[java-oidc-common] branch main updated: JCOMOIDC-123 - Profile configuration setting for strict scope validation
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Oct 2 11:22:02 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=f6680426bf489299782b0b353b6d20e7fa7ecc37
The following commit(s) were added to refs/heads/main by this push:
new f668042 JCOMOIDC-123 - Profile configuration setting for strict scope validation
f668042 is described below
commit f6680426bf489299782b0b353b6d20e7fa7ecc37
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Oct 2 14:21:33 2024 +0300
JCOMOIDC-123 - Profile configuration setting for strict scope validation
https://shibboleth.atlassian.net/browse/JCOMOIDC-123
- New interface OAuth2ScopeValidatingProfileConfiguration defines setting 'strictScopeValidation'
- Inherited by OIDCSSOProviderConfiguratio and OAuth2PushedAuthorizationRequestConfiguration
- Implemented by AbstractOIDCSSOConfiguration
---
.../config/OIDCSSOProviderConfiguration.java | 3 +-
.../logic/StrictScopeValidationPredicate.java | 45 ++++++++++++++++++++++
...th2PushedAuthorizationRequestConfiguration.java | 2 +-
.../OAuth2ScopeValidatingProfileConfiguration.java | 40 +++++++++++++++++++
.../config/impl/AbstractOIDCSSOConfiguration.java | 33 ++++++++++++++++
5 files changed, 121 insertions(+), 2 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProviderConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProviderConfiguration.java
index e460408..b7f13da 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProviderConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSOProviderConfiguration.java
@@ -17,6 +17,7 @@ package net.shibboleth.oidc.profile.config;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2AccessTokenProducingProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2RefreshTokenProducingProfileConfiguration;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ScopeValidatingProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration;
import net.shibboleth.profile.config.AttributeResolvingProfileConfiguration;
@@ -27,6 +28,6 @@ public interface OIDCSSOProviderConfiguration extends OAuth2TokenEncryptionProfi
OIDCIDTokenProducingProfileConfiguration, OAuth2AccessTokenProducingProfileConfiguration,
OAuth2RefreshTokenProducingProfileConfiguration, OIDCSSOProfileConfiguration,
AttributeResolvingProfileConfiguration, OIDCFlowAwareProfileConfiguration,
- OAuth2ClientAuthenticableProfileConfiguration {
+ OAuth2ClientAuthenticableProfileConfiguration, OAuth2ScopeValidatingProfileConfiguration {
}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/StrictScopeValidationPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/StrictScopeValidationPredicate.java
new file mode 100644
index 0000000..0c6896d
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/StrictScopeValidationPredicate.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ScopeValidatingProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+
+/**
+ * A predicate implementation that forwards to
+ * {@link OAuth2ScopeValidatingProfileConfiguration#isStrictScopeValidation(ProfileRequestContext)}.
+ *
+ * @since 3.2.0
+ */
+public class StrictScopeValidationPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ if (rpc.getProfileConfig() instanceof OAuth2ScopeValidatingProfileConfiguration oasvpc) {
+ return oasvpc.isStrictScopeValidation(input);
+ }
+ }
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2PushedAuthorizationRequestConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2PushedAuthorizationRequestConfiguration.java
index 3be99a5..17eb12c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2PushedAuthorizationRequestConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2PushedAuthorizationRequestConfiguration.java
@@ -38,7 +38,7 @@ import net.shibboleth.shared.annotation.constraint.Positive;
public interface OAuth2PushedAuthorizationRequestConfiguration extends OAuth2ClientAuthenticableProfileConfiguration,
OAuth2AuthorizationProfileConfiguration, OAuth2ProfileConfiguration, OverriddenIssuerProfileConfiguration,
OIDCAuthenticationRelyingPartyProfileConfiguration, OIDCAuthenticationProfileConfiguration,
- OAuth2DPoPProofValidatingProfileConfiguration {
+ OAuth2DPoPProofValidatingProfileConfiguration, OAuth2ScopeValidatingProfileConfiguration {
/** OAuth2 Pushed Authorization Requests URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc9126";
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ScopeValidatingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ScopeValidatingProfileConfiguration.java
new file mode 100644
index 0000000..a822fca
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ScopeValidatingProfileConfiguration.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.shared.annotation.ConfigurationSetting;
+
+/**
+ * Profile configuration for validating scope values.
+ *
+ * @since 3.2.0
+ */
+public interface OAuth2ScopeValidatingProfileConfiguration extends OAuth2ProfileConfiguration {
+
+ /**
+ * Get whether scope validation is strict, i.e. request for unallowed scopes is an error.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return whether scope validation is strict
+ */
+ @ConfigurationSetting(name="strictScopeValidation")
+ boolean isStrictScopeValidation(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 9535faa..0b04194 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -105,6 +105,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
/** Whether the access token to be issued is always a bearer access token. */
@Nonnull private Predicate<ProfileRequestContext> alwaysIssueBearerAccessTokenPredicate;
+ /** Whether scope validation is strict, i.e. request for unallowed scopes is an error. */
+ @Nonnull private Predicate<ProfileRequestContext> strictScopeValidationPredicate;
+
/**
* Creates a new configuration instance.
*
@@ -135,6 +138,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
customRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(null);
alwaysIssueBearerAccessTokenPredicate = PredicateSupport.alwaysFalse();
+ strictScopeValidationPredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -670,4 +674,33 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
"Always issue bearer access token predicate cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ public boolean isStrictScopeValidation(@Nullable final ProfileRequestContext profileRequestContext) {
+ return strictScopeValidationPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether scope validation is strict, i.e. request for unallowed scopes is an error.
+ *
+ * @param flag flag to set
+ *
+ * @since 3.2.0
+ */
+ public void setStrictScopeValidation(final boolean flag) {
+ strictScopeValidationPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether scope validation is strict, i.e. request for unallowed scopes is an error.
+ *
+ * @param condition condition to set
+ *
+ * @since 3.2.0
+ */
+ public void setStrictScopeValidationPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ strictScopeValidationPredicate = Constraint.isNotNull(condition,
+ "Strict scope validation predicate cannot be null");
+ }
+
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list