[java-oidc-common] branch main updated: JCOMOIDC-108 - Profile Configuration for OAuth2 PAR
Henri Mikkonen
henri.mikkonen at iki.fi
Thu May 30 12:18:50 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=1eea9b7094df6f4d03a71916aaff6d3cc631a82f
The following commit(s) were added to refs/heads/main by this push:
new 1eea9b7 JCOMOIDC-108 - Profile Configuration for OAuth2 PAR
1eea9b7 is described below
commit 1eea9b7094df6f4d03a71916aaff6d3cc631a82f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu May 30 15:18:37 2024 +0300
JCOMOIDC-108 - Profile Configuration for OAuth2 PAR
https://shibboleth.atlassian.net/browse/JCOMOIDC-108
- Included 'requirePushedAuthorizationRequest' to OAuth2AuthorizationProfileConfiguration
---
...RequirePushedAuthorizationRequestPredicate.java | 48 ++++++++++++++++++++++
.../shibboleth/oidc/profile/core/OidcEventIds.java | 7 ++++
.../OAuth2AuthorizationProfileConfiguration.java | 14 +++++++
.../DefaultOIDCAuthorizationConfiguration.java | 34 +++++++++++++++
4 files changed, 103 insertions(+)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RequirePushedAuthorizationRequestPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RequirePushedAuthorizationRequestPredicate.java
new file mode 100644
index 0000000..c8618de
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/RequirePushedAuthorizationRequestPredicate.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OAuth2AuthorizationProfileConfiguration#isRequirePushedAuthorizationRequest(ProfileRequestContext)}.
+ * Defaults to false.
+ *
+ * @since 3.2.0
+ */
+public class RequirePushedAuthorizationRequestPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OAuth2AuthorizationProfileConfiguration oapc) {
+ return oapc.isRequirePushedAuthorizationRequest(input);
+ }
+ }
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java
index 64a73c4..f8253b6 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OidcEventIds.java
@@ -189,6 +189,13 @@ public final class OidcEventIds {
*/
@Nonnull @NotEmpty public static final String INVALID_DPOP_NONCE = "DPoPNonceInvalid";
+ /**
+ * The pushed authorization request (specific request_uri) is not included in request even though it's mandatory.
+ *
+ * @since 3.2.0
+ */
+ @Nonnull @NotEmpty public static final String MISSING_MANDATORY_PAR_REQUEST_URI = "MissingMandatoryParRequest";
+
/**
* Constructor.
*/
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
index 52f5130..4df1914 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
@@ -128,4 +128,18 @@ public interface OAuth2AuthorizationProfileConfiguration {
*/
@ConfigurationSetting(name="requireDpopJkt")
boolean isRequireDpopJkt(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether client is required to use pushed authorization requests. If enabled, then the client needs to call
+ * pushed authorization endpoint before authorization endpoint in order to fetch the request_uri to be included
+ * in the authorization request.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return whether client is required to use pushed authorization requests.
+ *
+ * @since 3.2.0
+ */
+ @ConfigurationSetting(name="requirePushedAuthorizationRequest")
+ boolean isRequirePushedAuthorizationRequest(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 837c3ef..0406b80 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -149,6 +149,9 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
/** Whether client is required to include dpop_jkt in authorization request. */
@Nonnull private Predicate<ProfileRequestContext> requireDpopJktPredicate;
+ /** Whether client is required to use pushed authorization request. */
+ @Nonnull private Predicate<ProfileRequestContext> requirePushedAuthorizationRequestPredicate;
+
/**
* Constructor.
*/
@@ -192,6 +195,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
requireAuthenticationRequestPredicateLookupStrategy =
FunctionSupport.constant(PredicateSupport.alwaysTrue());
requireDpopJktPredicate = PredicateSupport.alwaysFalse();
+ requirePushedAuthorizationRequestPredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -1024,4 +1028,34 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
requireDpopJktPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ public boolean isRequirePushedAuthorizationRequest(@Nullable final ProfileRequestContext profileRequestContext) {
+ return requirePushedAuthorizationRequestPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether client is required to use pushed authorization request.
+ *
+ * @param flag flag to set
+ *
+ * @since 3.2.0
+ */
+ public void setRequirePushedAuthorizationRequest(final boolean flag) {
+ requirePushedAuthorizationRequestPredicate =
+ flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set condition for whether client is required to use pushed authorization request.
+ *
+ * @param condition condition to set
+ *
+ * @since 3.2.0
+ */
+ public void setRequirePushedAuthorizationRequestPredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ requirePushedAuthorizationRequestPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list