[java-idp-oidc] branch main updated: JOIDC-243 - Wire audit extractor for destination URL
Henri Mikkonen
henri.mikkonen at iki.fi
Thu Jun 12 08:30:42 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=004a29a9e10deef8f9bc4e565f6705c2252b0d18
The following commit(s) were added to refs/heads/main by this push:
new 004a29a9 JOIDC-243 - Wire audit extractor for destination URL
004a29a9 is described below
commit 004a29a9e10deef8f9bc4e565f6705c2252b0d18
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Jun 12 11:30:19 2025 +0300
JOIDC-243 - Wire audit extractor for destination URL
https://shibboleth.atlassian.net/browse/JOIDC-243
- Add audit extractors for payload claims 'iss', 'sub', 'exp', and 'iat', and for the 'typ' -header.
---
...thenticationJWTPayloadClaimsAuditExtractor.java | 10 +++++++-
...AuthenticationJWTTypeHeaderAuditExtractor.java} | 30 +++++-----------------
.../authn/OAuth2Client/OAuth2Client-beans.xml | 19 ++++++++++++++
.../net/shibboleth/idp/module/conf/oidc.properties | 2 ++
4 files changed, 37 insertions(+), 24 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTPayloadClaimsAuditExtractor.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTPayloadClaimsAuditExtractor.java
index 1e320e26..cfa7a0b1 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTPayloadClaimsAuditExtractor.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTPayloadClaimsAuditExtractor.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.oidc.op.authn.audit.impl;
import java.text.ParseException;
+import java.util.Date;
import java.util.Optional;
import java.util.function.Function;
@@ -82,7 +83,14 @@ public class ClientAuthenticationJWTPayloadClaimsAuditExtractor implements Funct
.map(jwtAuthentication -> jwtAuthentication.getClientAssertion())
.orElse(null);
try {
- return jwt == null ? null : (String) jwt.getJWTClaimsSet().getClaim(key);
+ final Object claim = jwt == null ? null : jwt.getJWTClaimsSet().getClaim(key);
+ if (claim instanceof Date date) {
+ return date.toInstant().toString();
+ } else if (claim != null) {
+ return claim.toString();
+ } else {
+ return null;
+ }
} catch (final ParseException e) {
return null;
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTPayloadClaimsAuditExtractor.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTTypeHeaderAuditExtractor.java
similarity index 68%
copy from idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTPayloadClaimsAuditExtractor.java
copy to idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTTypeHeaderAuditExtractor.java
index 1e320e26..11436813 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTPayloadClaimsAuditExtractor.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/audit/impl/ClientAuthenticationJWTTypeHeaderAuditExtractor.java
@@ -14,7 +14,6 @@
package net.shibboleth.idp.plugin.oidc.op.authn.audit.impl;
-import java.text.ParseException;
import java.util.Optional;
import java.util.function.Function;
@@ -24,32 +23,23 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.auth.JWTAuthentication;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext;
import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
-/** {@link Function} that returns the desired claim from the client authentication JWT payload. */
-public class ClientAuthenticationJWTPayloadClaimsAuditExtractor implements Function<ProfileRequestContext, String> {
+/** {@link Function} that returns the type header from the client authentication JWT payload. */
+public class ClientAuthenticationJWTTypeHeaderAuditExtractor implements Function<ProfileRequestContext, String> {
/** Strategy that will return {@link OAuth2ClientAuthenticationContext}. */
@Nonnull private Function<ProfileRequestContext,OAuth2ClientAuthenticationContext> clientAuthContextLookupStrategy;
- /** The claim whose value is to be extracted. */
- @Nonnull @NotEmpty private final String key;
-
/**
* Constructor.
- *
- * @param claim Claim whose value is to be extracted
*/
- public ClientAuthenticationJWTPayloadClaimsAuditExtractor(
- @Nonnull @NotEmpty @ParameterName(name = "key") final String claim) {
- key = Constraint.isNotEmpty(claim, "The claim cannot be empty");
+ public ClientAuthenticationJWTTypeHeaderAuditExtractor() {
// PRC -> AuthenticationContext -> OAuth2ClientAuthenticationContext
final Function<ProfileRequestContext,OAuth2ClientAuthenticationContext> cacls =
new ChildContextLookup<>(OAuth2ClientAuthenticationContext.class).compose(
@@ -61,31 +51,25 @@ public class ClientAuthenticationJWTPayloadClaimsAuditExtractor implements Funct
/**
* Constructor.
*
- * @param claim Claim whose value is to be extracted
* @param lookupStrategy Strategy that will return {@link OAuth2ClientAuthenticationContext}.
*/
- public ClientAuthenticationJWTPayloadClaimsAuditExtractor(
- @Nonnull @NotEmpty @ParameterName(name = "key") final String claim,
+ public ClientAuthenticationJWTTypeHeaderAuditExtractor(
@Nonnull @ParameterName(name = "clientAuthContextLookupStrategy")
final Function<ProfileRequestContext,OAuth2ClientAuthenticationContext> lookupStrategy) {
- key = Constraint.isNotEmpty(claim, "key cannot be empty");
clientAuthContextLookupStrategy =
Constraint.isNotNull(lookupStrategy, "clientAuthContextLookupStrategy lookup strategy cannot be null");
}
/** {@inheritDoc} */
@Nullable public String apply(@Nullable final ProfileRequestContext input) {
- final SignedJWT jwt = Optional.ofNullable(clientAuthContextLookupStrategy.apply(input))
+ return Optional.ofNullable(clientAuthContextLookupStrategy.apply(input))
.map(ctx -> ctx.getClientAuthentication())
.filter(JWTAuthentication.class::isInstance)
.map(JWTAuthentication.class::cast)
.map(jwtAuthentication -> jwtAuthentication.getClientAssertion())
+ .map(jwt -> jwt.getHeader().getType())
+ .map(joseType -> joseType.getType())
.orElse(null);
- try {
- return jwt == null ? null : (String) jwt.getJWTClaimsSet().getClaim(key);
- } catch (final ParseException e) {
- return null;
- }
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
index 5f4dd7b2..cd0b41ec 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OAuth2Client/OAuth2Client-beans.xml
@@ -266,6 +266,25 @@
<bean class="net.shibboleth.idp.plugin.oidc.op.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
c:key="aud" />
</entry>
+ <entry key="iss">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="iss" />
+ </entry>
+ <entry key="sub">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="sub" />
+ </entry>
+ <entry key="exp">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="exp" />
+ </entry>
+ <entry key="iat">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.authn.audit.impl.ClientAuthenticationJWTPayloadClaimsAuditExtractor"
+ c:key="iat" />
+ </entry>
+ <entry key="typ">
+ <bean class="net.shibboleth.idp.plugin.oidc.op.authn.audit.impl.ClientAuthenticationJWTTypeHeaderAuditExtractor" />
+ </entry>
</map>
</property>
</bean>
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
index 9e568450..21d2f5d7 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/oidc.properties
@@ -31,3 +31,5 @@ idp.authn.Password.supportedPrincipals = \
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
saml1/urn:oasis:names:tc:SAML:1.0:am:password, \
oidc/password
+
+idp.authn.OAuth2Client.audit.format = %a|%T|%SP|%I|%s|%AF|%CV|%u|%tu|%AR|%UA|%iss|%sub|%exp|%iat|%typ
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list