[java-idp-plugin-vci] 01/02: Authorization details carried in own specific claim in authz_code. Manipulation class renamed.
Codeberg
noreply at shibboleth.net
Fri Dec 5 08:28:00 UTC 2025
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/AUTHZ_DETAILS_TO_OWN_CLAIM
in repository java-idp-plugin-vci.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/195ead0e4467679f8f49290c1d108be7ac54891d
commit 195ead0e4467679f8f49290c1d108be7ac54891d
Author: jlauros <janne.lauros at csc.fi>
AuthorDate: Fri Dec 5 10:27:02 2025 +0200
Authorization details carried in own specific claim in authz_code. Manipulation class renamed.
---
.../AuthorizationDetailsLookupFunction.java | 12 ++-
...thorizationDetailsCodeManipulationStrategy.java | 87 ++++++++++++++++++++++
.../META-INF/net.shibboleth.idp/postconfig.xml | 2 +-
3 files changed, 96 insertions(+), 5 deletions(-)
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/AuthorizationDetailsLookupFunction.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/AuthorizationDetailsLookupFunction.java
index 907975e..209e5e0 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/AuthorizationDetailsLookupFunction.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/context/navigate/AuthorizationDetailsLookupFunction.java
@@ -22,6 +22,7 @@ import javax.annotation.Nonnull;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCIAuthorizationDetail;
import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCITokenRequest;
+import org.geant.shibboleth.plugin.openidvci.profile.logic.AuthorizationDetailsCodeManipulationStrategy;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -38,6 +39,10 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationRes
* from from 1. {@link AuthorizationRequest}, 2. {@link OpenIDVCITokenRequest}
* or from claim encoded to 3. authorization code grant.
*/
+
+/**
+ * TODO Locate details also in PAR case.
+ */
public class AuthorizationDetailsLookupFunction
implements ContextDataLookupFunction<ProfileRequestContext, List<OpenIDVCIAuthorizationDetail>> {
@@ -69,12 +74,11 @@ public class AuthorizationDetailsLookupFunction
OIDCAuthenticationResponseContext oidcCtx = input.getOutboundMessageContext()
.getSubcontext(OIDCAuthenticationResponseContext.class);
if (oidcCtx == null || oidcCtx.getAuthorizationGrantClaimsSet() == null
- || oidcCtx.getAuthorizationGrantClaimsSet().getUserinfoDeliveryClaims() == null) {
+ || oidcCtx.getAuthorizationGrantClaimsSet().getClaimsSet() == null) {
return null;
}
- // TODO: naming scheme for internal delivery claims
- if (oidcCtx.getAuthorizationGrantClaimsSet().getUserinfoDeliveryClaims()
- .getClaim("vci.int.authorizationDetails") instanceof String details) {
+ if (oidcCtx.getAuthorizationGrantClaimsSet().getClaimsSet()
+ .getClaim(AuthorizationDetailsCodeManipulationStrategy.CLAIM_NAME) instanceof String details) {
try {
return OpenIDVCIAuthorizationDetail.parse(details);
} catch (JsonProcessingException e) {
diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/AuthorizationDetailsCodeManipulationStrategy.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/AuthorizationDetailsCodeManipulationStrategy.java
new file mode 100644
index 0000000..658380d
--- /dev/null
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/logic/AuthorizationDetailsCodeManipulationStrategy.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2025, GÉANT
+ *
+ * Licensed under the Apache License, Version 2.0 (the “License”); you may not
+ * use this file except in compliance with the License. You may obtain a copy
+ * of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an “AS IS” BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.geant.shibboleth.plugin.openidvci.profile.logic;
+
+import java.util.List;
+import java.util.Map;
+import java.util.function.BiFunction;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.geant.shibboleth.plugin.openidvci.messaging.context.navigate.AuthorizationDetailsLookupFunction;
+import org.geant.shibboleth.plugin.openidvci.messaging.impl.OpenIDVCIAuthorizationDetail;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nimbusds.oauth2.sdk.AuthorizationRequest;
+
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+public class AuthorizationDetailsCodeManipulationStrategy
+ implements BiFunction<ProfileRequestContext, Map<String, Object>, Map<String, Object>> {
+
+ /** Class logger. */
+ @Nonnull
+ private Logger log = LoggerFactory.getLogger(AuthorizationDetailsCodeManipulationStrategy.class);
+
+ public final static String CLAIM_NAME = "vci.int.authorizationDetails";
+
+ /** Strategy used to locate the {@link OpenIDVCIAuthorizationDetail} to use. */
+ @Nonnull
+ private Function<ProfileRequestContext, List<OpenIDVCIAuthorizationDetail>> authorizationDetailsStrategy;
+
+ /**
+ * Set the strategy used to locate the {@link OpenIDVCIAuthorizationDetail} to
+ * use.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAuthorizationDetailsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, List<OpenIDVCIAuthorizationDetail>> strategy) {
+ authorizationDetailsStrategy = Constraint.isNotNull(strategy,
+ "AuthorizationDetailsLookupStrategy lookup strategy cannot be null");
+ }
+
+ /**
+ * Constructor.
+ */
+ public AuthorizationDetailsCodeManipulationStrategy() {
+ authorizationDetailsStrategy = new AuthorizationDetailsLookupFunction();
+ }
+
+ @Override
+ public Map<String, Object> apply(ProfileRequestContext profileRequestContext, Map<String, Object> claims) {
+ if (profileRequestContext.getInboundMessageContext().getMessage() instanceof AuthorizationRequest request) {
+ try {
+ List<OpenIDVCIAuthorizationDetail> details = OpenIDVCIAuthorizationDetail
+ .parse(request.toHTTPRequest());
+ if (details == null) {
+ return null;
+ }
+ claims.put(CLAIM_NAME, new ObjectMapper().writeValueAsString(details));
+ return claims;
+ } catch (JsonProcessingException e) {
+ log.warn("{} Failed parsing", e);
+ }
+ }
+ return null;
+ }
+}
diff --git a/openid-vci-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/openid-vci-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 2775a71..5a010b3 100644
--- a/openid-vci-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/openid-vci-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -25,7 +25,7 @@
class="org.geant.shibboleth.plugin.openidvci.authn.impl.WalletCredentialValidator" />
<bean id="openidvci.AuthzCodeManipulationStrategy"
- class="org.geant.shibboleth.plugin.openidvci.profile.logic.AuthorizationCodeManipulationStrategy" />
+ class="org.geant.shibboleth.plugin.openidvci.profile.logic.AuthorizationDetailsCodeManipulationStrategy" />
</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list