[java-oidc-common] branch main updated: Add profile option for reverting 'aud' claims in JWT authentication assertions to tokenEndpointURL
Phil Smart
philip.smart at jisc.ac.uk
Wed Jun 4 10:13:10 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=913b6f92e2c477dae7a3055a83279d14e875803c
The following commit(s) were added to refs/heads/main by this push:
new 913b6f9 Add profile option for reverting 'aud' claims in JWT authentication assertions to tokenEndpointURL
913b6f9 is described below
commit 913b6f92e2c477dae7a3055a83279d14e875803c
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jun 4 11:13:07 2025 +0100
Add profile option for reverting 'aud' claims in JWT authentication
assertions to tokenEndpointURL
- consolidate profile additions into the abstract client authenticable
abstract class
https://shibboleth.atlassian.net/browse/JCOMOIDC-129
---
.../DefaultOIDCAuthorizationConfiguration.java | 41 --------------------
...efaultOIDCDynamicRegistrationConfiguration.java | 43 ---------------------
...th2ClientAuthenticableProfileConfiguration.java | 42 +++++++++++++++++++++
...AbstractOAuth2TokenValidatingConfiguration.java | 44 ----------------------
.../impl/DefaultOAuth2TokenConfiguration.java | 40 --------------------
5 files changed, 42 insertions(+), 168 deletions(-)
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 9de1901..bfeddf9 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -151,12 +151,6 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
/** Whether client is required to use pushed authorization request. */
@Nonnull private Predicate<ProfileRequestContext> requirePushedAuthorizationRequestPredicate;
-
- /**
- * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
- * is the audience must be the issuer identifier of the recipient.
- */
- @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
/**
* Constructor.
@@ -202,7 +196,6 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
FunctionSupport.constant(PredicateSupport.alwaysTrue());
requireDpopJktPredicate = PredicateSupport.alwaysFalse();
requirePushedAuthorizationRequestPredicate = PredicateSupport.alwaysFalse();
- useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -1064,38 +1057,4 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
@Nonnull final Predicate<ProfileRequestContext> condition) {
requirePushedAuthorizationRequestPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
-
- /** {@inheritDoc} */
- @Override
- public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
- }
-
- /**
- * Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
- * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
- *
- * @param condition condition to set.
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudiencePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
- "UseTargetedEndpointAsJWTAudience Condition cannot be null");
- }
-
- /**
- * Set a flag to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
- * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
- *
- * @param flag the flag to set
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
index e0ff0bc..6e65928 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCDynamicRegistrationConfiguration.java
@@ -17,7 +17,6 @@ package net.shibboleth.oidc.profile.config.impl;
import java.time.Duration;
import java.util.Map;
import java.util.function.Function;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -31,7 +30,6 @@ import net.shibboleth.shared.annotation.constraint.NonNegative;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
/**
* Implemenation of a profile configuration for the OpenID Connect dynamic client registration.
@@ -53,12 +51,6 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
/** Lookup function to the default metadata policy. */
@Nonnull private Function<ProfileRequestContext,Map<String,MetadataPolicy>> metadataPolicyLookupStrategy;
-
- /**
- * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
- * is the audience must be the issuer identifier of the recipient.
- */
- @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
/**
* Constructor.
@@ -79,7 +71,6 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
secretExpirationPeriodLookupStrategy = FunctionSupport.constant(Duration.ofDays(365));
metadataPolicyLookupStrategy = FunctionSupport.constant(null);
registrationValidityPeriodLookupStrategy = FunctionSupport.constant(null);
- useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -202,38 +193,4 @@ public class DefaultOIDCDynamicRegistrationConfiguration extends AbstractOAuth2F
@Nonnull final Function<ProfileRequestContext,Map<String,MetadataPolicy>> strategy) {
metadataPolicyLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
-
- /** {@inheritDoc} */
- @Override
- public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
- }
-
- /**
- * Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
- * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
- *
- * @param condition condition to set.
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudience(@Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
- "UseTargetedEndpointAsJWTAudience Condition cannot be null");
- }
-
- /**
- * Set a flag to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
- * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
- *
- * @param flag the flag to set
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index 2eadc9e..ba9322c 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -101,6 +101,12 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
/** Lookup function to retrieve nonce generator for DPoP proofs. */
@Nonnull private Function<ProfileRequestContext,Function<ProfileRequestContext,String>>
dpopProofNonceGeneratorLookupStrategy;
+
+ /**
+ * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
+ * is the audience must be the issuer identifier of the recipient.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
/**
* Constructor.
@@ -131,6 +137,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
dpopSignatureValidationConfigurationLookupStrategy = FunctionSupport.constant(null);
requireDpopProofPredicate = PredicateSupport.alwaysFalse();
dpopProofNonceGeneratorLookupStrategy = FunctionSupport.constant(null);
+ useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -617,4 +624,39 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
dpopProofNonceGeneratorLookupStrategy =
Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
+ return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param condition condition to set.
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudiencePredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
+ "UseTargetedEndpointAsJWTAudience Condition cannot be null");
+ }
+
+ /**
+ * Set a flag to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
+ * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
+ * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
+ *
+ * @param flag the flag to set
+ *
+ * @since 3.3.0
+ */
+ public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
+ useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
index d07bd2d..d637af6 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2TokenValidatingConfiguration.java
@@ -15,7 +15,6 @@
package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.util.function.Function;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -27,7 +26,6 @@ import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenValidatingProfileCon
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
/**
* Base class for profile configurations that validate previously issued OAuth2 tokens.
@@ -42,12 +40,6 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
/** Validation of JWT claims for issued tokens. */
@Nonnull private Function<ProfileRequestContext,ClaimsValidator> issuedClaimsValidatorLookupStrategy;
-
- /**
- * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
- * is the audience must be the issuer identifier of the recipient.
- */
- @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
/**
* Creates a new configuration instance.
@@ -59,7 +51,6 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
issuerLookupStrategy = FunctionSupport.constant(null);
issuedClaimsValidatorLookupStrategy = FunctionSupport.constant(null);
- useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -119,39 +110,4 @@ public class AbstractOAuth2TokenValidatingConfiguration extends AbstractOAuth2Cl
@Nonnull final Function<ProfileRequestContext,ClaimsValidator> strategy) {
issuedClaimsValidatorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
-
- /** {@inheritDoc} */
- @Override
- public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
- }
-
- /**
- * Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
- * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
- *
- * @param condition condition to set.
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudiencePredicate(
- @Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
- "UseTargetedEndpointAsJWTAudience Condition cannot be null");
- }
-
- /**
- * Set a falg to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
- * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
- *
- * @param flag the flag to set
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
index efcedad..4716e45 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
@@ -64,12 +64,6 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
/** Whether initial access token audience is solely to self (i.e. UserInfo) use. */
@Nonnull private Predicate<ProfileRequestContext> limitInitialAccessTokenToSelfPredicate;
-
- /**
- * Should the audience claim of a JWT be targeted to a specific endpoint on the recipient? Defaults to false, that
- * is the audience must be the issuer identifier of the recipient.
- */
- @Nonnull private Predicate<ProfileRequestContext> useTargetedEndpointAsJWTAudiencePredicate;
/**
* Constructor.
@@ -91,7 +85,6 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
enforceRefreshTokenRotationPredicate = PredicateSupport.alwaysFalse();
issueIdTokenViaRefreshTokenPredicate = PredicateSupport.alwaysTrue();
limitInitialAccessTokenToSelfPredicate = PredicateSupport.alwaysFalse();
- useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
@Override
@@ -250,37 +243,4 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
limitInitialAccessTokenToSelfPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
- /** {@inheritDoc} */
- @Override
- public boolean isUseTargetedEndpointAsJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
- return useTargetedEndpointAsJWTAudiencePredicate.test(profileRequestContext);
- }
-
- /**
- * Set a condition to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
- * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
- *
- * @param condition condition to set.
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudiencePredicate(
- @Nonnull final Predicate<ProfileRequestContext> condition) {
- useTargetedEndpointAsJWTAudiencePredicate = Constraint.isNotNull(condition,
- "UseTargetedEndpointAsJWTAudience Condition cannot be null");
- }
-
- /**
- * Set a flag to determine if the audience claim of a JWT should be targeted to a specific endpoint of the
- * recipient? The endpoint value used will differ depending on the context in which the predicate is used. If the
- * condition returns false, the audience value must be fixed to the issuer identifier of the recipient.
- *
- * @param flag the flag to set
- *
- * @since 3.3.0
- */
- public void setUseTargetedEndpointAsJWTAudience(final boolean flag) {
- useTargetedEndpointAsJWTAudiencePredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list