[java-idp-oidc] 01/02: JOIDC-243 - Wire audit extractor for destination URL

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=39810c52fbec2d98ce7b1068dbdda6fc88fec7c2

commit 39810c52fbec2d98ce7b1068dbdda6fc88fec7c2
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Jun 10 09:48:11 2025 +0300

    JOIDC-243 - Wire audit extractor for destination URL
    
    https://shibboleth.atlassian.net/browse/JOIDC-243
    
    New ValidatedRedirectUriAuditExtractor is wired to '%DEST'.
    It extracts the value whenever it's populated in the OIDCAuthenticationContext.redirectUri: including PAR and token in addition to the authorize flow.
---
 .../impl/ValidatedRedirectUriAuditExtractor.java   | 65 ++++++++++++++++++++++
 .../META-INF/net.shibboleth.idp/postconfig.xml     |  6 ++
 2 files changed, 71 insertions(+)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/ValidatedRedirectUriAuditExtractor.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/ValidatedRedirectUriAuditExtractor.java
new file mode 100644
index 00000000..195eda0c
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/ValidatedRedirectUriAuditExtractor.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.audit.impl;
+
+import java.util.Optional;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
+import net.shibboleth.shared.logic.Constraint;
+
+/**
+ * Looks up the validated redirect URI value from the OIDC authentication response context.
+ */
+public class ValidatedRedirectUriAuditExtractor implements Function<ProfileRequestContext, String> {
+    
+    /** Lookup strategy for the context to find the subject value from. */
+    @Nonnull
+    private final Function<ProfileRequestContext, OIDCAuthenticationResponseContext> ctxLookupStrategy;
+
+    /**
+     * Constructor.
+     */
+    public ValidatedRedirectUriAuditExtractor() {
+        this(new OIDCAuthenticationResponseContextLookupFunction());
+    }
+
+    /**
+     * Constructor.
+     *
+     * @param strategy lookup strategy for message
+     */
+    public ValidatedRedirectUriAuditExtractor(
+            @Nonnull final Function<ProfileRequestContext, OIDCAuthenticationResponseContext> strategy) {
+        ctxLookupStrategy =
+                Constraint.isNotNull(strategy, "OIDC authentication response context lookup strategy cannot be null");
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    @Nullable
+    public String apply(@Nullable final ProfileRequestContext input) {
+        return Optional.ofNullable(ctxLookupStrategy.apply(input))
+                .map(ctx -> ctx.getRedirectURI())
+                .map(uri -> uri.toString())
+                .orElse(null);
+    }
+}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index f031dd2d..532f73f7 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -537,6 +537,12 @@
                     </key>
                     <bean class="net.shibboleth.oidc.profile.audit.impl.OutboundMessageClassLookupFunction" />
                 </entry>
+                <entry>
+                    <key>
+                        <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.DESTINATION_URL"/>
+                    </key>
+                    <bean class="net.shibboleth.idp.plugin.oidc.op.audit.impl.ValidatedRedirectUriAuditExtractor" />
+                </entry>
             </map>
         </property>
     </bean>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.