[java-idp-oidc] 12/35: JOIDC-225 - Relocate and improve lookup functions for request message contents
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Oct 24 14:01:37 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch dev/JOIDC-222
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=a488423e50e41ff3efaa5921a612ba15e110b995
commit a488423e50e41ff3efaa5921a612ba15e110b995
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Sep 26 18:22:23 2024 +0300
JOIDC-225 - Relocate and improve lookup functions for request message contents
https://shibboleth.atlassian.net/browse/JOIDC-225
- Restored the lookup functions in API to the shape that they were for previous release (4.1.0)
- Deprecate the lookup functions in API that directly reads the request messages
- Their improved versions were moved to -impl: net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate
- The ones that deal with our own context data were left intact
- The new functions dealing with authorization/authentication requests need to be initialized
- They are @ThreadSafeAfterInit
- They are always wired to the SWF actions via XML, no default value via Java anymore
---
...bstractAuthenticationRequestLookupFunction.java | 1 +
...AbstractAuthorizationRequestLookupFunction.java | 64 ++----------
.../AbstractTokenRequestLookupFunction.java | 7 ++
.../navigate/DefaultClientIDLookupFunction.java | 7 ++
.../DefaultRequestAudienceLookupFunction.java | 3 +-
.../DefaultRequestCodeChallengeLookupFunction.java | 4 +-
...ltRequestCodeChallengeMethodLookupFunction.java | 4 +-
.../DefaultRequestLoginHintLookupFunction.java | 3 +-
.../DefaultRequestMaxAgeLookupFunction.java | 4 +-
.../DefaultRequestNonceLookupFunction.java | 3 +-
.../DefaultRequestRedirectURILookupFunction.java | 5 +-
.../DefaultRequestResponseModeLookupFunction.java | 3 +-
.../DefaultRequestResponseTypeLookupFunction.java | 10 +-
.../DefaultRequestStateLookupFunction.java | 3 +-
.../DefaultRequestedAcrLookupFunction.java | 3 +-
.../DefaultRequestedClaimsLookupFunction.java | 3 +-
.../DefaultRequestedPromptLookupFunction.java | 3 +-
.../DefaultRequestedScopeLookupFunction.java | 10 +-
.../DefaultValidResponseTypesLookupFunction.java | 1 +
.../TokenRequestAudienceLookupFunction.java | 1 +
...okenRequestAuthorizationCodeLookupFunction.java | 1 +
.../TokenRequestClientIDLookupFunction.java | 7 ++
.../TokenRequestRedirectURILookupFunction.java | 1 +
.../navigate/TokenRequestScopeLookupFunction.java | 1 +
...actAuthenticationRequestLookupFunctionTest.java | 4 +-
...ractAuthorizationRequestLookupFunctionTest.java | 2 +
.../AbstractTokenRequestLookupFunctionTest.java | 2 +
.../DefaultClientIDLookupFunctionTest.java | 1 +
.../DefaultRequestLoginHintLookupFunctionTest.java | 1 +
.../navigate/DefaultRequestMaxAgeFunctionTest.java | 1 +
.../DefaultRequestNonceLookupFunctionTest.java | 1 +
...efaultRequestRedirectURILookupFunctionTest.java | 1 +
...faultRequestResponseModeLookupFunctionTest.java | 1 +
...faultRequestResponseTypeLookupFunctionTest.java | 1 +
.../DefaultRequestStateLookupFunctionTest.java | 1 +
.../DefaultRequestedAcrLookupFunctionTest.java | 1 +
.../DefaultRequestedClaimsLookupFunctionTest.java | 1 +
.../DefaultRequestedPromptLookupFunctionTest.java | 1 +
.../DefaultRequestedScopeLookupFunctionTest.java | 51 +--------
.../TokenRequestClientIDLookupFunctionTest.java | 1 +
.../TokenRequestRedirectURILookupFunctionTest.java | 1 +
.../AuthenticationRequestClaimsAuditExtractor.java | 11 +-
...bstractAuthenticationRequestLookupFunction.java | 36 ++++---
...AbstractAuthorizationRequestLookupFunction.java | 57 +++++-----
.../AbstractTokenRequestLookupFunction.java | 7 +-
.../navigate/DefaultClientIDLookupFunction.java | 6 +-
.../DefaultRequestAudienceLookupFunction.java | 19 ++--
.../DefaultRequestCodeChallengeLookupFunction.java | 14 ++-
...ltRequestCodeChallengeMethodLookupFunction.java | 17 ++-
.../DefaultRequestDPoPJktLookupFunction.java | 11 +-
.../DefaultRequestLoginHintLookupFunction.java | 16 ++-
.../DefaultRequestMaxAgeLookupFunction.java | 16 ++-
.../DefaultRequestNonceLookupFunction.java | 18 +++-
.../DefaultRequestRedirectURILookupFunction.java | 16 ++-
.../DefaultRequestResponseModeLookupFunction.java | 16 ++-
.../DefaultRequestResponseTypeLookupFunction.java | 16 ++-
.../DefaultRequestStateLookupFunction.java | 16 ++-
.../DefaultRequestedAcrLookupFunction.java | 16 ++-
.../DefaultRequestedClaimsLookupFunction.java | 16 ++-
.../DefaultRequestedPromptLookupFunction.java | 16 ++-
.../DefaultRequestedScopeLookupFunction.java | 16 ++-
.../DefaultUseOnlyRequestObjectPredicate.java | 6 +-
.../DefaultValidResponseTypesLookupFunction.java | 16 ++-
.../TokenRequestAudienceLookupFunction.java | 12 ++-
.../TokenRequestClientIDLookupFunction.java | 6 +-
.../TokenRequestRedirectURILookupFunction.java | 6 +-
.../navigate/TokenRequestScopeLookupFunction.java | 6 +-
.../messaging/context/navigate/package-info.java | 16 +++
.../decoding/impl/BaseOAuth2RequestDecoder.java | 2 +-
.../CustomResourceHttpServletRequestWrapper.java | 2 +-
.../impl/SetEntityIdToSAMLPeerEntityContext.java | 2 +-
.../op/oauth2/profile/impl/BuildAccessToken.java | 2 +-
.../SetAuthorizationCodeToResponseContext.java | 37 +++++--
.../profile/impl/StoreDPoPProofKeyThumbprint.java | 16 ++-
.../op/oauth2/profile/impl/ValidateAudience.java | 2 +-
.../impl/ValidateClientIDAgainstPolicy.java | 2 +-
.../oauth2/profile/impl/ValidateCodeChallenge.java | 22 ++--
.../ValidatePushedAuthorizationClientIDMatch.java | 2 +-
.../oauth2/profile/impl/ValidateRedirectURI.java | 7 +-
.../oauth2/profile/impl/ValidateResponseMode.java | 16 ++-
.../oauth2/profile/impl/ValidateResponseType.java | 23 ++--
.../oidc/op/oauth2/profile/impl/ValidateScope.java | 25 +++--
.../oidc/op/profile/impl/AddNonceToIDToken.java | 23 ++--
.../BuildAuthenticationErrorResponseFromEvent.java | 70 +++++++++++--
.../FormOutboundAuthenticationResponseMessage.java | 55 ++++++++--
.../impl/InitializeAuthenticationContext.java | 30 ++++--
...tboundAuthenticationResponseMessageContext.java | 2 +-
.../impl/InitializeRelyingPartyContext.java | 2 +-
.../op/profile/impl/OIDCMetadataLookupHandler.java | 2 +-
.../profile/impl/ProcessRequestedAuthnContext.java | 16 ++-
.../plugin/oidc/op/profile/impl/RevokeConsent.java | 22 ++--
.../impl/SetRequestedClaimsToResponseContext.java | 13 +--
.../logic/DefaultRevokeConsentPredicate.java | 17 ++-
.../impl/OIDCRPSessionCreationStrategy.java | 2 +-
.../oauth2/introspection/introspection-beans.xml | 2 +-
.../pushed-authorization-beans.xml | 15 +--
.../flows/oauth2/revocation/revocation-beans.xml | 2 +-
.../idp/flows/oidc/authorize/authorize-beans.xml | 116 ++++++++++++++++++---
.../idp/flows/oidc/token/token-beans.xml | 6 +-
.../impl/OIDCAuthenticationRequestDecoderTest.java | 2 +-
.../decoding/impl/OIDCTokenRequestDecoderTest.java | 2 +-
...actAuthenticationRequestLookupFunctionTest.java | 17 ++-
...ractAuthorizationRequestLookupFunctionTest.java | 17 ++-
.../AbstractTokenRequestLookupFunctionTest.java | 2 +-
.../DefaultClientIDLookupFunctionTest.java | 2 +-
.../DefaultRequestLoginHintLookupFunctionTest.java | 5 +-
.../navigate/DefaultRequestMaxAgeFunctionTest.java | 6 +-
.../DefaultRequestNonceLookupFunctionTest.java | 6 +-
...efaultRequestRedirectURILookupFunctionTest.java | 5 +-
...faultRequestResponseModeLookupFunctionTest.java | 5 +-
...faultRequestResponseTypeLookupFunctionTest.java | 5 +-
.../DefaultRequestStateLookupFunctionTest.java | 5 +-
.../DefaultRequestedAcrLookupFunctionTest.java | 5 +-
.../DefaultRequestedClaimsLookupFunctionTest.java | 5 +-
.../DefaultRequestedPromptLookupFunctionTest.java | 5 +-
.../DefaultRequestedScopeLookupFunctionTest.java | 5 +-
.../TokenRequestClientIDLookupFunctionTest.java | 2 +-
.../TokenRequestRedirectURILookupFunctionTest.java | 2 +-
.../OAuth2AuthorizationRequestDecoderTest.java | 2 +-
.../SetAuthorizationCodeToResponseContextTest.java | 14 +++
.../oauth2/profile/impl/ValidateAudienceTest.java | 2 +-
.../profile/impl/ValidateCodeChallengeTest.java | 9 ++
.../profile/impl/ValidateResponseTypeTest.java | 20 +++-
.../op/oauth2/profile/impl/ValidateScopeTest.java | 11 +-
.../op/profile/impl/AddNonceToIDTokenTest.java | 4 +
...mOutboundAuthenticationResponseMessageTest.java | 8 ++
.../impl/InitializeAuthenticationContextTest.java | 17 +++
.../impl/ProcessRequestedAuthnContextTest.java | 4 +
.../oidc/op/profile/impl/RevokeConsentTest.java | 8 ++
129 files changed, 983 insertions(+), 422 deletions(-)
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java
index 4cf5a2d6..a0597c83 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java
@@ -28,6 +28,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
*
* @param <T> type of lookup result to return.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public abstract class AbstractAuthenticationRequestLookupFunction<T>
extends AbstractAuthorizationRequestLookupFunction<T>
implements ContextDataLookupFunction<ProfileRequestContext,T> {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java
index 1915146c..4c3c0b3c 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java
@@ -14,22 +14,19 @@
package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
-import java.util.function.BiPredicate;
-
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
-import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.DeprecationSupport;
+import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
/**
* A Abstract function extended by lookups searching fields from authorization request.
@@ -38,21 +35,16 @@ import net.shibboleth.shared.primitive.LoggerFactory;
*
* @since 3.3.0
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public abstract class AbstractAuthorizationRequestLookupFunction<T>
implements ContextDataLookupFunction<ProfileRequestContext,T> {
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AbstractAuthorizationRequestLookupFunction.class);
-
/** Request. */
@Nullable private JWT requestObject;
/** The request message class to verify that the actual request is an instance of. */
@Nonnull private final Class<? extends AuthorizationRequest> messageClass;
- /** The predicate to decide if the parameter values may only be set in the request object. */
- @Nonnull private BiPredicate<AuthorizationRequest, String> useOnlyRequestObjectPredicate;
-
/**
* Constructor.
*/
@@ -67,19 +59,6 @@ public abstract class AbstractAuthorizationRequestLookupFunction<T>
*/
protected AbstractAuthorizationRequestLookupFunction(@Nonnull final Class<? extends AuthorizationRequest> clazz) {
messageClass = Constraint.isNotNull(clazz, "Message class cannot be null");
- useOnlyRequestObjectPredicate = new DefaultUseOnlyRequestObjectPredicate();
- }
-
- /**
- * Set the predicate to decide if the parameter values may only be set in the request object.
- *
- * @param predicate the predicate to decide if the parameter values may only be set in the request object.
- *
- * @since 4.2.0
- */
- public void setUseOnlyRequestObjectPredicate(@Nonnull final BiPredicate<AuthorizationRequest, String> predicate) {
- useOnlyRequestObjectPredicate = Constraint.isNotNull(predicate,
- "Use only request object predicate cannot be null");
}
/**
@@ -91,14 +70,16 @@ public abstract class AbstractAuthorizationRequestLookupFunction<T>
@Nullable protected abstract T doLookup(@Nonnull final AuthorizationRequest req);
/** {@inheritDoc} */
+ @SuppressWarnings("null")
@Nullable
public T apply(@Nullable final ProfileRequestContext input) {
+ DeprecationSupport.warn(ObjectType.CLASS, getClass().getName(), null,
+ "Classes in package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate'");
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
final Object message = input.ensureInboundMessageContext().getMessage();
- if (message == null ||
- (!(messageClass.isInstance(message)) && !(message instanceof PushedAuthorizationRequest))) {
+ if (message == null || !(messageClass.isInstance(message))) {
return null;
}
if (input.getOutboundMessageContext() != null) {
@@ -108,12 +89,7 @@ public abstract class AbstractAuthorizationRequestLookupFunction<T>
requestObject = ctx.getRequestObject();
}
}
-
- if (message instanceof PushedAuthorizationRequest pushedAuthorizationRequest) {
- final AuthorizationRequest authorizationRequest = pushedAuthorizationRequest.getAuthorizationRequest();
- assert authorizationRequest != null;
- return doLookup(authorizationRequest);
- }
+
return doLookup((AuthorizationRequest) message);
}
@@ -125,27 +101,5 @@ public abstract class AbstractAuthorizationRequestLookupFunction<T>
@Nullable public JWT getRequestObject() {
return requestObject;
}
-
- /**
- * Check if the given {@link AuthorizationRequest} and parameter should only be set in the request object. It's
- * tested with {@link #useOnlyRequestObjectPredicate}: if it returns true, the default result is returned
- * instead of the parameter value.
- *
- * @param authorizationRequest the authorization request being processed.
- * @param parameterName the parameter name.
- * @param parameterValue the value found from the parameters.
- * @param defaultResult the default value to be used if the request contained OAuth2 JAR request object.
- * @return the parameter value to be used, depending on the authorization request message contents.
- *
- * @since 4.2.0
- */
- @Nullable protected T checkRequestObject(@Nonnull final AuthorizationRequest authorizationRequest,
- @Nonnull final String parameterName, @Nullable final T parameterValue, @Nullable T defaultResult) {
- if (useOnlyRequestObjectPredicate.test(authorizationRequest, parameterName)) {
- log.debug("Ignoring value {}={} from authorization request as request object is defined", parameterName,
- parameterValue);
- return defaultResult;
- }
- return parameterValue;
- }
+
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java
index 9bec672e..2601e634 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java
@@ -20,11 +20,15 @@ import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.oauth2.sdk.TokenRequest;
+import net.shibboleth.shared.primitive.DeprecationSupport;
+import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
+
/**
* A Abstract function extended by lookups searching fields from token request.
*
* @param <T> type of lookup result to return.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public abstract class AbstractTokenRequestLookupFunction<T>
implements ContextDataLookupFunction<ProfileRequestContext, T> {
@@ -37,8 +41,11 @@ public abstract class AbstractTokenRequestLookupFunction<T>
abstract T doLookup(@Nonnull TokenRequest req);
/** {@inheritDoc} */
+ @SuppressWarnings("null")
@Nullable
public T apply(@Nullable final ProfileRequestContext input) {
+ DeprecationSupport.warn(ObjectType.CLASS, getClass().getName(), null,
+ "Classes in package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate'");
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunction.java
index b0e74f13..45099871 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunction.java
@@ -22,14 +22,21 @@ import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.id.ClientID;
+import net.shibboleth.shared.primitive.DeprecationSupport;
+import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
+
/**
* A function that returns client id of the authentication request via a lookup function. This default lookup locates
* client id from oidc authentication request if available. If information is not available, null is returned.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultClientIDLookupFunction implements ContextDataLookupFunction<MessageContext, ClientID> {
/** {@inheritDoc} */
+ @SuppressWarnings("null")
@Nullable public ClientID apply(@Nullable final MessageContext input) {
+ DeprecationSupport.warn(ObjectType.CLASS, getClass().getName(), null,
+ "Classes in package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate'");
if (input == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java
index 51ade30d..9986372b 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java
@@ -37,6 +37,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
*
* @since 3.2.0
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestAudienceLookupFunction extends AbstractAuthorizationRequestLookupFunction<List<String>> {
/** Custom name for the resource parameter that allows non-uri values. */
@@ -66,7 +67,7 @@ public class DefaultRequestAudienceLookupFunction extends AbstractAuthorizationR
return null;
}
- return checkRequestObject(req, "resource", req.getCustomParameter(CUSTOM_RESOURCE_PARAM_NAME), null);
+ return req.getCustomParameter(CUSTOM_RESOURCE_PARAM_NAME);
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
index 8ff2d1ba..6adb4ffe 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
@@ -30,6 +30,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* locates code challenge from OAuth authorization request if available. If information is not available, null is
* returned. If there is code_challenge in request object it is used instead of code_challenge parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestCodeChallengeLookupFunction extends AbstractAuthorizationRequestLookupFunction<String> {
/** Class logger. */
@@ -54,8 +55,7 @@ public class DefaultRequestCodeChallengeLookupFunction extends AbstractAuthoriza
log.error("Unable to parse code challenge from request object code_challenge value");
return null;
}
- return req.getCodeChallenge() == null ? null :
- checkRequestObject(req, "code_challenge", req.getCodeChallenge().getValue(), null);
+ return req.getCodeChallenge() == null ? null : req.getCodeChallenge().getValue();
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
index be2ea11f..d8392a8d 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
@@ -29,6 +29,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* null is returned. If there is code_challenge_method in request object it is used instead of code_challenge_method
* parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestCodeChallengeMethodLookupFunction
extends AbstractAuthorizationRequestLookupFunction<String> {
@@ -55,8 +56,7 @@ public class DefaultRequestCodeChallengeMethodLookupFunction
log.error("Unable to parse code challenge method from request object code_challenge_method value");
return null;
}
- return req.getCodeChallengeMethod() == null ? null :
- checkRequestObject(req, "code_challenge_method", req.getCodeChallengeMethod().getValue(), null);
+ return req.getCodeChallengeMethod() == null ? null : req.getCodeChallengeMethod().getValue();
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java
index cb83710c..7b1dd3be 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java
@@ -28,6 +28,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* authentication request if available. If information is not available, null is returned. If there is hint in request
* object it is used instead of login_hint parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestLoginHintLookupFunction extends AbstractAuthenticationRequestLookupFunction<String> {
/** Class logger. */
@@ -52,6 +53,6 @@ public class DefaultRequestLoginHintLookupFunction extends AbstractAuthenticatio
log.error("Unable to parse login hint from request object login_hint value");
return null;
}
- return checkRequestObject(req, "login_hint", req.getLoginHint(), null);
+ return req.getLoginHint();
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java
index 2f3f398c..fedb85c0 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java
@@ -30,6 +30,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* locates max age from oidc authentication request if available. If information is not available, null is returned. If
* there is max_age parameter in request object it is used instead of max_age request parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestMaxAgeLookupFunction extends AbstractAuthenticationRequestLookupFunction<Duration> {
/** Class logger. */
@@ -48,7 +49,6 @@ public class DefaultRequestMaxAgeLookupFunction extends AbstractAuthenticationRe
log.error("Unable to parse state from request object state value");
return null;
}
- return req.getMaxAge() == -1 ? null :
- checkRequestObject(req, "max_age", Duration.ofSeconds(req.getMaxAge()), null);
+ return req.getMaxAge() == -1 ? null : Duration.ofSeconds(req.getMaxAge());
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java
index 2a060f6b..b817de42 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java
@@ -29,6 +29,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* authentication request if available. If information is not available, null is returned. If there is nonce in request
* object it is used instead of nonce parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestNonceLookupFunction extends AbstractAuthenticationRequestLookupFunction<Nonce> {
/** Class logger. */
@@ -54,7 +55,7 @@ public class DefaultRequestNonceLookupFunction extends AbstractAuthenticationReq
return null;
}
if (req.getNonce() != null) {
- return checkRequestObject(req, "nonce", new Nonce(req.getNonce().getValue()), null);
+ return new Nonce(req.getNonce().getValue());
}
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java
index a77b41ac..b295238a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java
@@ -30,12 +30,13 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* redirect uri from OAuth authorization request if available. If information is not available, null is returned. If
* there is redirect uri in request object it is used instead of redirect_uri parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestRedirectURILookupFunction extends AbstractAuthorizationRequestLookupFunction<URI> {
/** Class logger. */
@Nonnull
private Logger log = LoggerFactory.getLogger(DefaultRequestRedirectURILookupFunction.class);
-
+
/** {@inheritDoc} */
@Override
protected URI doLookup(@Nonnull final AuthorizationRequest req) {
@@ -54,6 +55,6 @@ public class DefaultRequestRedirectURILookupFunction extends AbstractAuthorizati
log.error("Unable to parse redirect URI from request object redirect_uri value");
return null;
}
- return checkRequestObject(req, "redirect_uri", req.getRedirectionURI(), null);
+ return req.getRedirectionURI();
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java
index 38971a64..4cd775f3 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java
@@ -30,6 +30,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* response mode from OAuth authorization request if available. If information is not available, null is returned. If
* there is response mode in request object it is used instead of response_mode parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestResponseModeLookupFunction
extends AbstractAuthorizationRequestLookupFunction<ResponseMode> {
@@ -58,6 +59,6 @@ public class DefaultRequestResponseModeLookupFunction
if (req.getResponseMode() == null) {
return null;
}
- return checkRequestObject(req, "response_mode", new ResponseMode(req.getResponseMode().getValue()), null);
+ return new ResponseMode(req.getResponseMode().getValue());
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java
index 4fb936c1..7ab8dbcd 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java
@@ -29,6 +29,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* OAuth authorization request if available. If information is not available, null is returned. If there is response
* type in request object it is used instead of response_type parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestResponseTypeLookupFunction
extends AbstractAuthorizationRequestLookupFunction<ResponseType> {
@@ -48,11 +49,8 @@ public class DefaultRequestResponseTypeLookupFunction
log.error("Unable to parse response type from request object response_type value {}", e.getMessage());
return null;
}
- final ResponseType requestedType = req.getResponseType();
- final ResponseType result = new ResponseType();
- if (requestedType != null) {
- result.addAll(requestedType);
- }
- return checkRequestObject(req, "response_type", result, new ResponseType());
+ final ResponseType requestParameterScope = new ResponseType();
+ requestParameterScope.addAll(req.getResponseType());
+ return requestParameterScope;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java
index 7b7e40c2..3f9f1cc5 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java
@@ -29,6 +29,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* OAuth authorization request if available. If information is not available, null is returned. If there is state in
* request object it is used instead of state parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestStateLookupFunction extends AbstractAuthorizationRequestLookupFunction<State> {
/** Class logger. */
@@ -56,6 +57,6 @@ public class DefaultRequestStateLookupFunction extends AbstractAuthorizationRequ
if (req.getState() == null) {
return null;
}
- return checkRequestObject(req, "state", new State(req.getState().getValue()), null);
+ return new State(req.getState().getValue());
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java
index 4643618d..6601d06a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java
@@ -31,6 +31,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* from oidc authentication request if available. If information is not available, null is returned. If there are acr
* values in request object it is used instead of acr_values parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestedAcrLookupFunction extends AbstractAuthenticationRequestLookupFunction<List<ACR>> {
/** Class logger. */
@@ -59,6 +60,6 @@ public class DefaultRequestedAcrLookupFunction extends AbstractAuthenticationReq
}
final List<ACR> requestParameterAcr = new ArrayList<ACR>();
requestParameterAcr.addAll(req.getACRValues());
- return checkRequestObject(req, "acr_values", requestParameterAcr, null);
+ return requestParameterAcr;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
index 1dc0d6d2..a968b5b9 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
@@ -32,6 +32,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* from oidc authentication request if available. If information is not available, null is returned. If there is claims
* request in request object it is used instead of claims parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestedClaimsLookupFunction
extends AbstractAuthenticationRequestLookupFunction<OIDCClaimsRequest> {
@@ -60,7 +61,7 @@ public class DefaultRequestedClaimsLookupFunction
log.error("unable to parse claims claim {}", e.getMessage());
return null;
}
- return checkRequestObject(req, "claims", req.getOIDCClaims(), null);
+ return req.getOIDCClaims();
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java
index 98770ac7..74691957 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java
@@ -29,6 +29,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* authorization request if available. If information is not available, null is returned. If there is prompt in request
* object it is used instead of prompt parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestedPromptLookupFunction extends AbstractAuthorizationRequestLookupFunction<Prompt> {
/** Class logger. */
@@ -52,6 +53,6 @@ public class DefaultRequestedPromptLookupFunction extends AbstractAuthorizationR
}
final Prompt requestParameterPrompt = new Prompt();
requestParameterPrompt.addAll(req.getPrompt());
- return checkRequestObject(req, "prompt", requestParameterPrompt, null);
+ return requestParameterPrompt;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java
index 20545fcb..013d8cb3 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java
@@ -29,6 +29,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* authorization request if available. If information is not available, null is returned. If there is scope in request
* object it is used instead of scope parameter.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestedScopeLookupFunction extends AbstractAuthorizationRequestLookupFunction<Scope> {
/** Class logger. */
@@ -47,11 +48,8 @@ public class DefaultRequestedScopeLookupFunction extends AbstractAuthorizationRe
log.error("Unable to parse scope from request object scope value");
return null;
}
- final Scope result = new Scope();
- final Scope requestParameterScope = req.getScope();
- if (requestParameterScope != null) {
- result.addAll(requestParameterScope);
- }
- return checkRequestObject(req, "scope", result, new Scope());
+ final Scope requestParameterScope = new Scope();
+ requestParameterScope.addAll(req.getScope());
+ return requestParameterScope;
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java
index bec75af1..d0b8337a 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java
@@ -29,6 +29,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
*
* @since 3.3.0
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultValidResponseTypesLookupFunction
extends AbstractAuthorizationRequestLookupFunction<Set<ResponseType>> {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAudienceLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAudienceLookupFunction.java
index 18c1a63a..c294b51b 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAudienceLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAudienceLookupFunction.java
@@ -28,6 +28,7 @@ import com.nimbusds.oauth2.sdk.TokenRequest;
* {@link DefaultRequestAudienceLookupFunction#CUSTOM_RESOURCE_PARAM_NAME}. The token request message decoder switches
* the incoming resource -parameter names into that.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class TokenRequestAudienceLookupFunction extends AbstractTokenRequestLookupFunction<List<String>> {
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAuthorizationCodeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAuthorizationCodeLookupFunction.java
index e9c42dc5..7018e0dd 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAuthorizationCodeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAuthorizationCodeLookupFunction.java
@@ -27,6 +27,7 @@ import com.nimbusds.oauth2.sdk.TokenRequest;
*
* @since 3.2.0
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class TokenRequestAuthorizationCodeLookupFunction extends AbstractTokenRequestLookupFunction<String> {
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunction.java
index 0ddb563d..3a420edf 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunction.java
@@ -23,6 +23,9 @@ import com.nimbusds.oauth2.sdk.AbstractOptionallyAuthenticatedRequest;
import com.nimbusds.oauth2.sdk.AbstractOptionallyIdentifiedRequest;
import com.nimbusds.oauth2.sdk.id.ClientID;
+import net.shibboleth.shared.primitive.DeprecationSupport;
+import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
+
/**
* For Token, Revocation and other end points supporting client authentication.
*
@@ -30,11 +33,15 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
* client authentication if available. If client authentication information is not available, client id is looked from
* client_id parameter. Null is returned if information is not available.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class TokenRequestClientIDLookupFunction implements ContextDataLookupFunction<MessageContext, ClientID> {
/** {@inheritDoc} */
+ @SuppressWarnings("null")
@Nullable
public ClientID apply(@Nullable final MessageContext input) {
+ DeprecationSupport.warn(ObjectType.CLASS, getClass().getName(), null,
+ "Classes in package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate'");
if (input == null) {
return null;
}
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java
index 625b6e1a..0d6a1e39 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java
@@ -32,6 +32,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* A function that returns redirect uri of the request via a lookup function. This default lookup locates uri from oidc
* token request if available. If information is not available, null is returned.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class TokenRequestRedirectURILookupFunction extends AbstractTokenRequestLookupFunction<URI> {
/** Class logger. */
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestScopeLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestScopeLookupFunction.java
index 26f4184e..11c15eeb 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestScopeLookupFunction.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestScopeLookupFunction.java
@@ -22,6 +22,7 @@ import com.nimbusds.oauth2.sdk.TokenRequest;
/**
* A function that returns a copy of requested scopes from a {@link TokenRequest}.
*/
+ at Deprecated(since="4.2.0", forRemoval=true)
public class TokenRequestScopeLookupFunction extends AbstractTokenRequestLookupFunction<Scope> {
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java
index 323e2ae9..a0c26e3c 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java
@@ -34,6 +34,7 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class AbstractAuthenticationRequestLookupFunctionTest {
protected ProfileRequestContext prc;
@@ -86,7 +87,8 @@ public class AbstractAuthenticationRequestLookupFunctionTest {
}
@SuppressWarnings("null")
- class MockOKLookupFunction extends AbstractAuthenticationRequestLookupFunction<String> {
+ @Deprecated(since="4.2.0", forRemoval=true)
+ class MockOKLookupFunction extends AbstractAuthenticationRequestLookupFunction<String> {
@Override
protected String doLookup(AuthenticationRequest req) {
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java
index 662f3d1e..530bf2f7 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java
@@ -34,6 +34,7 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class AbstractAuthorizationRequestLookupFunctionTest {
protected ProfileRequestContext prc;
@@ -88,6 +89,7 @@ public class AbstractAuthorizationRequestLookupFunctionTest {
}
@SuppressWarnings("null")
+ @Deprecated(since="4.2.0", forRemoval=true)
class MockOKLookupFunction extends AbstractAuthorizationRequestLookupFunction<String> {
@Override
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunctionTest.java
index db6d2629..4fd03fb8 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunctionTest.java
@@ -30,6 +30,7 @@ import com.nimbusds.oauth2.sdk.RefreshTokenGrant;
import com.nimbusds.oauth2.sdk.TokenRequest;
import com.nimbusds.oauth2.sdk.token.RefreshToken;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class AbstractTokenRequestLookupFunctionTest {
protected ProfileRequestContext prc;
@@ -70,6 +71,7 @@ public class AbstractTokenRequestLookupFunctionTest {
}
@SuppressWarnings("null")
+ @Deprecated(since="4.2.0", forRemoval=true)
class MockOKLookupFunction extends AbstractTokenRequestLookupFunction<Object> {
@Override
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunctionTest.java
index 03a7662a..2367fdf3 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunctionTest.java
@@ -27,6 +27,7 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultClientIDLookupFunctionTest {
private DefaultClientIDLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
index 43d37641..546226dd 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
@@ -27,6 +27,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestLoginHintLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestLoginHintLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeFunctionTest.java
index 278d4d74..26f42061 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeFunctionTest.java
@@ -28,6 +28,7 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestMaxAgeFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestMaxAgeLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunctionTest.java
index 5e00a0c5..2894a89c 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunctionTest.java
@@ -28,6 +28,7 @@ import com.nimbusds.openid.connect.sdk.Nonce;
import org.testng.Assert;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestNonceLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestNonceLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java
index 35a30833..05fcca3d 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java
@@ -27,6 +27,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestRedirectURILookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestRedirectURILookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
index 2ac964db..b212e87e 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
@@ -28,6 +28,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestResponseModeLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestResponseModeLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
index 2a8a002d..2a0c1c3f 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
@@ -27,6 +27,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestResponseTypeLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestResponseTypeLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunctionTest.java
index 4c2bad43..5bdbeb0c 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunctionTest.java
@@ -27,6 +27,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestStateLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestStateLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
index e1e3a393..fe6b851e 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
@@ -30,6 +30,7 @@ import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.claims.ACR;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestedAcrLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestedAcrLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
index 3ca0bb59..55e86425 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
@@ -33,6 +33,7 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.UserInfo;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestedClaimsLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestedClaimsLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
index e48a51dd..1d646ad7 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
@@ -30,6 +30,7 @@ import com.nimbusds.openid.connect.sdk.Prompt.Type;
import org.testng.Assert;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestedPromptLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestedPromptLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
index c3f778cf..64569dfd 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
@@ -19,7 +19,6 @@ import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.PlainJWT;
-import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
@@ -28,6 +27,7 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
+ at Deprecated(since="4.2.0", forRemoval=true)
public class DefaultRequestedScopeLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
private DefaultRequestedScopeLookupFunction lookup;
@@ -35,7 +35,6 @@ public class DefaultRequestedScopeLookupFunctionTest extends BaseDefaultRequestL
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestedScopeLookupFunction();
- oidcCtx.setRequestObject(null);
}
@Test
@@ -48,7 +47,7 @@ public class DefaultRequestedScopeLookupFunctionTest extends BaseDefaultRequestL
assert result != null;
Assert.assertTrue(result.contains("openid"));
Assert.assertTrue(result.contains("email"));
- Assert.assertEquals(result.size(), 2);
+ Assert.assertEquals(2, result.size());
}
@Test
@@ -64,51 +63,7 @@ public class DefaultRequestedScopeLookupFunctionTest extends BaseDefaultRequestL
assert result != null;
Assert.assertTrue(result.contains("openid"));
Assert.assertTrue(result.contains("email"));
- Assert.assertEquals(result.size(), 2);
- }
-
- @Test
- public void testSuccessReqObjectNullScope() {
- JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("scope", null).build();
- AuthorizationRequest req = new AuthorizationRequest.Builder(new PlainJWT(ro),
- new ClientID("000123")).state(new State()).build();
- msgCtx.setMessage(req);
- oidcCtx.setRequestObject(req.getRequestObject());
- final Scope result = lookup.apply(prc);
- assert result != null;
- Assert.assertEquals(result.size(), 0);
- }
-
- @Test
- public void testSuccessReqObjectEmptyScope() {
- JWTClaimsSet ro = new JWTClaimsSet.Builder().claim("scope", "").build();
- AuthorizationRequest req = new AuthorizationRequest.Builder(new PlainJWT(ro),
- new ClientID("000123")).state(new State()).build();
- msgCtx.setMessage(req);
- oidcCtx.setRequestObject(req.getRequestObject());
- final Scope result = lookup.apply(prc);
- assert result != null;
- Assert.assertEquals(result.size(), 0);
- }
-
- @Test
- public void testWithNullScopeInRequest() {
- AuthorizationRequest req = new AuthorizationRequest.Builder(URI.create("https://example.com/callback"),
- new ClientID("000123")).state(new State()).build();
- msgCtx.setMessage(req);
- final Scope result = lookup.apply(prc);
- assert result != null;
- Assert.assertEquals(result.size(), 0);
- }
-
- @Test
- public void testWithEmptyScopeInRequest() {
- AuthorizationRequest req = new AuthorizationRequest.Builder(ResponseType.CODE,
- new ClientID("000123")).state(new State()).scope(new Scope()).build();
- msgCtx.setMessage(req);
- final Scope result = lookup.apply(prc);
- assert result != null;
- Assert.assertEquals(result.size(), 0);
+ Assert.assertEquals(2, result.size());
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunctionTest.java
index d134b950..ef903147 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunctionTest.java
@@ -28,6 +28,7 @@ import com.nimbusds.oauth2.sdk.token.RefreshToken;
import org.testng.Assert;
/** Tests for {@link TokenRequestClientIDLookupFunction}. */
+ at Deprecated(since="4.2.0", forRemoval=true)
public class TokenRequestClientIDLookupFunctionTest {
private TokenRequestClientIDLookupFunction lookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunctionTest.java b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunctionTest.java
index 434bb4e8..dbebd5fc 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunctionTest.java
+++ b/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunctionTest.java
@@ -38,6 +38,7 @@ import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileR
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
/** Tests for {@link TokenRequestRedirectURILookupFunction}. */
+ at Deprecated(since="4.2.0", forRemoval=true)
public class TokenRequestRedirectURILookupFunctionTest {
private TokenRequestRedirectURILookupFunction lookup;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java
index 91dfffe8..06490da2 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/AuthenticationRequestClaimsAuditExtractor.java
@@ -19,14 +19,16 @@ import java.util.List;
import java.util.function.Function;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.AbstractAuthenticationRequestLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.AbstractAuthenticationRequestLookupFunction;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -54,9 +56,10 @@ public class AuthenticationRequestClaimsAuditExtractor extends AbstractAuthentic
}
/** {@inheritDoc} */
- @Override
- protected String doLookup(@Nonnull final AuthenticationRequest request) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected String doLookup(@Nonnull final AuthenticationRequest request,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim(key) != null) {
return requestObject.getJWTClaimsSet().getStringClaim(key);
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthenticationRequestLookupFunction.java
similarity index 53%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthenticationRequestLookupFunction.java
index 4cf5a2d6..c1c7e3ab 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthenticationRequestLookupFunction.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -20,14 +20,21 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+
/**
* A Abstract function extended by lookups searching fields from authentication request.
*
* @param <T> type of lookup result to return.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public abstract class AbstractAuthenticationRequestLookupFunction<T>
extends AbstractAuthorizationRequestLookupFunction<T>
implements ContextDataLookupFunction<ProfileRequestContext,T> {
@@ -39,22 +46,25 @@ public abstract class AbstractAuthenticationRequestLookupFunction<T>
super(AuthenticationRequest.class);
}
- /**
- * Implemented to perform the actual lookup.
- *
- * @param req auhtorization request to perform the lookup from.
- * @return lookup value.
- */
- @Nullable protected T doLookup(@Nonnull final AuthorizationRequest req) {
- return doLookup((AuthenticationRequest) req);
+ /** {@inheritDoc} */
+ @Override @Nullable
+ protected T doLookup(@Nonnull final AuthorizationRequest authorizationRequest,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
+ return doLookup((AuthenticationRequest)authorizationRequest, parRequest, requestObject, isRequestObjectFromPar);
}
/**
- * Implemented to perform the actual lookup from OIDC authentication request.
+ * Implemented to perform the actual lookup.
*
- * @param req authentication request to perform the lookup from.
+ * @param authenticationRequest authorization request to perform the lookup from.
+ * @param parRequest pushed authorization request if authorization request was pushed.
+ * @param requestObject request object if it was part of the request.
+ * @param isRequestObjectFromPar flag to indicate that the request object is built by the PAR endpoint.
* @return lookup value.
*/
- @Nullable protected abstract T doLookup(@Nonnull final AuthenticationRequest req);
-
+ @Nullable
+ protected abstract T doLookup(@Nonnull final AuthenticationRequest authenticationRequest,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar);
}
\ No newline at end of file
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthorizationRequestLookupFunction.java
similarity index 73%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthorizationRequestLookupFunction.java
index 1915146c..a73ccc1c 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthorizationRequestLookupFunction.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.util.function.BiPredicate;
@@ -28,25 +28,25 @@ import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
- * A Abstract function extended by lookups searching fields from authorization request.
+ * An abstract function extended by lookups searching fields from authorization request.
*
* @param <T> type of lookup result to return.
*
- * @since 3.3.0
+ * @since 4.2.0
*/
-public abstract class AbstractAuthorizationRequestLookupFunction<T>
+ at ThreadSafeAfterInit
+public abstract class AbstractAuthorizationRequestLookupFunction<T> extends AbstractInitializableComponent
implements ContextDataLookupFunction<ProfileRequestContext,T> {
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(AbstractAuthorizationRequestLookupFunction.class);
- /** Request. */
- @Nullable private JWT requestObject;
-
/** The request message class to verify that the actual request is an instance of. */
@Nonnull private final Class<? extends AuthorizationRequest> messageClass;
@@ -74,10 +74,9 @@ public abstract class AbstractAuthorizationRequestLookupFunction<T>
* Set the predicate to decide if the parameter values may only be set in the request object.
*
* @param predicate the predicate to decide if the parameter values may only be set in the request object.
- *
- * @since 4.2.0
*/
public void setUseOnlyRequestObjectPredicate(@Nonnull final BiPredicate<AuthorizationRequest, String> predicate) {
+ checkSetterPreconditions();
useOnlyRequestObjectPredicate = Constraint.isNotNull(predicate,
"Use only request object predicate cannot be null");
}
@@ -85,14 +84,20 @@ public abstract class AbstractAuthorizationRequestLookupFunction<T>
/**
* Implemented to perform the actual lookup.
*
- * @param req authorization request to perform the lookup from.
+ * @param authorizationRequest authorization request to perform the lookup from.
+ * @param parRequest pushed authorization request if authorization request was pushed.
+ * @param requestObject request object if it was part of the request.
+ * @param isRequestObjectFromPar flag to indicate that the request object is built by the PAR endpoint.
* @return lookup value.
*/
- @Nullable protected abstract T doLookup(@Nonnull final AuthorizationRequest req);
+ @Nullable protected abstract T doLookup(@Nonnull final AuthorizationRequest authorizationRequest,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar);
/** {@inheritDoc} */
@Nullable
public T apply(@Nullable final ProfileRequestContext input) {
+ checkComponentActive();
if (input == null || input.getInboundMessageContext() == null) {
return null;
}
@@ -101,29 +106,25 @@ public abstract class AbstractAuthorizationRequestLookupFunction<T>
(!(messageClass.isInstance(message)) && !(message instanceof PushedAuthorizationRequest))) {
return null;
}
- if (input.getOutboundMessageContext() != null) {
+ final JWT localRequestObject;
+ final boolean isRequestObjectFromPar;
+ if (input.getOutboundMessageContext() != null
+ && input.ensureOutboundMessageContext().containsSubcontext(OIDCAuthenticationResponseContext.class)) {
final OIDCAuthenticationResponseContext ctx =
- input.ensureOutboundMessageContext().getSubcontext(OIDCAuthenticationResponseContext.class);
- if (ctx != null) {
- requestObject = ctx.getRequestObject();
- }
+ input.ensureOutboundMessageContext().ensureSubcontext(OIDCAuthenticationResponseContext.class);
+ localRequestObject = ctx.getRequestObject();
+ isRequestObjectFromPar = ctx.isRequestObjectFromPar();
+ } else {
+ localRequestObject = null;
+ isRequestObjectFromPar = false;
}
if (message instanceof PushedAuthorizationRequest pushedAuthorizationRequest) {
final AuthorizationRequest authorizationRequest = pushedAuthorizationRequest.getAuthorizationRequest();
assert authorizationRequest != null;
- return doLookup(authorizationRequest);
+ return doLookup(authorizationRequest, pushedAuthorizationRequest, localRequestObject, isRequestObjectFromPar);
}
- return doLookup((AuthorizationRequest) message);
- }
-
- /**
- * Gets the request object.
- *
- * @return the request object.
- */
- @Nullable public JWT getRequestObject() {
- return requestObject;
+ return doLookup((AuthorizationRequest) message, null, localRequestObject, isRequestObjectFromPar);
}
/**
@@ -136,8 +137,6 @@ public abstract class AbstractAuthorizationRequestLookupFunction<T>
* @param parameterValue the value found from the parameters.
* @param defaultResult the default value to be used if the request contained OAuth2 JAR request object.
* @return the parameter value to be used, depending on the authorization request message contents.
- *
- * @since 4.2.0
*/
@Nullable protected T checkRequestObject(@Nonnull final AuthorizationRequest authorizationRequest,
@Nonnull final String parameterName, @Nullable final T parameterValue, @Nullable T defaultResult) {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractTokenRequestLookupFunction.java
similarity index 92%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractTokenRequestLookupFunction.java
index 9bec672e..60822a8f 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractTokenRequestLookupFunction.java
@@ -12,10 +12,12 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
+
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.oauth2.sdk.TokenRequest;
@@ -24,7 +26,10 @@ import com.nimbusds.oauth2.sdk.TokenRequest;
* A Abstract function extended by lookups searching fields from token request.
*
* @param <T> type of lookup result to return.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafe
public abstract class AbstractTokenRequestLookupFunction<T>
implements ContextDataLookupFunction<ProfileRequestContext, T> {
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultClientIDLookupFunction.java
similarity index 91%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultClientIDLookupFunction.java
index b0e74f13..ec36eb4c 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultClientIDLookupFunction.java
@@ -12,9 +12,10 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
@@ -25,7 +26,10 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
/**
* A function that returns client id of the authentication request via a lookup function. This default lookup locates
* client id from oidc authentication request if available. If information is not available, null is returned.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafe
public class DefaultClientIDLookupFunction implements ContextDataLookupFunction<MessageContext, ClientID> {
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestAudienceLookupFunction.java
similarity index 75%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestAudienceLookupFunction.java
index 51ade30d..531851c2 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestAudienceLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestAudienceLookupFunction.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import java.util.Collections;
@@ -25,18 +25,21 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns resource value of the authorization request.
*
- * Since 4.1.0, the resource value is fetched via custom parameter name {@link #CUSTOM_RESOURCE_PARAM_NAME}. The
- * message decoders switches the incoming resource -parameter names into that. The request objects still contain
- * the standard resource parameter name.
+ * The resource value is fetched via custom parameter name {@link #CUSTOM_RESOURCE_PARAM_NAME}. The message decoders
+ * switches the incoming resource -parameter names into that. The request objects contain the standard resource
+ * parameter name.
*
- * @since 3.2.0
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestAudienceLookupFunction extends AbstractAuthorizationRequestLookupFunction<List<String>> {
/** Custom name for the resource parameter that allows non-uri values. */
@@ -46,8 +49,10 @@ public class DefaultRequestAudienceLookupFunction extends AbstractAuthorizationR
@Nonnull private Logger log = LoggerFactory.getLogger(DefaultRequestAudienceLookupFunction.class);
/** {@inheritDoc} */
- @Nullable protected List<String> doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected List<String> doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("resource") != null) {
final Object resource = requestObject.getJWTClaimsSet().getClaim("resource");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
similarity index 82%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
index 8ff2d1ba..112eb18b 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestCodeChallengeLookupFunction.java
@@ -12,9 +12,10 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
+
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -22,14 +23,19 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns code challenge value of the authorization request via a lookup function. This default lookup
* locates code challenge from OAuth authorization request if available. If information is not available, null is
* returned. If there is code_challenge in request object it is used instead of code_challenge parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestCodeChallengeLookupFunction extends AbstractAuthorizationRequestLookupFunction<String> {
/** Class logger. */
@@ -37,8 +43,10 @@ public class DefaultRequestCodeChallengeLookupFunction extends AbstractAuthoriza
private Logger log = LoggerFactory.getLogger(DefaultRequestCodeChallengeLookupFunction.class);
/** {@inheritDoc} */
- @Nullable protected String doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected String doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("code_challenge") != null) {
final Object codeChallenge = requestObject.getJWTClaimsSet().getClaim("code_challenge");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
similarity index 83%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
index be2ea11f..2a2fb681 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestCodeChallengeMethodLookupFunction.java
@@ -12,15 +12,20 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
+
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -28,7 +33,10 @@ import net.shibboleth.shared.primitive.LoggerFactory;
* lookup locates code challenge method from OAuth authorization request if available. If information is not available,
* null is returned. If there is code_challenge_method in request object it is used instead of code_challenge_method
* parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestCodeChallengeMethodLookupFunction
extends AbstractAuthorizationRequestLookupFunction<String> {
@@ -37,9 +45,10 @@ public class DefaultRequestCodeChallengeMethodLookupFunction
private Logger log = LoggerFactory.getLogger(DefaultRequestCodeChallengeMethodLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected String doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected String doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("code_challenge_method") != null) {
final Object codeChallenge = requestObject.getJWTClaimsSet().getClaim("code_challenge_method");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestDPoPJktLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestDPoPJktLookupFunction.java
similarity index 82%
rename from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestDPoPJktLookupFunction.java
rename to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestDPoPJktLookupFunction.java
index ec4f8c59..33920b1c 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestDPoPJktLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestDPoPJktLookupFunction.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
@@ -22,7 +22,9 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -32,6 +34,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
*
* @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestDPoPJktLookupFunction extends AbstractAuthorizationRequestLookupFunction<String> {
/** Class logger. */
@@ -39,8 +42,10 @@ public class DefaultRequestDPoPJktLookupFunction extends AbstractAuthorizationRe
private Logger log = LoggerFactory.getLogger(DefaultRequestDPoPJktLookupFunction.class);
/** {@inheritDoc} */
- @Nullable protected String doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected String doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("dpop_jkt") != null) {
final Object thumbprint = requestObject.getJWTClaimsSet().getClaim("dpop_jkt");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunction.java
similarity index 82%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunction.java
index cb83710c..14b96ed0 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunction.java
@@ -12,22 +12,29 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns request login hint via a lookup function. This default lookup locates hint from oidc
* authentication request if available. If information is not available, null is returned. If there is hint in request
* object it is used instead of login_hint parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestLoginHintLookupFunction extends AbstractAuthenticationRequestLookupFunction<String> {
/** Class logger. */
@@ -35,9 +42,10 @@ public class DefaultRequestLoginHintLookupFunction extends AbstractAuthenticatio
private Logger log = LoggerFactory.getLogger(DefaultRequestLoginHintLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected String doLookup(@Nonnull final AuthenticationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected String doLookup(@Nonnull final AuthenticationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("login_hint") != null) {
final Object hint = requestObject.getJWTClaimsSet().getClaim("login_hint");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeLookupFunction.java
similarity index 81%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeLookupFunction.java
index 2f3f398c..72376dc9 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeLookupFunction.java
@@ -12,24 +12,31 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import java.time.Duration;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns authentication max age parameter the request via a lookup function. This default lookup
* locates max age from oidc authentication request if available. If information is not available, null is returned. If
* there is max_age parameter in request object it is used instead of max_age request parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestMaxAgeLookupFunction extends AbstractAuthenticationRequestLookupFunction<Duration> {
/** Class logger. */
@@ -37,9 +44,10 @@ public class DefaultRequestMaxAgeLookupFunction extends AbstractAuthenticationRe
private Logger log = LoggerFactory.getLogger(DefaultRequestMaxAgeLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected Duration doLookup(@Nonnull final AuthenticationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected Duration doLookup(@Nonnull final AuthenticationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getIntegerClaim("max_age") != null) {
return Duration.ofSeconds(requestObject.getJWTClaimsSet().getIntegerClaim("max_age"));
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunction.java
similarity index 77%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunction.java
index 2a060f6b..7204b00b 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunction.java
@@ -12,33 +12,41 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.Nonce;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns copy of Nonce via a lookup function. This default lookup locates nonce from oidc
* authentication request if available. If information is not available, null is returned. If there is nonce in request
* object it is used instead of nonce parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestNonceLookupFunction extends AbstractAuthenticationRequestLookupFunction<Nonce> {
/** Class logger. */
@Nonnull
- private Logger log = LoggerFactory.getLogger(DefaultRequestLoginHintLookupFunction.class);
+ private Logger log = LoggerFactory.getLogger(DefaultRequestNonceLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected Nonce doLookup(@Nonnull final AuthenticationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected Nonce doLookup(@Nonnull final AuthenticationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("nonce") != null) {
final Object nonce = requestObject.getJWTClaimsSet().getClaim("nonce");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestRedirectURILookupFunction.java
similarity index 83%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestRedirectURILookupFunction.java
index a77b41ac..b188d4d8 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestRedirectURILookupFunction.java
@@ -12,24 +12,31 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import java.net.URISyntaxException;
import java.text.ParseException;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns redirect uri of the authentication request via a lookup function. This default lookup locates
* redirect uri from OAuth authorization request if available. If information is not available, null is returned. If
* there is redirect uri in request object it is used instead of redirect_uri parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestRedirectURILookupFunction extends AbstractAuthorizationRequestLookupFunction<URI> {
/** Class logger. */
@@ -37,9 +44,10 @@ public class DefaultRequestRedirectURILookupFunction extends AbstractAuthorizati
private Logger log = LoggerFactory.getLogger(DefaultRequestRedirectURILookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected URI doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected URI doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("redirect_uri") != null) {
final Object redirect = requestObject.getJWTClaimsSet().getClaim("redirect_uri");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunction.java
similarity index 83%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunction.java
index 38971a64..83a1af39 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunction.java
@@ -12,24 +12,31 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseMode;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns copy of the response mode of the request via a lookup function. This default lookup locates
* response mode from OAuth authorization request if available. If information is not available, null is returned. If
* there is response mode in request object it is used instead of response_mode parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestResponseModeLookupFunction
extends AbstractAuthorizationRequestLookupFunction<ResponseMode> {
@@ -38,9 +45,10 @@ public class DefaultRequestResponseModeLookupFunction
private Logger log = LoggerFactory.getLogger(DefaultRequestResponseModeLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected ResponseMode doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected ResponseMode doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("response_mode") != null) {
final Object rMode = requestObject.getJWTClaimsSet().getClaim("response_mode");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunction.java
similarity index 83%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunction.java
index 4fb936c1..bdcaafaa 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunction.java
@@ -12,23 +12,30 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseType;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns copy of response type via a lookup function. This default lookup locates response type from
* OAuth authorization request if available. If information is not available, null is returned. If there is response
* type in request object it is used instead of response_type parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestResponseTypeLookupFunction
extends AbstractAuthorizationRequestLookupFunction<ResponseType> {
@@ -37,9 +44,10 @@ public class DefaultRequestResponseTypeLookupFunction
private Logger log = LoggerFactory.getLogger(DefaultRequestResponseTypeLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected ResponseType doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected ResponseType doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("response_type") != null) {
return ResponseType.parse((String) requestObject.getJWTClaimsSet().getClaim("response_type"));
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunction.java
similarity index 83%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunction.java
index 7b7e40c2..ad7dfb91 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunction.java
@@ -12,23 +12,30 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.oauth2.sdk.id.State;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns copy of the state the request via a lookup function. This default lookup locates state from
* OAuth authorization request if available. If information is not available, null is returned. If there is state in
* request object it is used instead of state parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestStateLookupFunction extends AbstractAuthorizationRequestLookupFunction<State> {
/** Class logger. */
@@ -36,9 +43,10 @@ public class DefaultRequestStateLookupFunction extends AbstractAuthorizationRequ
private Logger log = LoggerFactory.getLogger(DefaultRequestStateLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected State doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected State doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("state") != null) {
final Object state = requestObject.getJWTClaimsSet().getClaim("state");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunction.java
similarity index 84%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunction.java
index 4643618d..63fb7fb6 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunction.java
@@ -12,25 +12,32 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import java.util.ArrayList;
import java.util.List;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.claims.ACR;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns copy of requested acr values via a lookup function. This default lookup locates acr values
* from oidc authentication request if available. If information is not available, null is returned. If there are acr
* values in request object it is used instead of acr_values parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestedAcrLookupFunction extends AbstractAuthenticationRequestLookupFunction<List<ACR>> {
/** Class logger. */
@@ -38,9 +45,10 @@ public class DefaultRequestedAcrLookupFunction extends AbstractAuthenticationReq
private Logger log = LoggerFactory.getLogger(DefaultRequestedAcrLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected List<ACR> doLookup(@Nonnull final AuthenticationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected List<ACR> doLookup(@Nonnull final AuthenticationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("acr_values") != null) {
final List<ACR> reqObjectAcr = new ArrayList<ACR>();
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedClaimsLookupFunction.java
similarity index 84%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedClaimsLookupFunction.java
index 1dc0d6d2..38f12307 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedClaimsLookupFunction.java
@@ -12,26 +12,33 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import java.util.Map;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
import net.minidev.json.JSONObject;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns copy of requested claims via a lookup function. This default lookup locates requested claims
* from oidc authentication request if available. If information is not available, null is returned. If there is claims
* request in request object it is used instead of claims parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestedClaimsLookupFunction
extends AbstractAuthenticationRequestLookupFunction<OIDCClaimsRequest> {
@@ -41,9 +48,10 @@ public class DefaultRequestedClaimsLookupFunction
/** {@inheritDoc} */
@SuppressWarnings("unchecked")
- @Override
- protected OIDCClaimsRequest doLookup(@Nonnull final AuthenticationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected OIDCClaimsRequest doLookup(@Nonnull final AuthenticationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("claims") != null) {
final Object claims = requestObject.getJWTClaimsSet().getClaim("claims");
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunction.java
similarity index 82%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunction.java
index 98770ac7..1b0fcda3 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunction.java
@@ -12,23 +12,30 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.openid.connect.sdk.Prompt;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns copy of requested prompt via a lookup function. This default lookup locates prompt from OAuth
* authorization request if available. If information is not available, null is returned. If there is prompt in request
* object it is used instead of prompt parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestedPromptLookupFunction extends AbstractAuthorizationRequestLookupFunction<Prompt> {
/** Class logger. */
@@ -36,9 +43,10 @@ public class DefaultRequestedPromptLookupFunction extends AbstractAuthorizationR
private Logger log = LoggerFactory.getLogger(DefaultRequestedPromptLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected Prompt doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected Prompt doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("prompt") != null) {
return Prompt.parse((String) requestObject.getJWTClaimsSet().getClaim("prompt"));
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunction.java
similarity index 82%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunction.java
index 20545fcb..1adceabd 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunction.java
@@ -12,23 +12,30 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.text.ParseException;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.slf4j.Logger;
import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.oauth2.sdk.Scope;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that returns copy of requested scopes via a lookup function. This default lookup locates scope from OAuth
* authorization request if available. If information is not available, null is returned. If there is scope in request
* object it is used instead of scope parameter.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultRequestedScopeLookupFunction extends AbstractAuthorizationRequestLookupFunction<Scope> {
/** Class logger. */
@@ -36,9 +43,10 @@ public class DefaultRequestedScopeLookupFunction extends AbstractAuthorizationRe
private Logger log = LoggerFactory.getLogger(DefaultRequestedScopeLookupFunction.class);
/** {@inheritDoc} */
- @Override
- protected Scope doLookup(@Nonnull final AuthorizationRequest req) {
- final JWT requestObject = getRequestObject();
+ @Override @Nullable
+ protected Scope doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
try {
if (requestObject != null && requestObject.getJWTClaimsSet().getClaim("scope") != null) {
return Scope.parse((String) requestObject.getJWTClaimsSet().getClaim("scope"));
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultUseOnlyRequestObjectPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultUseOnlyRequestObjectPredicate.java
similarity index 90%
rename from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultUseOnlyRequestObjectPredicate.java
rename to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultUseOnlyRequestObjectPredicate.java
index 0822c6d4..aa6f6267 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultUseOnlyRequestObjectPredicate.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultUseOnlyRequestObjectPredicate.java
@@ -12,11 +12,12 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.util.function.BiPredicate;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
@@ -24,7 +25,10 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
/**
* Default predicate for using only request object parameters if the authorization request (1) contains request object
* and (2) is not OIDC authentication request.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafe
public class DefaultUseOnlyRequestObjectPredicate implements BiPredicate<AuthorizationRequest, String> {
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultValidResponseTypesLookupFunction.java
similarity index 77%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultValidResponseTypesLookupFunction.java
index bec75af1..f614ca85 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultValidResponseTypesLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultValidResponseTypesLookupFunction.java
@@ -12,29 +12,37 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.util.Set;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+
/**
* A function that returns a set of valid response type for the authorization request. If the authorization request is
* valid OIDC authentication request, the set specified by the OIDC core specification is returned. Otherwise the set
* consisting of OAuth2 code and implicit (token) flow is returned.
*
- * @since 3.3.0
+ * @since 4.2.0
*/
+ at ThreadSafeAfterInit
public class DefaultValidResponseTypesLookupFunction
extends AbstractAuthorizationRequestLookupFunction<Set<ResponseType>> {
/** {@inheritDoc} */
- @Override
- protected Set<ResponseType> doLookup(@Nonnull final AuthorizationRequest req) {
+ @Override @Nullable
+ protected Set<ResponseType> doLookup(@Nonnull final AuthorizationRequest req,
+ @Nullable final PushedAuthorizationRequest parRequest, @Nullable final JWT requestObject,
+ final boolean isRequestObjectFromPar) {
if (req instanceof AuthenticationRequest) {
return Set.of(ResponseType.CODE, ResponseType.CODE_IDTOKEN, ResponseType.CODE_IDTOKEN_TOKEN,
ResponseType.CODE_TOKEN, ResponseType.IDTOKEN, ResponseType.IDTOKEN_TOKEN);
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAudienceLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestAudienceLookupFunction.java
similarity index 73%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAudienceLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestAudienceLookupFunction.java
index 18c1a63a..9579df08 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestAudienceLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestAudienceLookupFunction.java
@@ -12,22 +12,24 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
import com.nimbusds.oauth2.sdk.TokenRequest;
/**
- * A function that returns a copy of requested resource list from a {@link TokenRequest}.
+ * A function that returns a copy of requested resource list from a {@link TokenRequest}. The resource value is fetched
+ * via custom parameter name {@link DefaultRequestAudienceLookupFunction#CUSTOM_RESOURCE_PARAM_NAME}. The token request
+ * message decoder switches the incoming resource -parameter names into that.
*
- * Since 4.1.0, the resource value is fetched via custom parameter name
- * {@link DefaultRequestAudienceLookupFunction#CUSTOM_RESOURCE_PARAM_NAME}. The token request message decoder switches
- * the incoming resource -parameter names into that.
+ * @since 4.2.0
*/
+ at ThreadSafe
public class TokenRequestAudienceLookupFunction extends AbstractTokenRequestLookupFunction<List<String>> {
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestClientIDLookupFunction.java
similarity index 93%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestClientIDLookupFunction.java
index 0ddb563d..a6193e8d 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestClientIDLookupFunction.java
@@ -12,9 +12,10 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
@@ -29,7 +30,10 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
* A function that returns client id of the request via a lookup function. This lookup locates client id primarily from
* client authentication if available. If client authentication information is not available, client id is looked from
* client_id parameter. Null is returned if information is not available.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafe
public class TokenRequestClientIDLookupFunction implements ContextDataLookupFunction<MessageContext, ClientID> {
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestRedirectURILookupFunction.java
similarity index 93%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestRedirectURILookupFunction.java
index 625b6e1a..9b90c4d1 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestRedirectURILookupFunction.java
@@ -12,13 +12,14 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.List;
import javax.annotation.Nonnull;
+import javax.annotation.concurrent.ThreadSafe;
import org.slf4j.Logger;
@@ -31,7 +32,10 @@ import net.shibboleth.shared.primitive.LoggerFactory;
*
* A function that returns redirect uri of the request via a lookup function. This default lookup locates uri from oidc
* token request if available. If information is not available, null is returned.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafe
public class TokenRequestRedirectURILookupFunction extends AbstractTokenRequestLookupFunction<URI> {
/** Class logger. */
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestScopeLookupFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestScopeLookupFunction.java
similarity index 89%
copy from idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestScopeLookupFunction.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestScopeLookupFunction.java
index 26f4184e..107dbc86 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestScopeLookupFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestScopeLookupFunction.java
@@ -12,16 +12,20 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import javax.annotation.Nonnull;
+import javax.annotation.concurrent.ThreadSafe;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.TokenRequest;
/**
* A function that returns a copy of requested scopes from a {@link TokenRequest}.
+ *
+ * @since 4.2.0
*/
+ at ThreadSafe
public class TokenRequestScopeLookupFunction extends AbstractTokenRequestLookupFunction<Scope> {
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/package-info.java
new file mode 100644
index 00000000..b7d3e6c3
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/package-info.java
@@ -0,0 +1,16 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** Lookup functions. */
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java
index 0b77e9ce..67230735 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java
@@ -28,7 +28,7 @@ import com.nimbusds.oauth2.sdk.Request;
import com.nimbusds.oauth2.sdk.http.HTTPRequest;
import jakarta.servlet.http.HttpServletRequest;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestAudienceLookupFunction;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/CustomResourceHttpServletRequestWrapper.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/CustomResourceHttpServletRequestWrapper.java
index f347c317..bca19215 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/CustomResourceHttpServletRequestWrapper.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/CustomResourceHttpServletRequestWrapper.java
@@ -21,7 +21,7 @@ import javax.annotation.Nonnull;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletRequestWrapper;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestAudienceLookupFunction;
/**
* A custom extension to {@link HttpServletRequestWrapper} overriding the resource parameter with a custom one in the
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/messaging/impl/SetEntityIdToSAMLPeerEntityContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/messaging/impl/SetEntityIdToSAMLPeerEntityContext.java
index 037d4e95..8346af11 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/messaging/impl/SetEntityIdToSAMLPeerEntityContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/messaging/impl/SetEntityIdToSAMLPeerEntityContext.java
@@ -28,7 +28,7 @@ import org.slf4j.Logger;
import com.nimbusds.oauth2.sdk.id.ClientID;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultClientIDLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultClientIDLookupFunction;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
index 383fc041..cf981cf3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
@@ -49,8 +49,8 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.AccessTokenContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestClientIDLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCResponseAction;
import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContext.java
index 12d8b3db..d166c6c6 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContext.java
@@ -33,15 +33,13 @@ import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.Nonce;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
import net.minidev.json.JSONArray;
import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestCodeChallengeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestCodeChallengeMethodLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestNonceLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.profile.IdPEventIds;
@@ -101,16 +99,20 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOAuthAuthoriz
private Predicate<ProfileRequestContext> consentEnabledPredicate;
/** Strategy used to locate the code challenge. */
- @Nonnull private Function<ProfileRequestContext, String> codeChallengeLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, String> codeChallengeLookupStrategy;
/** Strategy used to locate the code challenge method. */
- @Nonnull private Function<ProfileRequestContext, String> codeChallengeMethodLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, String> codeChallengeMethodLookupStrategy;
/** Lookup function to supply strategy bi-function for manipulating token claims set. */
@Nonnull
private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
tokenClaimsSetManipulationStrategyLookupStrategy;
+ /** Strategy used to obtain the request nonce. */
+ @NonnullAfterInit
+ private Function<ProfileRequestContext, Nonce> requestNonceLookupStrategy;
+
/** The strategy used for manipulating the token claims set. */
@Nullable private BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> manipulationStrategy;
@@ -130,9 +132,6 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOAuthAuthoriz
* Constructor.
*/
public SetAuthorizationCodeToResponseContext() {
- codeChallengeLookupStrategy = new DefaultRequestCodeChallengeLookupFunction();
- codeChallengeMethodLookupStrategy = new DefaultRequestCodeChallengeMethodLookupFunction();
-
final Function<ProfileRequestContext, OIDCAuthenticationResponseTokenClaimsContext> tccls =
new ChildContextLookup<>(OIDCAuthenticationResponseTokenClaimsContext.class).compose(
new OIDCAuthenticationResponseContextLookupFunction());
@@ -284,6 +283,17 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOAuthAuthoriz
xmlSafeIdentifier = flag;
}
+ /**
+ * Set the strategy used to locate the nonce of authentication request.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRequestNonceLookupStrategy(@Nonnull final Function<ProfileRequestContext, Nonce> strategy) {
+ ifInitializedThrowUnmodifiabledComponentException();
+ requestNonceLookupStrategy =
+ Constraint.isNotNull(strategy, "RequestNonceLookupStrategy lookup strategy cannot be null");
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -292,6 +302,15 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOAuthAuthoriz
if (dataSealer == null) {
throw new ComponentInitializationException("DataSealer cannot be null");
}
+ if (codeChallengeLookupStrategy == null) {
+ throw new ComponentInitializationException("Code challenge lookup strategy cannot be null");
+ }
+ if (codeChallengeMethodLookupStrategy == null) {
+ throw new ComponentInitializationException("Code challenge method lookup strategy cannot be null");
+ }
+ if (requestNonceLookupStrategy == null) {
+ throw new ComponentInitializationException("Request nonce lookup strategy cannot be null");
+ }
}
/** {@inheritDoc} */
@@ -398,7 +417,7 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOAuthAuthoriz
.setScope(scope)
.setAudience(responseCtx.getAudience())
.setACR(responseCtx.getAcr())
- .setNonce(new DefaultRequestNonceLookupFunction().apply(profileRequestContext))
+ .setNonce(requestNonceLookupStrategy.apply(profileRequestContext))
.setCodeChallenge(codeChallenge)
.setClaimsRequest(responseCtx.getRequestedClaims())
.setDlClaims(claims)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/StoreDPoPProofKeyThumbprint.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/StoreDPoPProofKeyThumbprint.java
index 2671257a..2ae7e724 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/StoreDPoPProofKeyThumbprint.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/StoreDPoPProofKeyThumbprint.java
@@ -26,9 +26,10 @@ import org.slf4j.Logger;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultDPoPProofThumbprintLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestDPoPJktLookupFunction;
import net.shibboleth.oidc.profile.config.logic.RequireDPoPJktParameterPredicate;
import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
@@ -46,7 +47,7 @@ public class StoreDPoPProofKeyThumbprint extends AbstractOAuthAuthorizationResp
@Nonnull private Predicate<ProfileRequestContext> requireDpopJktCondition;
/** Strategy used to locate the dpop_jkt value. */
- @Nonnull private Function<ProfileRequestContext, String> jktLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, String> jktLookupStrategy;
/** Strategy used to locate thumbprint of validated DPoP Proof JWT. */
@Nonnull private Function<ProfileRequestContext, String> dpopProofThumbprintLookupStrategy;
@@ -62,7 +63,6 @@ public class StoreDPoPProofKeyThumbprint extends AbstractOAuthAuthorizationResp
*/
public StoreDPoPProofKeyThumbprint() {
requireDpopJktCondition = new RequireDPoPJktParameterPredicate();
- jktLookupStrategy = new DefaultRequestDPoPJktLookupFunction();
dpopProofThumbprintLookupStrategy = new DefaultDPoPProofThumbprintLookupFunction();
}
@@ -97,6 +97,16 @@ public class StoreDPoPProofKeyThumbprint extends AbstractOAuthAuthorizationResp
dpopProofThumbprintLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (jktLookupStrategy == null) {
+ throw new ComponentInitializationException("DPoP JKT lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java
index 5e7b2102..d493eb1b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java
@@ -32,9 +32,9 @@ import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.slf4j.Logger;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestAudienceLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ClientInfoAudienceLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestAudienceLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCAuthenticationResponseAction;
import net.shibboleth.idp.plugin.oidc.op.profile.logic.IssueIDTokenCondition;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateClientIDAgainstPolicy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateClientIDAgainstPolicy.java
index fbf6f0fa..1432a1a9 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateClientIDAgainstPolicy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateClientIDAgainstPolicy.java
@@ -29,7 +29,7 @@ import org.slf4j.Logger;
import com.nimbusds.oauth2.sdk.id.ClientID;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultClientIDLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultClientIDLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateCodeChallenge.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateCodeChallenge.java
index c7582a47..bbd4f19b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateCodeChallenge.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateCodeChallenge.java
@@ -24,11 +24,11 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestCodeChallengeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestCodeChallengeMethodLookupFunction;
import net.shibboleth.oidc.profile.config.logic.AllowPKCEPlainPredicate;
import net.shibboleth.oidc.profile.config.logic.ForcePKCEPredicate;
import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
@@ -48,10 +48,10 @@ public class ValidateCodeChallenge extends AbstractOAuthAuthorizationResponseAc
@Nonnull private Predicate<ProfileRequestContext> allowPKCEPlainCondition;
/** Strategy used to locate the code challenge. */
- @Nonnull private Function<ProfileRequestContext, String> codeChallengeLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, String> codeChallengeLookupStrategy;
/** Strategy used to locate the code challenge method. */
- @Nonnull private Function<ProfileRequestContext, String> codeChallengeMethodLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, String> codeChallengeMethodLookupStrategy;
/** Whether PKCE is mandatory. */
private boolean forcePKCE;
@@ -71,8 +71,6 @@ public class ValidateCodeChallenge extends AbstractOAuthAuthorizationResponseAc
public ValidateCodeChallenge() {
forcePKCECondition = new ForcePKCEPredicate();
allowPKCEPlainCondition = new AllowPKCEPlainPredicate();
- codeChallengeLookupStrategy = new DefaultRequestCodeChallengeLookupFunction();
- codeChallengeMethodLookupStrategy = new DefaultRequestCodeChallengeMethodLookupFunction();
}
/**
@@ -119,6 +117,18 @@ public class ValidateCodeChallenge extends AbstractOAuthAuthorizationResponseAc
Constraint.isNotNull(strategy, "Code challenge method lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+ if (codeChallengeLookupStrategy == null) {
+ throw new ComponentInitializationException("Code challenge lookup strategy cannot be null");
+ }
+ if (codeChallengeMethodLookupStrategy == null) {
+ throw new ComponentInitializationException("Code challenge method lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidatePushedAuthorizationClientIDMatch.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidatePushedAuthorizationClientIDMatch.java
index eaeaa2db..26a688f5 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidatePushedAuthorizationClientIDMatch.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidatePushedAuthorizationClientIDMatch.java
@@ -27,7 +27,7 @@ import org.slf4j.Logger;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.id.ClientID;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestClientIDLookupFunction;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRedirectURI.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRedirectURI.java
index 1e4a5c34..78be1431 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRedirectURI.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateRedirectURI.java
@@ -28,7 +28,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestRedirectURILookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultValidRedirectUrisLookupFunction;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
@@ -52,7 +51,7 @@ public class ValidateRedirectURI extends AbstractOAuthAuthorizationResponseActio
@Nonnull private Logger log = LoggerFactory.getLogger(ValidateRedirectURI.class);
/** Strategy used to obtain the redirect uri value in request. */
- @Nonnull private Function<ProfileRequestContext, URI> redirectURILookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, URI> redirectURILookupStrategy;
/** Strategy used to obtain the redirect uris to compare request value to. */
@Nonnull private Function<ProfileRequestContext, Set<URI>> validRedirectURIsLookupStrategy;
@@ -78,7 +77,6 @@ public class ValidateRedirectURI extends AbstractOAuthAuthorizationResponseActio
* Constructor.
*/
public ValidateRedirectURI() {
- redirectURILookupStrategy = new DefaultRequestRedirectURILookupFunction();
validRedirectURIsLookupStrategy = new DefaultValidRedirectUrisLookupFunction();
registeredRedirectURIsLookupStrategy = new DefaultValidRedirectUrisLookupFunction();
unregisteredClientPolicyLookupStrategy = new UnregisteredClientPolicyLookupFunction();
@@ -177,6 +175,9 @@ public class ValidateRedirectURI extends AbstractOAuthAuthorizationResponseActio
if (unregisteredClientPolicyEnforcer == null) {
throw new ConstraintViolationException("Unregistered client policy enforcer cannot be null");
}
+ if (redirectURILookupStrategy == null) {
+ throw new ConstraintViolationException("Redirect URI lookup strategy cannot be null");
+ }
}
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseMode.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseMode.java
index 4c800a63..5f235e6e 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseMode.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseMode.java
@@ -27,9 +27,10 @@ import org.slf4j.Logger;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseMode;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseModeLookupFunction;
import net.shibboleth.oidc.profile.config.navigate.ResponseModesLookupFunction;
import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -42,7 +43,7 @@ public class ValidateResponseMode extends AbstractOAuthAuthorizationResponseActi
@Nonnull private Logger log = LoggerFactory.getLogger(ValidateResponseMode.class);
/** Lookup strategy for fetching the requested response mode. */
- @Nonnull private Function<ProfileRequestContext, ResponseMode> requestedResponseModeLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, ResponseMode> requestedResponseModeLookupStrategy;
/** Lookup strategy for fetching the valid response modes. */
@Nonnull private Function<ProfileRequestContext, Set<String>> validResponseModesLookupStrategy;
@@ -51,7 +52,6 @@ public class ValidateResponseMode extends AbstractOAuthAuthorizationResponseActi
* Constructor.
*/
public ValidateResponseMode() {
- requestedResponseModeLookupStrategy = new DefaultRequestResponseModeLookupFunction();
validResponseModesLookupStrategy = new ResponseModesLookupFunction();
}
@@ -77,6 +77,16 @@ public class ValidateResponseMode extends AbstractOAuthAuthorizationResponseActi
validResponseModesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (requestedResponseModeLookupStrategy == null) {
+ throw new ComponentInitializationException("Requested response mode lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseType.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseType.java
index 42a2326a..4c564501 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseType.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseType.java
@@ -29,15 +29,15 @@ import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseTypeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultValidResponseTypesLookupFunction;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.oidc.metadata.policy.UnregisteredClientPolicy;
import net.shibboleth.oidc.metadata.policy.impl.DefaultMetadataPolicyEnforcer;
import net.shibboleth.oidc.profile.config.navigate.UnregisteredClientPolicyLookupFunction;
import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.collection.Pair;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -51,10 +51,10 @@ public class ValidateResponseType extends AbstractOAuthAuthorizationResponseActi
@Nonnull private Logger log = LoggerFactory.getLogger(ValidateResponseType.class);
/** Lookup strategy for fetching the requested response type. */
- @Nonnull private Function<ProfileRequestContext, ResponseType> requestedResponseTypeLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, ResponseType> requestedResponseTypeLookupStrategy;
/** Lookup strategy for fetching the valid response types matching the request message. */
- @Nonnull private Function<ProfileRequestContext, Set<ResponseType>> validResponseTypesLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, Set<ResponseType>> validResponseTypesLookupStrategy;
/** Strategy used to locate the unregistered client policy configured for the profile. */
@Nonnull private Function<ProfileRequestContext, Map<String, UnregisteredClientPolicy>>
@@ -67,8 +67,6 @@ public class ValidateResponseType extends AbstractOAuthAuthorizationResponseActi
* Constructor.
*/
public ValidateResponseType() {
- requestedResponseTypeLookupStrategy = new DefaultRequestResponseTypeLookupFunction();
- validResponseTypesLookupStrategy = new DefaultValidResponseTypesLookupFunction();
unregisteredClientPolicyLookupStrategy = new UnregisteredClientPolicyLookupFunction();
unregisteredClientPolicyEnforcer = new DefaultMetadataPolicyEnforcer();
}
@@ -120,6 +118,19 @@ public class ValidateResponseType extends AbstractOAuthAuthorizationResponseActi
unregisteredClientPolicyEnforcer = Constraint.isNotNull(enforcer, "Unregistered client policy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (requestedResponseTypeLookupStrategy == null) {
+ throw new ComponentInitializationException("Requested response type lookup strategy cannot be null");
+ }
+ if (validResponseTypesLookupStrategy == null) {
+ throw new ComponentInitializationException("Valid response types lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
index 105a3c04..0a090c62 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
@@ -34,8 +34,6 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationRes
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ClientInfoScopeLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseTypeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedScopeLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
import net.shibboleth.oidc.profile.core.OidcEventIds;
@@ -79,6 +77,9 @@ public class ValidateScope extends AbstractOAuthAuthorizationResponseAction {
/** Strategy used to obtain the mandatory scope value value. */
@Nonnull private Function<ProfileRequestContext,Scope> mandatoryScopeLookupStrategy;
+ /** Lookup strategy for fetching the requested response type. */
+ @Nullable private Function<ProfileRequestContext, ResponseType> requestedResponseTypeLookupStrategy;
+
/** Strategy used to locate the {@link OIDCAuthenticationResponseTokenClaimsContext}. */
@Nonnull
private Function<ProfileRequestContext,OIDCAuthenticationResponseTokenClaimsContext>
@@ -86,7 +87,6 @@ public class ValidateScope extends AbstractOAuthAuthorizationResponseAction {
/** Constructor. */
public ValidateScope() {
- requestedScopeLookupStrategy = new DefaultRequestedScopeLookupFunction();
relyingPartyIdLookupStrategy = new RelyingPartyIdLookupFunction();
final Function<ProfileRequestContext,Scope> asls = new ClientInfoScopeLookupFunction().compose(
new DefaultOIDCMetadataContextLookupFunction());
@@ -161,9 +161,19 @@ public class ValidateScope extends AbstractOAuthAuthorizationResponseAction {
tokenClaimsContextLookupStrategy = Constraint.isNotNull(strategy,
"OIDCAuthenticationResponseTokenClaimsContextt lookup strategy cannot be null");
}
-
-// Checkstyle: CyclomaticComplexity OFF
+ /**
+ * Set the lookup strategy for fetching the requested response type.
+ *
+ * @param strategy What to set.
+ */
+ public void setRequestedResponseTypeLookupStrategy(
+ @Nullable final Function<ProfileRequestContext, ResponseType> strategy) {
+ checkSetterPreconditions();
+ requestedResponseTypeLookupStrategy = strategy;
+ }
+
+ // Checkstyle: CyclomaticComplexity OFF
// Checkstyle: MethodLength OFF
/** {@inheritDoc} */
@Override
@@ -242,11 +252,10 @@ public class ValidateScope extends AbstractOAuthAuthorizationResponseAction {
}
}
- if (requestedScopes.contains(OIDCScopeValue.OFFLINE_ACCESS)) {
+ if (requestedScopes.contains(OIDCScopeValue.OFFLINE_ACCESS) && requestedResponseTypeLookupStrategy != null) {
// DefaultRequestResponseTypeLookupFunction returns response type only on authorization end point.
// It is enough to remove offline_scope in this first validation turn.
- final ResponseType responseType =
- new DefaultRequestResponseTypeLookupFunction().apply(profileRequestContext);
+ final ResponseType responseType = requestedResponseTypeLookupStrategy.apply(profileRequestContext);
if (responseType != null && !responseType.contains(ResponseType.Value.CODE)) {
requestedScopes.remove(OIDCScopeValue.OFFLINE_ACCESS);
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDToken.java
index af275f8d..9f1a7769 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDToken.java
@@ -27,7 +27,8 @@ import com.nimbusds.openid.connect.sdk.Nonce;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestNonceLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -41,15 +42,7 @@ public class AddNonceToIDToken extends AbstractOIDCResponseAction {
private Logger log = LoggerFactory.getLogger(AddNonceToIDToken.class);
/** Strategy used to obtain the request nonce. */
- @Nonnull
- private Function<ProfileRequestContext, Nonce> requestNonceLookupStrategy;
-
- /**
- * Constructor.
- */
- public AddNonceToIDToken() {
- requestNonceLookupStrategy = new DefaultRequestNonceLookupFunction();
- }
+ @NonnullAfterInit private Function<ProfileRequestContext, Nonce> requestNonceLookupStrategy;
/**
* Set the strategy used to locate the nonce of authentication request.
@@ -62,6 +55,16 @@ public class AddNonceToIDToken extends AbstractOIDCResponseAction {
Constraint.isNotNull(strategy, "RequestNonceLookupStrategy lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (requestNonceLookupStrategy == null) {
+ throw new ComponentInitializationException("Requested nonce lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java
index bbb6778b..0c9dc605 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java
@@ -29,15 +29,15 @@ import com.nimbusds.oauth2.sdk.ErrorObject;
import com.nimbusds.oauth2.sdk.ResponseMode;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.id.Issuer;
+import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationErrorResponse;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseModeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseTypeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestStateLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ValidatedRedirectURILookupFunction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.logic.IncludeIssuerInAuthenticationResponsePredicate;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
@@ -58,6 +58,15 @@ public class BuildAuthenticationErrorResponseFromEvent
/** Predicate to signal whether or not to include iss-parameter to the response. */
@Nonnull private Predicate<ProfileRequestContext> includeIssuerInResponsePredicate;
+ /** Lookup strategy for fetching the requested response mode. */
+ @NonnullAfterInit private Function<ProfileRequestContext, ResponseMode> requestedResponseModeLookupStrategy;
+
+ /** Lookup strategy for fetching the requested state. */
+ @NonnullAfterInit private Function<ProfileRequestContext, State> requestedStateLookupStrategy;
+
+ /** Lookup strategy for fetching the requested response type. */
+ @NonnullAfterInit private Function<ProfileRequestContext, ResponseType> requestedResponseTypeLookupStrategy;
+
/** Issuer value to included in the response message, if configured to be included. */
private Issuer issuer;
@@ -92,6 +101,55 @@ public class BuildAuthenticationErrorResponseFromEvent
"Include issuer in response predicate cannot be null");
}
+ /**
+ * Set the lookup strategy for fetching the requested response mode.
+ *
+ * @param strategy What to set.
+ */
+ public void setRequestedResponseModeLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, ResponseMode> strategy) {
+ checkSetterPreconditions();
+ requestedResponseModeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the lookup strategy for fetching the requested state.
+ *
+ * @param strategy What to set.
+ */
+ public void setRequestedStateLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, State> strategy) {
+ checkSetterPreconditions();
+ requestedStateLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the lookup strategy for fetching the requested response type.
+ *
+ * @param strategy What to set.
+ */
+ public void setRequestedResponseTypeLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, ResponseType> strategy) {
+ checkSetterPreconditions();
+ requestedResponseTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (requestedResponseModeLookupStrategy == null) {
+ throw new ComponentInitializationException("Response mode lookup strategy cannot be null");
+ }
+ if (requestedStateLookupStrategy == null) {
+ throw new ComponentInitializationException("State lookup strategy cannot be null");
+ }
+ if (requestedResponseTypeLookupStrategy == null) {
+ throw new ComponentInitializationException("Response type lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -123,8 +181,8 @@ public class BuildAuthenticationErrorResponseFromEvent
return null;
}
final ResponseMode defaultResponseMode =
- new DefaultRequestResponseModeLookupFunction().apply(profileRequestContext);
- final ResponseType responseType = new DefaultRequestResponseTypeLookupFunction().apply(profileRequestContext);
+ requestedResponseModeLookupStrategy.apply(profileRequestContext);
+ final ResponseType responseType = requestedResponseTypeLookupStrategy.apply(profileRequestContext);
final ResponseMode responseMode;
if (responseType != null && (responseType.impliesHybridFlow() || responseType.impliesImplicitFlow())) {
responseMode = defaultResponseMode == null ? ResponseMode.FRAGMENT :
@@ -133,7 +191,7 @@ public class BuildAuthenticationErrorResponseFromEvent
responseMode = defaultResponseMode;
}
return new AuthenticationErrorResponse(redirectURI, error,
- new DefaultRequestStateLookupFunction().apply(profileRequestContext), issuer, responseMode);
+ requestedStateLookupStrategy.apply(profileRequestContext), issuer, responseMode);
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessage.java
index fee97707..d2642fe4 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessage.java
@@ -26,18 +26,20 @@ import org.slf4j.Logger;
import com.nimbusds.oauth2.sdk.AuthorizationResponse;
import com.nimbusds.oauth2.sdk.AuthorizationSuccessResponse;
+import com.nimbusds.oauth2.sdk.ResponseMode;
import com.nimbusds.oauth2.sdk.id.Issuer;
+import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.AuthenticationResponse;
import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.AbstractOAuthAuthorizationResponseAction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseModeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestStateLookupFunction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.logic.IncludeIssuerInAuthenticationResponsePredicate;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
@@ -57,6 +59,12 @@ public class FormOutboundAuthenticationResponseMessage extends AbstractOAuthAuth
/** Predicate to signal whether or not to include iss-parameter to the response. */
@Nonnull private Predicate<ProfileRequestContext> includeIssuerInResponsePredicate;
+ /** Lookup strategy for fetching the requested response mode. */
+ @NonnullAfterInit private Function<ProfileRequestContext, ResponseMode> requestedResponseModeLookupStrategy;
+
+ /** Lookup strategy for fetching the requested state. */
+ @NonnullAfterInit private Function<ProfileRequestContext, State> requestedStateLookupStrategy;
+
/** Issuer value to included in the response message, if configured to be included. */
private Issuer issuer;
@@ -91,6 +99,41 @@ public class FormOutboundAuthenticationResponseMessage extends AbstractOAuthAuth
"Include issuer in response predicate cannot be null");
}
+ /**
+ * Set the lookup strategy for fetching the requested response mode.
+ *
+ * @param strategy What to set.
+ */
+ public void setRequestedResponseModeLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, ResponseMode> strategy) {
+ checkSetterPreconditions();
+ requestedResponseModeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the lookup strategy for fetching the requested state.
+ *
+ * @param strategy What to set.
+ */
+ public void setRequestedStateLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, State> strategy) {
+ checkSetterPreconditions();
+ requestedStateLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (requestedResponseModeLookupStrategy == null) {
+ throw new ComponentInitializationException("Response mode lookup strategy cannot be null");
+ }
+ if (requestedStateLookupStrategy == null) {
+ throw new ComponentInitializationException("State lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -128,15 +171,15 @@ public class FormOutboundAuthenticationResponseMessage extends AbstractOAuthAuth
oidcResponseContext.getRedirectURI(),
oidcResponseContext.getAuthorizationCode(), oidcResponseContext.getProcessedToken(),
oidcResponseContext.getAccessToken(),
- new DefaultRequestStateLookupFunction().apply(profileRequestContext), null, issuer,
- new DefaultRequestResponseModeLookupFunction().apply(profileRequestContext));
+ requestedStateLookupStrategy.apply(profileRequestContext), null, issuer,
+ requestedResponseModeLookupStrategy.apply(profileRequestContext));
profileRequestContext.ensureOutboundMessageContext().setMessage(resp);
} else {
final AuthorizationResponse resp = new AuthorizationSuccessResponse(
oidcResponseContext.getRedirectURI(),
oidcResponseContext.getAuthorizationCode(), oidcResponseContext.getAccessToken(),
- new DefaultRequestStateLookupFunction().apply(profileRequestContext), issuer,
- new DefaultRequestResponseModeLookupFunction().apply(profileRequestContext));
+ requestedStateLookupStrategy.apply(profileRequestContext), issuer,
+ requestedResponseModeLookupStrategy.apply(profileRequestContext));
profileRequestContext.ensureOutboundMessageContext().setMessage(resp);
}
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContext.java
index 21488b15..cafbf1f7 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContext.java
@@ -22,9 +22,8 @@ import javax.annotation.Nonnull;
import net.shibboleth.idp.authn.config.navigate.ForceAuthnProfileConfigPredicate;
import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestLoginHintLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestMaxAgeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedPromptLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -49,13 +48,13 @@ public class InitializeAuthenticationContext extends AbstractOIDCAuthenticationR
@Nonnull private final Logger log = LoggerFactory.getLogger(InitializeAuthenticationContext.class);
/** Strategy used to obtain the requested prompt value. */
- @Nonnull private Function<ProfileRequestContext, Prompt> promptLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, Prompt> promptLookupStrategy;
/** Strategy used to obtain the request login hint value. */
- @Nonnull private Function<ProfileRequestContext, String> loginHintLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, String> loginHintLookupStrategy;
/** Strategy used to obtain the request max_age value. */
- @Nonnull private Function<ProfileRequestContext, Duration> maxAgeLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, Duration> maxAgeLookupStrategy;
/** Extracts forceAuthn property from profile config. */
@Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
@@ -64,9 +63,6 @@ public class InitializeAuthenticationContext extends AbstractOIDCAuthenticationR
* Constructor.
*/
public InitializeAuthenticationContext() {
- promptLookupStrategy = new DefaultRequestedPromptLookupFunction();
- loginHintLookupStrategy = new DefaultRequestLoginHintLookupFunction();
- maxAgeLookupStrategy = new DefaultRequestMaxAgeLookupFunction();
forceAuthnPredicate = new ForceAuthnProfileConfigPredicate();
}
@@ -114,6 +110,22 @@ public class InitializeAuthenticationContext extends AbstractOIDCAuthenticationR
forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (promptLookupStrategy == null) {
+ throw new ComponentInitializationException("Prompt lookup strategy cannot be null");
+ }
+ if (loginHintLookupStrategy == null) {
+ throw new ComponentInitializationException("Login hint lookup strategy cannot be null");
+ }
+ if (maxAgeLookupStrategy == null) {
+ throw new ComponentInitializationException("Max age type lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
index f4ce28ac..7bc9269d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
@@ -14,7 +14,7 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultClientIDLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultClientIDLookupFunction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.profile.context.RelyingPartyContext;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRelyingPartyContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRelyingPartyContext.java
index 5b7d708b..c290c13c 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRelyingPartyContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeRelyingPartyContext.java
@@ -23,7 +23,7 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultClientIDLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultClientIDLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/OIDCMetadataLookupHandler.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/OIDCMetadataLookupHandler.java
index c6baa704..23145bff 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/OIDCMetadataLookupHandler.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/OIDCMetadataLookupHandler.java
@@ -18,7 +18,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultClientIDLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultClientIDLookupFunction;
import net.shibboleth.oidc.metadata.ClientInformationResolver;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.criterion.ClientIDCriterion;
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
index c450ac36..1ce3e8f3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContext.java
@@ -22,9 +22,10 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.PreferredPrincipalContext;
import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedAcrLookupFunction;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.oidc.profile.config.navigate.AcrClaimAlwaysEssentialLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -67,7 +68,7 @@ public class ProcessRequestedAuthnContext extends AbstractOIDCAuthenticationResp
@Nonnull private final Logger log = LoggerFactory.getLogger(ProcessRequestedAuthnContext.class);
/** Strategy used to obtain the requested acr values. */
- @Nonnull private Function<ProfileRequestContext, List<ACR>> acrLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, List<ACR>> acrLookupStrategy;
/** Strategy used to obtain whether all arc claims requests should be treated as Essential. */
@Nonnull private Predicate<ProfileRequestContext> acrAlwaysEssentialLookupStrategy;
@@ -85,7 +86,6 @@ public class ProcessRequestedAuthnContext extends AbstractOIDCAuthenticationResp
* Constructor.
*/
public ProcessRequestedAuthnContext() {
- acrLookupStrategy = new DefaultRequestedAcrLookupFunction();
acrAlwaysEssentialLookupStrategy = new AcrClaimAlwaysEssentialLookupFunction();
}
@@ -110,6 +110,16 @@ public class ProcessRequestedAuthnContext extends AbstractOIDCAuthenticationResp
"AcrAlwaysEssentialLookupStrategy lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (acrLookupStrategy == null) {
+ throw new ComponentInitializationException("ACR lookup strategy cannot be null");
+ }
+ }
+
// Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
@Override
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsent.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsent.java
index f66777e5..07598ebe 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsent.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsent.java
@@ -22,7 +22,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import net.shibboleth.idp.consent.context.ConsentManagementContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultRevokeConsentPredicate;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -36,16 +37,9 @@ public class RevokeConsent extends AbstractOIDCResponseAction {
@Nonnull private Logger log = LoggerFactory.getLogger(RevokeConsent.class);
/** Predicate used to decide if pre-existing consent is to be revoked. */
- @Nonnull
+ @NonnullAfterInit
private Predicate<ProfileRequestContext> revokePredicate;
- /**
- * Constructor.
- */
- public RevokeConsent() {
- revokePredicate = new DefaultRevokeConsentPredicate();
- }
-
/**
* Set the predicate used to decide if pre-existing consent is to be revoked.
*
@@ -58,6 +52,16 @@ public class RevokeConsent extends AbstractOIDCResponseAction {
revokePredicate = Constraint.isNotNull(predicate, "Predicate cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (revokePredicate == null) {
+ throw new ComponentInitializationException("Revoke consent predicate cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
index 7121a890..ff3303d3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
@@ -38,7 +38,6 @@ import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.attribute.transcoding.TranscoderSupport;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedClaimsLookupFunction;
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
@@ -61,18 +60,11 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
@Nonnull private final Logger log = LoggerFactory.getLogger(SetRequestedClaimsToResponseContext.class);
/** Strategy used to obtain the requested claims of request. */
- @Nonnull private Function<ProfileRequestContext, OIDCClaimsRequest> requestedClaimsLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, OIDCClaimsRequest> requestedClaimsLookupStrategy;
/** Transcoder registry service object. */
@NonnullAfterInit private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry;
- /**
- * Constructor.
- */
- public SetRequestedClaimsToResponseContext() {
- requestedClaimsLookupStrategy = new DefaultRequestedClaimsLookupFunction();
- }
-
/**
* Sets the registry of transcoding rules to apply to encode attributes.
*
@@ -104,6 +96,9 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
if (transcoderRegistry == null) {
throw new ComponentInitializationException("AttributeTranscoderRegistry cannot be null");
}
+ if (requestedClaimsLookupStrategy == null) {
+ throw new ComponentInitializationException("RequestedClaimsLookupStrategy lookup strategy cannot be null");
+ }
}
/** {@inheritDoc} */
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultRevokeConsentPredicate.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultRevokeConsentPredicate.java
index 82aa5e83..bb920e3b 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultRevokeConsentPredicate.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultRevokeConsentPredicate.java
@@ -20,9 +20,10 @@ import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedPromptLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ValidatedScopeLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.AbstractInitializableComponent;
+import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -50,7 +51,7 @@ public class DefaultRevokeConsentPredicate extends AbstractInitializableComponen
@Nonnull private Function<ProfileRequestContext,Scope> scopeLookupStrategy;
/** Strategy used to obtain the requested prompt value. */
- @Nonnull private Function<ProfileRequestContext, Prompt> promptLookupStrategy;
+ @NonnullAfterInit private Function<ProfileRequestContext, Prompt> promptLookupStrategy;
/** Predicate used to determine if consent should be revoked with offline_access scope. */
@Nonnull private Predicate<ProfileRequestContext> revokeWithOfflineAccessScopePredicate;
@@ -63,7 +64,6 @@ public class DefaultRevokeConsentPredicate extends AbstractInitializableComponen
*/
public DefaultRevokeConsentPredicate() {
scopeLookupStrategy = new ValidatedScopeLookupFunction();
- promptLookupStrategy = new DefaultRequestedPromptLookupFunction();
revokeWithOfflineAccessScopePredicate = PredicateSupport.alwaysTrue();
revokeWithConsentPromptPredicate = PredicateSupport.alwaysTrue();
}
@@ -109,6 +109,17 @@ public class DefaultRevokeConsentPredicate extends AbstractInitializableComponen
revokeWithConsentPromptPredicate = Constraint.isNotNull(predicate,
"RevokeWithConsentPromptPredicate cannot be null");
}
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (promptLookupStrategy == null) {
+ throw new ComponentInitializationException("Prompt lookup strategy cannot be null");
+ }
+ }
+
/** {@inheritDoc} */
@Override
public boolean test(@Nullable final ProfileRequestContext input) {
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionCreationStrategy.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionCreationStrategy.java
index 8a0e24b4..7d7d4e0d 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionCreationStrategy.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/session/impl/OIDCRPSessionCreationStrategy.java
@@ -31,7 +31,7 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultClientIDLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultClientIDLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.session.OIDCRPSession;
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
index 78a2129e..a6e3d194 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
@@ -25,7 +25,7 @@
</bean>
<bean id="shibboleth.ClientIDLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction"
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestClientIDLookupFunction"
scope="prototype" />
<bean id="InitializeOutboundMessageContext"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml
index 8171ed79..3dfdf6d1 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml
@@ -274,7 +274,7 @@
p:requireRequestedValue="true"
p:unregisteredClientPolicyEnforcer="#{getObject('shibboleth.oidc.UnregisteredClientPolicyEnforcer') ?: getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyEnforcer')}">
<property name="redirectURILookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestRedirectURILookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestRedirectURILookupFunction"
p:useOnlyRequestObjectPredicate-ref="UseOnlyRequestObjectCondition"/>
</property>
</bean>
@@ -283,15 +283,18 @@
scope="prototype"
p:unregisteredClientPolicyEnforcer="#{getObject('shibboleth.oidc.UnregisteredClientPolicyEnforcer') ?: getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyEnforcer')}">
<property name="requestedResponseTypeLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseTypeLookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseTypeLookupFunction"
p:useOnlyRequestObjectPredicate-ref="UseOnlyRequestObjectCondition"/>
</property>
+ <property name="validResponseTypesLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultValidResponseTypesLookupFunction"/>
+ </property>
</bean>
<bean id="ValidateResponseMode" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateResponseMode"
scope="prototype">
<property name="requestedResponseModeLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseModeLookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseModeLookupFunction"
p:useOnlyRequestObjectPredicate-ref="UseOnlyRequestObjectCondition"/>
</property>
</bean>
@@ -299,11 +302,11 @@
<bean id="ValidateCodeChallenge" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateCodeChallenge"
scope="prototype">
<property name="codeChallengeLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestCodeChallengeLookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeLookupFunction"
p:useOnlyRequestObjectPredicate-ref="UseOnlyRequestObjectCondition"/>
</property>
<property name="codeChallengeMethodLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestCodeChallengeMethodLookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeMethodLookupFunction"
p:useOnlyRequestObjectPredicate-ref="UseOnlyRequestObjectCondition"/>
</property>
</bean>
@@ -311,7 +314,7 @@
<bean id="StoreDPoPProofKeyThumbprint" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.StoreDPoPProofKeyThumbprint"
scope="prototype">
<property name="dpopJktLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestDPoPJktLookupFunction"
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestDPoPJktLookupFunction"
p:useOnlyRequestObjectPredicate-ref="UseOnlyRequestObjectCondition"/>
</property>
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
index 2bfe7016..4655bc34 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
@@ -25,7 +25,7 @@
</bean>
<bean id="shibboleth.ClientIDLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction"
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestClientIDLookupFunction"
scope="prototype" />
<bean id="InitializeOutboundMessageContext"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 447498ce..6b9dacd1 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -37,20 +37,31 @@
<bean id="InitializeAuthenticationContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeAuthenticationContext" scope="prototype"
- p:loginHintLookupStrategy-ref="%{idp.oidc.LoginHintLookupStrategy:DefaultRequestLoginHintLookupFunction}"/>
+ p:loginHintLookupStrategy-ref="%{idp.oidc.LoginHintLookupStrategy:DefaultRequestLoginHintLookupFunction}">
+ <property name="promptLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestedPromptLookupFunction"/>
+ </property>
+ <property name="maxAgeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestMaxAgeLookupFunction"/>
+ </property>
+ </bean>
<bean id="DefaultRequestLoginHintLookupFunction"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestLoginHintLookupFunction"
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestLoginHintLookupFunction"
scope="prototype" />
<bean id="ProcessRequestedAuthnContext"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ProcessRequestedAuthnContext" scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.ProcessRequestedAuthnContext" scope="prototype">
+ <property name="acrLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestedAcrLookupFunction"/>
+ </property>
+ </bean>
<bean id="PopulateUserAgentContext" class="net.shibboleth.idp.profile.impl.PopulateUserAgentContext"
scope="prototype" p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
<bean id="shibboleth.ClientIDLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultClientIDLookupFunction"
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultClientIDLookupFunction"
scope="prototype" />
<bean id="SetRequestedSubjectToResponseContext"
@@ -64,7 +75,11 @@
<bean id="SetRequestedClaimsToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetRequestedClaimsToResponseContext" scope="prototype"
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
- p:activationCondition-ref="ScopeContainsOpenid"/>
+ p:activationCondition-ref="ScopeContainsOpenid">
+ <property name="requestedClaimsLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestedClaimsLookupFunction"/>
+ </property>
+ </bean>
<bean id="PopulatePostAuthnInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
@@ -397,23 +412,56 @@
<bean id="ValidateRedirectURI" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateRedirectURI"
scope="prototype"
p:requireRequestedValue="true"
- p:unregisteredClientPolicyEnforcer="#{getObject('shibboleth.oidc.UnregisteredClientPolicyEnforcer') ?: getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyEnforcer')}"/>
+ p:unregisteredClientPolicyEnforcer="#{getObject('shibboleth.oidc.UnregisteredClientPolicyEnforcer') ?: getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyEnforcer')}">
+ <property name="redirectURILookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestRedirectURILookupFunction"/>
+ </property>
+ </bean>
<bean id="ValidateResponseType" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateResponseType"
scope="prototype"
- p:unregisteredClientPolicyEnforcer="#{getObject('shibboleth.oidc.UnregisteredClientPolicyEnforcer') ?: getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyEnforcer')}"/>
+ p:unregisteredClientPolicyEnforcer="#{getObject('shibboleth.oidc.UnregisteredClientPolicyEnforcer') ?: getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyEnforcer')}">
+ <property name="requestedResponseTypeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseTypeLookupFunction"/>
+ </property>
+ <property name="validResponseTypesLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultValidResponseTypesLookupFunction"/>
+ </property>
+ </bean>
<bean id="ValidateResponseMode" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateResponseMode"
- scope="prototype" />
+ scope="prototype">
+ <property name="requestedResponseModeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseModeLookupFunction"/>
+ </property>
+ </bean>
<bean id="ValidateCodeChallenge" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateCodeChallenge"
- scope="prototype" />
+ scope="prototype">
+ <property name="codeChallengeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeLookupFunction"/>
+ </property>
+ <property name="codeChallengeMethodLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeMethodLookupFunction"/>
+ </property>
+ </bean>
<bean id="StoreDPoPProofKeyThumbprint" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.StoreDPoPProofKeyThumbprint"
- scope="prototype" />
+ scope="prototype">
+ <property name="dpopJktLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestDPoPJktLookupFunction"/>
+ </property>
+ </bean>
<bean id="ValidateScope" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateScope" scope="prototype"
- p:allowedScopeLookupStrategy="#{getObject('shibboleth.oidc.AllowedScopeStrategy') ?: getObject('shibboleth.oidc.DefaultAllowedScopeStrategy')}" />
+ p:allowedScopeLookupStrategy="#{getObject('shibboleth.oidc.AllowedScopeStrategy') ?: getObject('shibboleth.oidc.DefaultAllowedScopeStrategy')}">
+ <property name="requestedScopeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestedScopeLookupFunction"/>
+ </property>
+ <property name="requestedResponseTypeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseTypeLookupFunction"/>
+ </property>
+ </bean>
<bean id="ValidateAudience"
class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateAudience" scope="prototype"
@@ -421,7 +469,7 @@
p:allowedAudienceLookupStrategy="#{getObject('shibboleth.oidc.AllowedAudienceStrategy') ?: getObject('shibboleth.oidc.DefaultAllowedAudienceStrategy')}" />
<bean id="AuthenticationRequestAudienceLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction" scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestAudienceLookupFunction" scope="prototype" />
<bean id="PopulateClientStorageLoadContext"
class="org.opensaml.storage.impl.client.PopulateClientStorageLoadContext" scope="prototype"
@@ -433,7 +481,11 @@
<bean id="shibboleth.oidc.DefaultRevokeConsentPredicate"
class="net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultRevokeConsentPredicate"
p:revokeWithOfflineAccessScopePredicate="#{getObject('shibboleth.oidc.RevokeWithOfflineAccessScopePredicate') ?: getObject('shibboleth.Conditions.TRUE')}"
- p:revokeWithConsentPromptPredicate="#{getObject('shibboleth.oidc.RevokeWithConsentPromptPredicate') ?: getObject('shibboleth.Conditions.TRUE')}" />
+ p:revokeWithConsentPromptPredicate="#{getObject('shibboleth.oidc.RevokeWithConsentPromptPredicate') ?: getObject('shibboleth.Conditions.TRUE')}">
+ <property name="promptLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestedPromptLookupFunction"/>
+ </property>
+ </bean>
<bean id="SetAuthenticationTimeToResponseContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.SetAuthenticationTimeToResponseContext" scope="prototype" />
@@ -624,6 +676,15 @@
<property name="activationCondition">
<ref bean="AuthorizeCodeRequested" />
</property>
+ <property name="codeChallengeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeLookupFunction"/>
+ </property>
+ <property name="codeChallengeMethodLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeMethodLookupFunction"/>
+ </property>
+ <property name="requestNonceLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestNonceLookupFunction"/>
+ </property>
</bean>
<!-- If access token is strictly for UserInfo endpoint... -->
@@ -914,7 +975,11 @@
scope="prototype" />
<bean id="AddNonceToIDToken" class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddNonceToIDToken"
- scope="prototype" />
+ scope="prototype">
+ <property name="requestNonceLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestNonceLookupFunction"/>
+ </property>
+ </bean>
<bean id="AddAccessTokenHashToIDToken"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.AddAccessTokenHashToIDToken" scope="prototype"
@@ -998,7 +1063,14 @@
c:lifetime="%{idp.session.defaultSPlifetime:PT2H}"/>
<bean id="FormOutboundMessage"
- class="net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundAuthenticationResponseMessage" scope="prototype" />
+ class="net.shibboleth.idp.plugin.oidc.op.profile.impl.FormOutboundAuthenticationResponseMessage" scope="prototype">
+ <property name="requestedResponseModeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseModeLookupFunction"/>
+ </property>
+ <property name="requestedStateLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestStateLookupFunction"/>
+ </property>
+ </bean>
<bean id="PopulateClientStorageSaveContext"
class="org.opensaml.storage.impl.client.PopulateClientStorageSaveContext" scope="prototype"
@@ -1013,6 +1085,9 @@
<bean parent="shibboleth.Conditions.Expression"
c:expression="#input.ensureOutboundMessageContext().ensureSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).isRequestObjectFailure()" />
</property>
+ <property name="redirectURILookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestRedirectURILookupFunction"/>
+ </property>
</bean>
<bean id="BuildErrorResponseFromEvent"
@@ -1022,6 +1097,15 @@
<property name="eventContextLookupStrategy">
<bean class="net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction" />
</property>
+ <property name="requestedResponseModeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseModeLookupFunction"/>
+ </property>
+ <property name="requestedStateLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestStateLookupFunction"/>
+ </property>
+ <property name="requestedResponseTypeLookupStrategy">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseTypeLookupFunction"/>
+ </property>
</bean>
<bean id="ErrorViewPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
@@ -1031,7 +1115,7 @@
p:defaultView-ref="shibboleth.DefaultErrorView" p:eventMap="#{getObject('shibboleth.EventViewMap')}" />
<bean id="RequestResponseTypeLookupFunction" scope="prototype"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseTypeLookupFunction"/>
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseTypeLookupFunction"/>
<bean id="IDTokenRequested" parent="shibboleth.Conditions.Expression" p:customObject-ref="RequestResponseTypeLookupFunction">
<constructor-arg>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index b23f91f4..eea19308 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -31,7 +31,7 @@
</bean>
<bean id="shibboleth.ClientIDLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction" />
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestClientIDLookupFunction" />
<bean id="ResolveAttributesForClientPredicate"
class="net.shibboleth.profile.config.logic.ResolveAttributesPredicate" />
@@ -95,7 +95,7 @@
p:unregisteredClientPolicyEnforcer="#{getObject('shibboleth.oidc.UnregisteredClientPolicyEnforcer') ?: getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyEnforcer')}"/>
<bean id="shibboleth.TokenRequestRedirectURILookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestRedirectURILookupFunction" />
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestRedirectURILookupFunction" />
<bean id="shibboleth.TokenRequestValidRequestUrisLookupStrategy"
class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestValidRequestURIsLookupFunction" />
@@ -176,7 +176,7 @@
p:allowedAudienceLookupStrategy="#{getObject('shibboleth.oidc.AllowedAudienceStrategy') ?: getObject('shibboleth.oidc.DefaultAllowedAudienceStrategy')}" />
<bean id="TokenRequestScopeLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction" />
+ class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestScopeLookupFunction" />
<bean id="BuildOIDCTokensCondition"
class="net.shibboleth.idp.plugin.oidc.op.profile.logic.IssueIDTokenCondition" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoderTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoderTest.java
index d93b2c23..6ec49f0d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoderTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoderTest.java
@@ -29,7 +29,7 @@ import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import jakarta.servlet.http.HttpServletRequest;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestAudienceLookupFunction;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.NonnullSupplier;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
index 4b42c76a..9497899e 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
@@ -34,8 +34,8 @@ import com.nimbusds.oauth2.sdk.http.JakartaServletUtils;
import com.nimbusds.oauth2.sdk.http.HTTPRequest.Method;
import jakarta.servlet.http.HttpServletRequest;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestAudienceLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl.CustomNimbusRequestParser;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.primitive.NonnullSupplier;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java
similarity index 85%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java
index 323e2ae9..d23176d2 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthenticationRequestLookupFunctionTest.java
@@ -12,11 +12,12 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
+import net.shibboleth.shared.component.ComponentInitializationException;
import java.net.URI;
@@ -27,7 +28,9 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
@@ -88,8 +91,18 @@ public class AbstractAuthenticationRequestLookupFunctionTest {
@SuppressWarnings("null")
class MockOKLookupFunction extends AbstractAuthenticationRequestLookupFunction<String> {
+ public MockOKLookupFunction() {
+ super();
+ try {
+ initialize();
+ } catch (final ComponentInitializationException e) {
+ Assert.fail();
+ }
+ }
+
@Override
- protected String doLookup(AuthenticationRequest req) {
+ protected String doLookup(AuthenticationRequest req, PushedAuthorizationRequest parRequest,
+ JWT requestObject, boolean isRequestObjectFromPar) {
return req != null ? new String("OK") : new String("NOK");
}
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java
similarity index 85%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java
index 662f3d1e..4fffc3be 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractAuthorizationRequestLookupFunctionTest.java
@@ -12,11 +12,12 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
+import net.shibboleth.shared.component.ComponentInitializationException;
import java.net.URI;
@@ -27,7 +28,9 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.nimbusds.jwt.JWT;
import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseType;
import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.oauth2.sdk.id.ClientID;
@@ -90,8 +93,18 @@ public class AbstractAuthorizationRequestLookupFunctionTest {
@SuppressWarnings("null")
class MockOKLookupFunction extends AbstractAuthorizationRequestLookupFunction<String> {
+ public MockOKLookupFunction() {
+ super();
+ try {
+ initialize();
+ } catch (final ComponentInitializationException e) {
+ Assert.fail();
+ }
+ }
+
@Override
- protected String doLookup(AuthorizationRequest req) {
+ protected String doLookup(AuthorizationRequest req, PushedAuthorizationRequest parRequest,
+ JWT requestObject, boolean isRequestObjectFromPar) {
return req != null ? new String("OK") : new String("NOK");
}
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractTokenRequestLookupFunctionTest.java
similarity index 97%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractTokenRequestLookupFunctionTest.java
index db6d2629..8dfa8bca 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/AbstractTokenRequestLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/AbstractTokenRequestLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultClientIDLookupFunctionTest.java
similarity index 96%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultClientIDLookupFunctionTest.java
index 03a7662a..fd0dc914 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultClientIDLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultClientIDLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
similarity index 91%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
index 43d37641..c6ff155b 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestLoginHintLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import org.testng.annotations.BeforeMethod;
@@ -27,13 +27,14 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
-public class DefaultRequestLoginHintLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestLoginHintLookupFunctionTest extends AbstractAuthenticationRequestLookupFunctionTest {
private DefaultRequestLoginHintLookupFunction lookup;
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestLoginHintLookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeFunctionTest.java
similarity index 92%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeFunctionTest.java
index 278d4d74..bd8bbc8e 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestMaxAgeFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestMaxAgeFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import java.time.Duration;
@@ -28,12 +28,14 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
-public class DefaultRequestMaxAgeFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestMaxAgeFunctionTest extends AbstractAuthenticationRequestLookupFunctionTest {
private DefaultRequestMaxAgeLookupFunction lookup;
+
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestMaxAgeLookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunctionTest.java
similarity index 92%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunctionTest.java
index 5e00a0c5..335ab622 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestNonceLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestNonceLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import org.testng.annotations.BeforeMethod;
@@ -28,12 +28,14 @@ import com.nimbusds.openid.connect.sdk.Nonce;
import org.testng.Assert;
-public class DefaultRequestNonceLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestNonceLookupFunctionTest extends AbstractAuthenticationRequestLookupFunctionTest {
private DefaultRequestNonceLookupFunction lookup;
+
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestNonceLookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java
similarity index 94%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java
index 35a30833..4706fa7d 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestRedirectURILookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import org.testng.annotations.BeforeMethod;
@@ -27,13 +27,14 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
-public class DefaultRequestRedirectURILookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestRedirectURILookupFunctionTest extends AbstractAuthorizationRequestLookupFunctionTest {
private DefaultRequestRedirectURILookupFunction lookup;
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestRedirectURILookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
similarity index 94%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
index 2ac964db..e950e831 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseModeLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import org.testng.annotations.BeforeMethod;
@@ -28,13 +28,14 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
-public class DefaultRequestResponseModeLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestResponseModeLookupFunctionTest extends AbstractAuthorizationRequestLookupFunctionTest {
private DefaultRequestResponseModeLookupFunction lookup;
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestResponseModeLookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
similarity index 94%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
index 2a8a002d..f4cd5f35 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestResponseTypeLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import org.testng.annotations.BeforeMethod;
@@ -27,13 +27,14 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
-public class DefaultRequestResponseTypeLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestResponseTypeLookupFunctionTest extends AbstractAuthorizationRequestLookupFunctionTest {
private DefaultRequestResponseTypeLookupFunction lookup;
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestResponseTypeLookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunctionTest.java
similarity index 92%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunctionTest.java
index 4c2bad43..779b2fe2 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestStateLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestStateLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import org.testng.annotations.BeforeMethod;
@@ -27,13 +27,14 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
-public class DefaultRequestStateLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestStateLookupFunctionTest extends AbstractAuthorizationRequestLookupFunctionTest {
private DefaultRequestStateLookupFunction lookup;
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestStateLookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
similarity index 93%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
index e1e3a393..04ede6d1 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedAcrLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import java.util.ArrayList;
@@ -30,13 +30,14 @@ import com.nimbusds.oauth2.sdk.id.State;
import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import com.nimbusds.openid.connect.sdk.claims.ACR;
-public class DefaultRequestedAcrLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestedAcrLookupFunctionTest extends AbstractAuthenticationRequestLookupFunctionTest {
private DefaultRequestedAcrLookupFunction lookup;
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestedAcrLookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
similarity index 95%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
index 3ca0bb59..2611ce1f 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedClaimsLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import java.text.ParseException;
@@ -33,13 +33,14 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
import com.nimbusds.openid.connect.sdk.claims.UserInfo;
-public class DefaultRequestedClaimsLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestedClaimsLookupFunctionTest extends AbstractAuthenticationRequestLookupFunctionTest {
private DefaultRequestedClaimsLookupFunction lookup;
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestedClaimsLookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
similarity index 93%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
index e48a51dd..4ab2efc7 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedPromptLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
@@ -30,12 +30,13 @@ import com.nimbusds.openid.connect.sdk.Prompt.Type;
import org.testng.Assert;
-public class DefaultRequestedPromptLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestedPromptLookupFunctionTest extends AbstractAuthenticationRequestLookupFunctionTest {
private DefaultRequestedPromptLookupFunction lookup;
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestedPromptLookupFunction();
+ lookup.initialize();
}
@Test
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
similarity index 95%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
index c3f778cf..8d44a4e6 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/DefaultRequestedScopeLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import org.testng.annotations.BeforeMethod;
@@ -28,13 +28,14 @@ import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
import org.testng.Assert;
-public class DefaultRequestedScopeLookupFunctionTest extends BaseDefaultRequestLookupFunctionTest {
+public class DefaultRequestedScopeLookupFunctionTest extends AbstractAuthorizationRequestLookupFunctionTest {
private DefaultRequestedScopeLookupFunction lookup;
@BeforeMethod
protected void setUp() throws Exception {
lookup = new DefaultRequestedScopeLookupFunction();
+ lookup.initialize();
oidcCtx.setRequestObject(null);
}
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestClientIDLookupFunctionTest.java
similarity index 96%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestClientIDLookupFunctionTest.java
index d134b950..f62b068a 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestClientIDLookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestClientIDLookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
diff --git a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunctionTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestRedirectURILookupFunctionTest.java
similarity index 97%
copy from idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunctionTest.java
copy to idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestRedirectURILookupFunctionTest.java
index 434bb4e8..d66c6d95 100644
--- a/idp-oidc-extension-api/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/TokenRequestRedirectURILookupFunctionTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/messaging/context/navigate/TokenRequestRedirectURILookupFunctionTest.java
@@ -12,7 +12,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+package net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate;
import java.net.URI;
import java.net.URISyntaxException;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoderTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoderTest.java
index c0b9c97d..b406690d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoderTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoderTest.java
@@ -29,7 +29,7 @@ import com.nimbusds.oauth2.sdk.AuthorizationRequest;
import com.nimbusds.oauth2.sdk.ResponseType;
import jakarta.servlet.http.HttpServletRequest;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestAudienceLookupFunction;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.NonnullSupplier;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContextTest.java
index 0e938c2f..2bc9f523 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/SetAuthorizationCodeToResponseContextTest.java
@@ -17,6 +17,9 @@ package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseConsentContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeMethodLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestNonceLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.profile.IdPEventIds;
@@ -77,6 +80,17 @@ public class SetAuthorizationCodeToResponseContextTest extends BaseOIDCResponseA
if (manipulationStrategy != null) {
action.setTokenClaimsSetManipulationStrategyLookupStrategy(manipulationStrategy);
}
+ final DefaultRequestNonceLookupFunction nonceLookup = new DefaultRequestNonceLookupFunction();
+ nonceLookup.initialize();
+ action.setRequestNonceLookupStrategy(nonceLookup);
+ final DefaultRequestCodeChallengeLookupFunction codeChallengeLookup =
+ new DefaultRequestCodeChallengeLookupFunction();
+ codeChallengeLookup.initialize();
+ action.setCodeChallengeLookupStrategy(codeChallengeLookup);
+ final DefaultRequestCodeChallengeMethodLookupFunction codeChallengeMethodLookup =
+ new DefaultRequestCodeChallengeMethodLookupFunction();
+ codeChallengeMethodLookup.initialize();
+ action.setCodeChallengeMethodLookupStrategy(codeChallengeMethodLookup);
action.initialize();
final SubjectContext subjectCtx = profileRequestCtx.ensureSubcontext(SubjectContext.class);
subjectCtx.setPrincipalName("userPrin");
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudienceTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudienceTest.java
index 9b5f3a3d..97f278a8 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudienceTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudienceTest.java
@@ -20,7 +20,7 @@ import java.time.Instant;
import java.util.List;
import java.util.Map;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestAudienceLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestAudienceLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateCodeChallengeTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateCodeChallengeTest.java
index b9d6331d..7ff1a7a2 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateCodeChallengeTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateCodeChallengeTest.java
@@ -16,6 +16,8 @@ package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
import java.net.URISyntaxException;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestCodeChallengeMethodLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.profile.core.OidcEventIds;
@@ -39,6 +41,13 @@ public class ValidateCodeChallengeTest extends BaseOIDCResponseActionTest {
@BeforeMethod
private void init() throws ComponentInitializationException, URISyntaxException, ParseException {
action = new ValidateCodeChallenge();
+ final DefaultRequestCodeChallengeLookupFunction codeLookup = new DefaultRequestCodeChallengeLookupFunction();
+ codeLookup.initialize();
+ final DefaultRequestCodeChallengeMethodLookupFunction methodLookup =
+ new DefaultRequestCodeChallengeMethodLookupFunction();
+ methodLookup.initialize();
+ action.setCodeChallengeLookupStrategy(codeLookup);
+ action.setCodeChallengeMethodLookupStrategy(methodLookup);
action.setForcePKCECondition(prc -> forcePkce);
action.setAllowPKCEPlainCondition(prc -> allowPlain);
action.initialize();
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseTypeTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseTypeTest.java
index dcbd9113..b4103313 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseTypeTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseTypeTest.java
@@ -20,6 +20,8 @@ import java.util.HashSet;
import java.util.Map;
import java.util.Set;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseTypeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultValidResponseTypesLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
@@ -48,6 +50,14 @@ public class ValidateResponseTypeTest extends BaseOIDCResponseActionTest {
private void initMetadata(final Set<ResponseType> responseTypes) throws ComponentInitializationException,
URISyntaxException, ParseException {
action = new ValidateResponseType();
+ final DefaultRequestResponseTypeLookupFunction responseTypeLookup =
+ new DefaultRequestResponseTypeLookupFunction();
+ responseTypeLookup.initialize();
+ action.setRequestedResponseTypeLookupStrategy(responseTypeLookup);
+ final DefaultValidResponseTypesLookupFunction validResponseTypesLookup =
+ new DefaultValidResponseTypesLookupFunction();
+ validResponseTypesLookup.initialize();
+ action.setValidResponseTypesLookupStrategy(validResponseTypesLookup);
action.initialize();
final OIDCMetadataContext oidcCtx =
profileRequestCtx.ensureInboundMessageContext().ensureSubcontext(OIDCMetadataContext.class);
@@ -90,7 +100,15 @@ public class ValidateResponseTypeTest extends BaseOIDCResponseActionTest {
new UnregisteredClientPolicy(new MetadataPolicy.Builder()
.withOneOfValues(responseTypes.stream().map(rt -> (Object) rt.toString()).toList())
.build())));
- try {
+ final DefaultRequestResponseTypeLookupFunction responseTypeLookup =
+ new DefaultRequestResponseTypeLookupFunction();
+ final DefaultValidResponseTypesLookupFunction validResponseTypesLookup =
+ new DefaultValidResponseTypesLookupFunction();
+ try {
+ responseTypeLookup.initialize();
+ action.setRequestedResponseTypeLookupStrategy(responseTypeLookup);
+ validResponseTypesLookup.initialize();
+ action.setValidResponseTypesLookupStrategy(validResponseTypesLookup);
action.initialize();
} catch (ComponentInitializationException e) {
Assert.fail("Initializiation failed", e);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java
index e8596bd5..e3b4a4bf 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java
@@ -19,7 +19,9 @@ import java.net.URISyntaxException;
import java.time.Instant;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseTokenClaimsContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestScopeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseTypeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestedScopeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestScopeLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
@@ -64,6 +66,13 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
private void init(Scope.Value... values) throws URISyntaxException, ComponentInitializationException {
action = new ValidateScope();
+ final DefaultRequestedScopeLookupFunction scopeLookup = new DefaultRequestedScopeLookupFunction();
+ scopeLookup.initialize();
+ action.setRequestedScopeLookupStrategy(scopeLookup);
+ final DefaultRequestResponseTypeLookupFunction responseTypeLookup =
+ new DefaultRequestResponseTypeLookupFunction();
+ responseTypeLookup.initialize();
+ action.setRequestedResponseTypeLookupStrategy(responseTypeLookup);
action.initialize();
final OIDCMetadataContext oidcCtx =
profileRequestCtx.ensureInboundMessageContext().ensureSubcontext(OIDCMetadataContext.class);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDTokenTest.java
index 6f6ffa40..38d0aec2 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddNonceToIDTokenTest.java
@@ -16,6 +16,7 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import java.time.Instant;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestNonceLookupFunction;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
@@ -34,6 +35,9 @@ public class AddNonceToIDTokenTest extends BaseOIDCResponseActionTest {
private void init() throws ComponentInitializationException {
action = new AddNonceToIDToken();
+ final DefaultRequestNonceLookupFunction nonceLookup = new DefaultRequestNonceLookupFunction();
+ nonceLookup.initialize();
+ action.setRequestNonceLookupStrategy(nonceLookup);
action.initialize();
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessageTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessageTest.java
index a66eff51..3b7dbc50 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessageTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/FormOutboundAuthenticationResponseMessageTest.java
@@ -18,6 +18,8 @@ import java.net.URI;
import java.net.URISyntaxException;
import java.time.Instant;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestResponseModeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestStateLookupFunction;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import org.opensaml.messaging.context.MessageContext;
@@ -38,6 +40,12 @@ public class FormOutboundAuthenticationResponseMessageTest extends BaseOIDCRespo
@BeforeMethod
public void init() throws ComponentInitializationException, URISyntaxException {
action = new FormOutboundAuthenticationResponseMessage();
+ final DefaultRequestResponseModeLookupFunction modeLookup = new DefaultRequestResponseModeLookupFunction();
+ modeLookup.initialize();
+ final DefaultRequestStateLookupFunction stateLookup = new DefaultRequestStateLookupFunction();
+ stateLookup.initialize();
+ action.setRequestedResponseModeLookupStrategy(modeLookup);
+ action.setRequestedStateLookupStrategy(stateLookup);
respCtx.setRedirectURI(new URI("http://example.org"));
action.initialize();
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContextTest.java
index 0935a7bd..13b84be7 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeAuthenticationContextTest.java
@@ -17,6 +17,9 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import net.shibboleth.idp.authn.AuthenticationResult;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestLoginHintLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestMaxAgeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestedPromptLookupFunction;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
@@ -55,6 +58,7 @@ public class InitializeAuthenticationContextTest {
@BeforeMethod
public void init() throws ComponentInitializationException, ParseException {
action = new InitializeAuthenticationContext();
+ setMandatoryLookups(action);
action.initialize();
final AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
new ClientID("000123"), URI.create("https://example.com/callback")).state(new State())
@@ -67,6 +71,18 @@ public class InitializeAuthenticationContextTest {
prc.ensureOutboundMessageContext().addSubcontext(new OIDCAuthenticationResponseContext());
}
+ protected void setMandatoryLookups(final InitializeAuthenticationContext action) throws ComponentInitializationException {
+ final DefaultRequestedPromptLookupFunction promptLookup = new DefaultRequestedPromptLookupFunction();
+ promptLookup.initialize();
+ final DefaultRequestMaxAgeLookupFunction maxAgeLookup = new DefaultRequestMaxAgeLookupFunction();
+ maxAgeLookup.initialize();
+ final DefaultRequestLoginHintLookupFunction loginHintLookup = new DefaultRequestLoginHintLookupFunction();
+ loginHintLookup.initialize();
+ action.setPromptLookupStrategy(promptLookup);
+ action.setMaxAgeLookupStrategy(maxAgeLookup);
+ action.setLoginHintLookupStrategy(loginHintLookup);
+ }
+
/**
* Test forced, hinted name.
*/
@@ -118,6 +134,7 @@ public class InitializeAuthenticationContextTest {
public void testOIDCAuthnRequestWithoutPromptForceAuthnViaPredicate() throws ComponentInitializationException {
action = new InitializeAuthenticationContext();
action.setForceAuthnPredicate(PredicateSupport.alwaysTrue());
+ setMandatoryLookups(action);
action.initialize();
final AuthenticationRequest req = new AuthenticationRequest.Builder(new ResponseType("code"), new Scope("openid"),
new ClientID("000123"), URI.create("https://example.com/callback")).state(new State()).build();
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java
index 30b5df38..daf3eac8 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ProcessRequestedAuthnContextTest.java
@@ -18,6 +18,7 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.PreferredPrincipalContext;
import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestedAcrLookupFunction;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.authn.principal.AuthenticationContextClassReferencePrincipal;
import net.shibboleth.shared.component.ComponentInitializationException;
@@ -46,6 +47,9 @@ public class ProcessRequestedAuthnContextTest extends BaseOIDCResponseActionTest
private void init() throws ComponentInitializationException {
action = new ProcessRequestedAuthnContext();
+ final DefaultRequestedAcrLookupFunction acrLookup = new DefaultRequestedAcrLookupFunction();
+ acrLookup.initialize();
+ action.setAcrLookupStrategy(acrLookup);
action.initialize();
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsentTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsentTest.java
index 2ac50f1b..0872a467 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsentTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsentTest.java
@@ -15,6 +15,8 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import net.shibboleth.idp.consent.context.ConsentManagementContext;
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.DefaultRequestedPromptLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultRevokeConsentPredicate;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
@@ -41,6 +43,12 @@ public class RevokeConsentTest extends BaseOIDCResponseActionTest {
@BeforeMethod
private void init() throws ComponentInitializationException {
action = new RevokeConsent();
+ final DefaultRevokeConsentPredicate predicate = new DefaultRevokeConsentPredicate();
+ final DefaultRequestedPromptLookupFunction promptLookup = new DefaultRequestedPromptLookupFunction();
+ promptLookup.initialize();
+ predicate.setPromptLookupStrategy(promptLookup);
+ predicate.initialize();
+ action.setRevokeConsentPredicate(predicate);
action.initialize();
respCtx.setScope(new Scope());
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list