[java-oidc-common] branch main updated: JCOMOIDC-112 - Profile configuration settings for OAuth2 DPoP
Henri Mikkonen
henri.mikkonen at iki.fi
Wed May 22 10:52:08 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=06a2c844af1dbf61e86ddb17eaa13ba002c1c1b3
The following commit(s) were added to refs/heads/main by this push:
new 06a2c84 JCOMOIDC-112 - Profile configuration settings for OAuth2 DPoP
06a2c84 is described below
commit 06a2c844af1dbf61e86ddb17eaa13ba002c1c1b3
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed May 22 13:51:44 2024 +0300
JCOMOIDC-112 - Profile configuration settings for OAuth2 DPoP
https://shibboleth.atlassian.net/browse/JCOMOIDC-112
- New 'dpopProofNonceGenerator' profile configuration setting in OAuth2DPoPProofValidatingProfileConfiguration
- Nullable Function<ProfileRequestContext, String>
- If null, it means that no nonces are generated (and thus not needed from the clients)
- Implemented in AbstractOAuth2ClientAuthenticableProfileConfiguration
---
.../DPoPProofNonceGeneratorLookupFunction.java | 54 ++++++++++++++++++++++
.../shibboleth/oidc/profile/core/OidcEventIds.java | 7 +++
...th2DPoPProofValidatingProfileConfiguration.java | 12 +++++
...th2ClientAuthenticableProfileConfiguration.java | 37 +++++++++++++++
4 files changed, 110 insertions(+)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/DPoPProofNonceGeneratorLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/DPoPProofNonceGeneratorLookupFunction.java
new file mode 100644
index 0000000..d054718
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/DPoPProofNonceGeneratorLookupFunction.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.function.Function;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2DPoPProofValidatingProfileConfiguration;
+
+/**
+ * A function that obtains {@link
+ * OAuth2DPoPProofValidatingProfileConfiguration#getDpopProofNonceGenerator(ProfileRequestContext)} if such a profile is
+ * available from a {@link RelyingPartyContext} obtained via a lookup function, by default a child of the
+ * {@link ProfileRequestContext}. The value is returned as a single-valued list.
+ *
+ * <p>If a specific setting is unavailable, an empty list value is returned.</p>
+ *
+ * @since 3.2.0
+ */
+public class DPoPProofNonceGeneratorLookupFunction
+ extends AbstractRelyingPartyLookupFunction<Function<ProfileRequestContext,String>> {
+
+ /** {@inheritDoc} */
+ @Override @Nullable public Function<ProfileRequestContext,String> apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OAuth2DPoPProofValidatingProfileConfiguration odpvpc) {
+ return odpvpc.getDpopProofNonceGenerator(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java
index b54e86c..a33fb4c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java
@@ -175,6 +175,13 @@ public final class OidcEventIds {
*/
@Nonnull @NotEmpty public static final String INVALID_DPOP_PROOF = "DPoPProofInvalid";
+ /**
+ * ID of event returned if the DPoP proof nonce is invalid.
+ *
+ * @since 3.2.0
+ */
+ @Nonnull @NotEmpty public static final String INVALID_DPOP_NONCE = "DPoPNonceInvalid";
+
/**
* Constructor.
*/
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2DPoPProofValidatingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2DPoPProofValidatingProfileConfiguration.java
index a3d79ab..c05126c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2DPoPProofValidatingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2DPoPProofValidatingProfileConfiguration.java
@@ -15,6 +15,8 @@
package net.shibboleth.oidc.profile.oauth2.config;
+import java.util.function.Function;
+
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -61,4 +63,14 @@ public interface OAuth2DPoPProofValidatingProfileConfiguration extends OAuth2Pro
@ConfigurationSetting(name="requireDpopProof")
boolean isRequireDpopProof(@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get the {@link Function} to create nonces to be used with DPoP Proof JWTs.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the nonce generator to use
+ */
+ @ConfigurationSetting(name="dpopProofNonceGenerator")
+ @Nullable Function<ProfileRequestContext, String> getDpopProofNonceGenerator(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index b046a08..776b586 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -99,6 +99,10 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
/** Whether client is required to include DPoP Proof JWT in API request. */
@Nonnull private Predicate<ProfileRequestContext> requireDpopProofPredicate;
+ /** Lookup function to retrieve nonce generator for DPoP proofs. */
+ @Nonnull private Function<ProfileRequestContext,Function<ProfileRequestContext,String>>
+ dpopProofNonceGeneratorLookupStrategy;
+
/**
* Constructor.
*
@@ -127,6 +131,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
dpopProofClaimsValidatorLookupStrategy = FunctionSupport.constant(null);
dpopSignatureValidationConfigurationLookupStrategy = FunctionSupport.constant(null);
requireDpopProofPredicate = PredicateSupport.alwaysFalse();
+ dpopProofNonceGeneratorLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -581,4 +586,36 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
public void setRequireDpopProofPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
requireDpopProofPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public Function<ProfileRequestContext, String> getDpopProofNonceGenerator(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return dpopProofNonceGeneratorLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the {@link Function} to create nonces to be used with DPoP Proof JWTs.
+ *
+ * @param function generator function to use
+ *
+ * @since 3.2.0
+ */
+ public void setDpopProofNonceGenerator(
+ @Nullable final Function<ProfileRequestContext,String> function) {
+ dpopProofNonceGeneratorLookupStrategy = FunctionSupport.constant(function);
+ }
+
+ /**
+ * Set a lookup strategy for the {@link Function} to create nonces to be used with DPoP Proof JWTs.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.2.0
+ */
+ public void setDpopProofNonceGeneratorLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Function<ProfileRequestContext,String>> strategy) {
+ dpopProofNonceGeneratorLookupStrategy =
+ Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list