[java-oidc-common] branch main updated: JCOMOIDC-116 - Profile configuration setting for message handler
Henri Mikkonen
henri.mikkonen at iki.fi
Thu May 23 15:36:05 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=e6fd802d69fff9e8830c93721d57ef892beb4605
The following commit(s) were added to refs/heads/main by this push:
new e6fd802 JCOMOIDC-116 - Profile configuration setting for message handler
e6fd802 is described below
commit e6fd802d69fff9e8830c93721d57ef892beb4605
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu May 23 18:35:42 2024 +0300
JCOMOIDC-116 - Profile configuration setting for message handler
https://shibboleth.atlassian.net/browse/JCOMOIDC-116
- New OAuth2InterceptorAwareProfileConfiguration contains the messageHandler setting
- Implemented by AbstractInterceptorAwareOAuth2ProfileConfiguration
- inherited by DefaultOIDCLogoutConfiguration, AbstractOAuth2ClientAuthenticableProfileConfiguration, DefaultOAuth2TokenAudienceConfiguration
---
.../navigate/MessageHandlerLookupFunction.java | 50 +++++++++++++++
...OAuth2InterceptorAwareProfileConfiguration.java | 50 +++++++++++++++
.../impl/DefaultOIDCLogoutConfiguration.java | 4 +-
...OAuth2InterceptorAwareProfileConfiguration.java | 75 ++++++++++++++++++++++
...th2ClientAuthenticableProfileConfiguration.java | 5 +-
.../DefaultOAuth2TokenAudienceConfiguration.java | 3 +-
6 files changed, 180 insertions(+), 7 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/MessageHandlerLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/MessageHandlerLookupFunction.java
new file mode 100644
index 0000000..50a2ede
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/MessageHandlerLookupFunction.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import java.util.function.Function;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.messaging.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2InterceptorAwareProfileConfiguration;
+
+/**
+ * A function that returns {@link OAuth2InterceptorAwareProfileConfiguration#getMessageHandler(MessageContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ *
+ * @since 3.2.0
+ */
+public class MessageHandlerLookupFunction
+ extends AbstractRelyingPartyLookupFunction<Function<MessageContext,Exception>> {
+
+ /** {@inheritDoc} */
+ @Nullable public Function<MessageContext,Exception> apply(@Nullable final MessageContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ if (rpc.getProfileConfig() instanceof OAuth2InterceptorAwareProfileConfiguration downcast) {
+ return downcast.getMessageHandler(input);
+ }
+ }
+ return null;
+ }
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2InterceptorAwareProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2InterceptorAwareProfileConfiguration.java
new file mode 100644
index 0000000..ca99a28
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2InterceptorAwareProfileConfiguration.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.util.function.Function;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import net.shibboleth.idp.profile.config.InterceptorAwareProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
+
+/**
+ * Common interface for interceptor-aware OAuth 2.0 Profile Configurations.
+ *
+ * @since 3.2.0
+ */
+public interface OAuth2InterceptorAwareProfileConfiguration
+ extends OAuth2ProfileConfiguration, InterceptorAwareProfileConfiguration {
+
+ /**
+ * Get a custom handler for a message produced or consumed by this profile.
+ *
+ * <p>This function MUST be stateless and reusable if statically configured, or may be stateful
+ * if obtained by means of a more dynamic strategy.</p>
+ *
+ * <p>The use of the {@link Function} API rather than the OpenSAML {@link MessageHandler} API is a
+ * concession to making scripted or otherwise non-Java implementations easily usable, and avoiding
+ * the explicit need to raise exceptions to signal errors, in cases where doing do is awkward.</p>
+ *
+ * @param messageContext message context
+ *
+ * @return message handler
+ */
+ @ConfigurationSetting(name="messageHandler")
+ @Nullable Function<MessageContext,Exception> getMessageHandler(@Nullable final MessageContext messageContext);
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
index f6d88ab..7410b30 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
@@ -23,9 +23,9 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
import net.shibboleth.idp.session.SPSession;
import net.shibboleth.oidc.profile.config.OIDCLogoutProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.impl.AbstracOAuth2InterceptorAwareProfileConfiguration;
import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
@@ -37,7 +37,7 @@ import net.shibboleth.shared.logic.PredicateSupport;
*
* @since 3.1.0
*/
-public class DefaultOIDCLogoutConfiguration extends AbstractInterceptorAwareProfileConfiguration
+public class DefaultOIDCLogoutConfiguration extends AbstracOAuth2InterceptorAwareProfileConfiguration
implements OIDCLogoutProfileConfiguration, OverriddenIssuerProfileConfiguration {
/** OIDC Back-Channel Logout profile counter name. */
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstracOAuth2InterceptorAwareProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstracOAuth2InterceptorAwareProfileConfiguration.java
new file mode 100644
index 0000000..af791f7
--- /dev/null
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstracOAuth2InterceptorAwareProfileConfiguration.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2InterceptorAwareProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
+
+/**
+ * Abstract profile configuration implementation for interceptor flow aware OAuth2 profile configurations.
+ *
+ * @since 3.2.0
+ */
+public abstract class AbstracOAuth2InterceptorAwareProfileConfiguration
+ extends AbstractInterceptorAwareProfileConfiguration implements OAuth2InterceptorAwareProfileConfiguration {
+
+ /** Lookup strategy for message handler. */
+ @Nonnull private Function<MessageContext,Function<MessageContext,Exception>> messageHandlerLookupStrategy;
+
+ public AbstracOAuth2InterceptorAwareProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+ messageHandlerLookupStrategy = FunctionSupport.constant(null);
+ }
+
+ /** {@inheritDoc} */
+ @Nullable
+ public Function<MessageContext,Exception> getMessageHandler(@Nullable final MessageContext messageContext) {
+ return messageHandlerLookupStrategy.apply(messageContext);
+ }
+
+ /**
+ * Set a handler for the message.
+ *
+ * @param handler message handler
+ *
+ * @since 3.2.0
+ */
+ public void setMessageHandler(@Nullable final Function<MessageContext,Exception> handler) {
+ messageHandlerLookupStrategy = FunctionSupport.constant(handler);
+ }
+
+ /**
+ * Set a lookup strategy for the handler for the message.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.2.0
+ */
+ public void setMessageHandlerLookupStrategy(
+ @Nonnull final Function<MessageContext,Function<MessageContext,Exception>> strategy) {
+ messageHandlerLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index 776b586..c837737 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -29,7 +29,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
@@ -51,8 +50,8 @@ import net.shibboleth.shared.primitive.StringSupport;
* Base class for OAuth profile configurations that support OAuth-defined client authentication methods.
*/
public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
- extends AbstractInterceptorAwareProfileConfiguration implements OAuth2ClientAuthenticableProfileConfiguration,
- OAuth2ClientAuthenticableClientProfileConfiguration {
+ extends AbstracOAuth2InterceptorAwareProfileConfiguration
+ implements OAuth2ClientAuthenticableProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration {
/** Enabled token endpoint authentication methods. */
@Nonnull private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy;
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
index aa95120..6de7df6 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
@@ -25,7 +25,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.Positive;
@@ -37,7 +36,7 @@ import net.shibboleth.shared.primitive.StringSupport;
/**
* Implementation of an OAuth 2.0 token "audience" profile configuration.
*/
-public class DefaultOAuth2TokenAudienceConfiguration extends AbstractInterceptorAwareProfileConfiguration
+public class DefaultOAuth2TokenAudienceConfiguration extends AbstracOAuth2InterceptorAwareProfileConfiguration
implements OAuth2TokenAudienceConfiguration {
/** Lookup function to override issuer value. */
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list