet claimsSet = tokenClaims.getClaimsSet();
+ assert claimsSet != null;
+ log.debug("{} Validating parsed/decoded claims set: {}", getLogPrefix(), claimsSet.toString());
try {
- claimsValidator.validate(tokenClaims.getClaimsSet(), profileRequestContext);
+ assert claimsValidator != null;
+ claimsValidator.validate(claimsSet, profileRequestContext);
} catch (final JWTValidationException e) {
log.warn("{} Claims validation failed, token is invalid: {}", getLogPrefix(), e.getMessage());
ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ACCESS_TOKEN);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list