[java-oidc-common] branch main updated: Add profile option for reverting 'aud' claims in JWT authentication assertions to tokenEndpointURL
Phil Smart
philip.smart at jisc.ac.uk
Wed Jun 4 09:24:16 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=1596066eacec24c5a27c588cdad4ee7c633bc958
The following commit(s) were added to refs/heads/main by this push:
new 1596066 Add profile option for reverting 'aud' claims in JWT authentication assertions to tokenEndpointURL
1596066 is described below
commit 1596066eacec24c5a27c588cdad4ee7c633bc958
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jun 4 10:24:13 2025 +0100
Add profile option for reverting 'aud' claims in JWT authentication
assertions to tokenEndpointURL
- fix predicate naming
https://shibboleth.atlassian.net/browse/JCOMOIDC-129
---
.../impl/DefaultOIDCAuthorizationConfiguration.java | 14 +++++++-------
.../impl/DefaultOIDCDynamicRegistrationConfiguration.java | 12 ++++++------
.../impl/AbstractOAuth2TokenValidatingConfiguration.java | 13 +++++++------
.../config/impl/DefaultOAuth2TokenConfiguration.java | 15 ++++++++-------
4 files changed, 28 insertions(+), 26 deletions(-)
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 260bbb9..9de1901 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -156,7 +156,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
* is the audience must be the issuer identifier of the recipient.
*/
- @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudience;
+ @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
/**
* Constructor.
@@ -202,7 +202,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
FunctionSupport.constant(PredicateSupport.alwaysTrue());
requireDpopJktPredicate = PredicateSupport.alwaysFalse();
requirePushedAuthorizationRequestPredicate = PredicateSupport.alwaysFalse();
- useTargetedEndpointAsJWTAudience = PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -1068,7 +1068,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
/** {@inheritDoc} */
@Override
public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudience.test(profileRequestContext);
+ return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
}
/**
@@ -1080,13 +1080,13 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
*
* @since 3.3.0
*/
- public void setUseTargetedEndpointAsJWTAudience(@Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudience = Constraint.isNotNull(condition,
+ public void setUseTargetedEndpointAsJWTAudiencePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
"UseTargetedEndpointAsJWTAudience Condition cannot be null");
}
/**
- * Set a falg to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * Set a flag to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
* recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
* condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
*
@@ -1095,7 +1095,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @since 3.3.0
*/
public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudience = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
index 8963c34..e0ff0bc 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
@@ -58,7 +58,7 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
* Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
* is the audience must be the issuer identifier of the recipient.
*/
- @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudience;
+ @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
/**
* Constructor.
@@ -79,7 +79,7 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
secretExpirationPeriodLookupStrategy = FunctionSupport.constant(Duration.ofDays(365));
metadataPolicyLookupStrategy = FunctionSupport.constant(null);
registrationValidityPeriodLookupStrategy = FunctionSupport.constant(null);
- useTargetedEndpointAsJWTAudience = PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -206,7 +206,7 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
/** {@inheritDoc} */
@Override
public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudience.test(profileRequestContext);
+ return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
}
/**
@@ -219,12 +219,12 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
* @since 3.3.0
*/
public void setUseTargetedEndpointAsJWTAudience(@Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudience = Constraint.isNotNull(condition,
+ useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
"UseTargetedEndpointAsJWTAudience Condition cannot be null");
}
/**
- * Set a falg to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * Set a flag to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
* recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
* condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
*
@@ -233,7 +233,7 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
* @since 3.3.0
*/
public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudience = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
index a031154..d07bd2d 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
@@ -47,7 +47,7 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
* Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
* is the audience must be the issuer identifier of the recipient.
*/
- @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudience;
+ @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
/**
* Creates a new configuration instance.
@@ -59,7 +59,7 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
issuerLookupStrategy = FunctionSupport.constant(null);
issuedClaimsValidatorLookupStrategy = FunctionSupport.constant(null);
- useTargetedEndpointAsJWTAudience = PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -123,7 +123,7 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
/** {@inheritDoc} */
@Override
public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudience.test(profileRequestContext);
+ return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
}
/**
@@ -135,8 +135,9 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
*
* @since 3.3.0
*/
- public void setUseTargetedEndpointAsJWTAudience(@Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudience = Constraint.isNotNull(condition,
+ public void setUseTargetedEndpointAsJWTAudiencePredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
"UseTargetedEndpointAsJWTAudience Condition cannot be null");
}
@@ -150,7 +151,7 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
* @since 3.3.0
*/
public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudience = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
index 4ac5f44..efcedad 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
@@ -69,7 +69,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
* Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
* is the audience must be the issuer identifier of the recipient.
*/
- @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudience;
+ @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
/**
* Constructor.
@@ -91,7 +91,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
enforceRefreshTokenRotationPredicate = PredicateSupport.alwaysFalse();
issueIdTokenViaRefreshTokenPredicate = PredicateSupport.alwaysTrue();
limitInitialAccessTokenToSelfPredicate = PredicateSupport.alwaysFalse();
- useTargetedEndpointAsJWTAudience = PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
@Override
@@ -253,7 +253,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
/** {@inheritDoc} */
@Override
public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudience.test(profileRequestContext);
+ return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
}
/**
@@ -265,13 +265,14 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
*
* @since 3.3.0
*/
- public void setUseTargetedEndpointAsJWTAudience(@Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudience = Constraint.isNotNull(condition,
+ public void setUseTargetedEndpointAsJWTAudiencePredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
"UseTargetedEndpointAsJWTAudience Condition cannot be null");
}
/**
- * Set a falg to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * Set a flag to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
* recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
* condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
*
@@ -280,6 +281,6 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
* @since 3.3.0
*/
public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudience = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
}
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list