[java-oidc-common] branch main updated: Add profile option for reverting 'aud' claims in JWT authentication assertions to tokenEndpointURL
Phil Smart
philip.smart at jisc.ac.uk
Wed Jun 4 09:07:01 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=5d344ae7b2930f4278fee8b4e430ba5b82f41f26
The following commit(s) were added to refs/heads/main by this push:
new 5d344ae Add profile option for reverting 'aud' claims in JWT authentication assertions to tokenEndpointURL
5d344ae is described below
commit 5d344ae7b2930f4278fee8b4e430ba5b82f41f26
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jun 4 10:06:58 2025 +0100
Add profile option for reverting 'aud' claims in JWT authentication
assertions to tokenEndpointURL
- Add UseTargetedEndpointAsJWTAudience to the
OAuth2ClientAuthenticableClientProfileConfiguration interface, and add
implementations where required. This is more generic, and can be used by
either RP or OP.
https://shibboleth.atlassian.net/browse/JCOMOIDC-129
---
...entAuthenticableClientProfileConfiguration.java | 15 ++++++++
.../DefaultOIDCAuthorizationConfiguration.java | 40 +++++++++++++++++++++
...efaultOIDCDynamicRegistrationConfiguration.java | 42 ++++++++++++++++++++++
...AbstractOAuth2TokenValidatingConfiguration.java | 42 ++++++++++++++++++++++
.../impl/DefaultOAuth2TokenConfiguration.java | 40 +++++++++++++++++++++
5 files changed, 179 insertions(+)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
index ad814fb..a0eb662 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
@@ -70,5 +70,20 @@ public interface OAuth2ClientAuthenticableClientProfileConfiguration
*/
@ConfigurationSetting(name="clientId")
@Nullable @NotEmpty String getClientId(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Should the audience claim of a JWT be targeted to a specific endpoint of the recipient? The targeted audience
+ * would be specific to the context in which the JWT is used. For example, the token endpoint URL in a JWT client
+ * assertion. Defaults to false, where the audience value must be the issuer identifier of the recipient.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return true if the audience claim should use a targeted endpoint of the recipient, false if the default
+ * audience applies
+ *
+ * @since 3.3.0
+ */
+ @ConfigurationSetting(name="useTokenEndpointAsJWTAudience")
+ boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index ed3ced3..260bbb9 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -151,6 +151,12 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
/** Whether client is required to use pushed authorization request. */
@Nonnull private Predicate<ProfileRequestContext> requirePushedAuthorizationRequestPredicate;
+
+ /**
+ * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
+ * is the audience must be the issuer identifier of the recipient.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudience;
/**
* Constructor.
@@ -196,6 +202,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
FunctionSupport.constant(PredicateSupport.alwaysTrue());
requireDpopJktPredicate = PredicateSupport.alwaysFalse();
requirePushedAuthorizationRequestPredicate = PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudience = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -1058,4 +1065,37 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
requirePushedAuthorizationRequestPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
+ @Override
+ public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
+ return useTargetedEndpointAsJWTAudience.test(profileRequestContext);
+ }
+
+ /**
+ * Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param condition condition to set.
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudience(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ useTargetedEndpointAsJWTAudience = Constraint.isNotNull(condition,
+ "UseTargetedEndpointAsJWTAudience Condition cannot be null");
+ }
+
+ /**
+ * Set a falg to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param flag the flag to set
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
+ useTargetedEndpointAsJWTAudience = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
index 34663ac..8963c34 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
@@ -17,6 +17,7 @@ package net.shibboleth.oidc.profile.config.impl;
import java.time.Duration;
import java.util.Map;
import java.util.function.Function;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -30,6 +31,7 @@ import net.shibboleth.shared.annotation.constraint.NonNegative;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
/**
* Implemenation of a profile configuration for the OpenID Connect dynamic client registration.
@@ -51,6 +53,12 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
/** Lookup function to the default metadata policy. */
@Nonnull private Function<ProfileRequestContext,Map<String,MetadataPolicy>> metadataPolicyLookupStrategy;
+
+ /**
+ * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
+ * is the audience must be the issuer identifier of the recipient.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudience;
/**
* Constructor.
@@ -71,6 +79,7 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
secretExpirationPeriodLookupStrategy = FunctionSupport.constant(Duration.ofDays(365));
metadataPolicyLookupStrategy = FunctionSupport.constant(null);
registrationValidityPeriodLookupStrategy = FunctionSupport.constant(null);
+ useTargetedEndpointAsJWTAudience = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -193,5 +202,38 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
@Nonnull final Function<ProfileRequestContext,Map<String,MetadataPolicy>> strategy) {
metadataPolicyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
+ return useTargetedEndpointAsJWTAudience.test(profileRequestContext);
+ }
+
+ /**
+ * Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param condition condition to set.
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudience(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ useTargetedEndpointAsJWTAudience = Constraint.isNotNull(condition,
+ "UseTargetedEndpointAsJWTAudience Condition cannot be null");
+ }
+
+ /**
+ * Set a falg to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param flag the flag to set
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
+ useTargetedEndpointAsJWTAudience = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
index ac256e0..a031154 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
@@ -15,6 +15,7 @@
package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.util.function.Function;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -26,6 +27,7 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenValidatingProfileCon
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
/**
* Base class for profile configurations that validate previously issued OAuth2 tokens.
@@ -40,6 +42,12 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
/** Validation of JWT claims for issued tokens. */
@Nonnull private Function<ProfileRequestContext,ClaimsValidator> issuedClaimsValidatorLookupStrategy;
+
+ /**
+ * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
+ * is the audience must be the issuer identifier of the recipient.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudience;
/**
* Creates a new configuration instance.
@@ -51,6 +59,7 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
issuerLookupStrategy = FunctionSupport.constant(null);
issuedClaimsValidatorLookupStrategy = FunctionSupport.constant(null);
+ useTargetedEndpointAsJWTAudience = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -110,5 +119,38 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
@Nonnull final Function<ProfileRequestContext,ClaimsValidator> strategy) {
issuedClaimsValidatorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
+ return useTargetedEndpointAsJWTAudience.test(profileRequestContext);
+ }
+
+ /**
+ * Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param condition condition to set.
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudience(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ useTargetedEndpointAsJWTAudience = Constraint.isNotNull(condition,
+ "UseTargetedEndpointAsJWTAudience Condition cannot be null");
+ }
+
+ /**
+ * Set a falg to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param flag the flag to set
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
+ useTargetedEndpointAsJWTAudience = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
index 617e899..4ac5f44 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
@@ -64,6 +64,12 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
/** Whether initial access token audience is solely to self (i.e. UserInfo) use. */
@Nonnull private Predicate<ProfileRequestContext> limitInitialAccessTokenToSelfPredicate;
+
+ /**
+ * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
+ * is the audience must be the issuer identifier of the recipient.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudience;
/**
* Constructor.
@@ -85,6 +91,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
enforceRefreshTokenRotationPredicate = PredicateSupport.alwaysFalse();
issueIdTokenViaRefreshTokenPredicate = PredicateSupport.alwaysTrue();
limitInitialAccessTokenToSelfPredicate = PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudience = PredicateSupport.alwaysFalse();
}
@Override
@@ -242,4 +249,37 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
@Nonnull final Predicate<ProfileRequestContext> condition) {
limitInitialAccessTokenToSelfPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
+ return useTargetedEndpointAsJWTAudience.test(profileRequestContext);
+ }
+
+ /**
+ * Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param condition condition to set.
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudience(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ useTargetedEndpointAsJWTAudience = Constraint.isNotNull(condition,
+ "UseTargetedEndpointAsJWTAudience Condition cannot be null");
+ }
+
+ /**
+ * Set a falg to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param flag the flag to set
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
+ useTargetedEndpointAsJWTAudience = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list