[java-idp-oidc] 02/02: JOIDC-222 - Support for OpenID Federation

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch dev/JOIDC-222
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=60c1fcb0cab4051600e2c8675969624e598e67be

commit 60c1fcb0cab4051600e2c8675969624e598e67be
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Apr 22 10:26:09 2025 +0300

    JOIDC-222 - Support for OpenID Federation
    
    https://shibboleth.atlassian.net/browse/JOIDC-222
    
    Include validated trust marks for the subject into the resolve entity response
---
 .../profile/impl/BuildResolveEntityResponse.java   | 47 +++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
index bf5a7b2b..c5714b20 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
@@ -14,10 +14,15 @@
 
 package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
 
+import java.text.ParseException;
 import java.time.Instant;
 import java.util.Date;
 import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
 import java.util.function.Function;
+import java.util.stream.Collectors;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -30,6 +35,7 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
 import org.slf4j.Logger;
 
 import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.SignedJWT;
 import com.nimbusds.openid.connect.sdk.federation.entities.EntityStatement;
 import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
 
@@ -130,10 +136,49 @@ public class BuildResolveEntityResponse extends AbstractBuildEntityStatementActi
         }
         builder.expirationTime(Date.from(expirationTime));
 
-
+        final String entityId = clientInformation.getID().getValue();
+        assert entityId != null;
+        final Map<String, String> trustMarks = buildTrustMarks(entityId, trustChainContext.getVerifiedTrustMarks());
+        if (trustMarks != null && !trustMarks.isEmpty()) {
+            builder.claim("trust_marks", trustMarks);
+        }
         return true;
     }
 
+    /**
+     * Builds value for the trust_marks claim in the resolve entity response entity statement.
+     * 
+     * @param entityId the subject entity ID
+     * @param trustMarks trust marks for the selected trust chain
+     * @return map of trust marks, keyed with trust mark IDs
+     */
+    @Nullable private Map<String, String> buildTrustMarks(@Nonnull final String entityId,
+            @Nullable final Map<String, List<SignedJWT>> trustMarks) {
+        return Optional.ofNullable(trustMarks)
+            .map(marks -> marks.get(entityId))
+            .filter(Objects::nonNull)
+            .map(list -> list.stream()
+                    .map(trustMark -> new Pair<String, String>(getTrustMarkId(trustMark), trustMark.serialize()))
+                    .filter(Objects::nonNull)
+                    .collect(Collectors.toMap(pair -> pair.getFirst(), pair -> pair.getSecond())))
+            .orElse(null);
+    }
+
+    /**
+     * Parses the trust mark ID for the given trust mark.
+     * 
+     * @param trustMark the trust mark
+     * @return the ID, or null if it could not be parsed
+     */
+    @Nullable private String getTrustMarkId(@Nullable final SignedJWT trustMark) {
+        try {
+            return trustMark == null ? null : trustMark.getJWTClaimsSet().getStringClaim("trust_mark_id");
+        } catch (final ParseException e) {
+            log.error("{} Could not parse the TrustMark JWT contents", getLogPrefix(), e);
+        }
+        return null;
+    }
+
     /**
      * Resolve expiration time for the given trust chain.
      * 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.