[java-oidc-common] branch main updated: JCOMOIDC-134 - Add profile option for requiring single audience value in JWT authentication
Henri Mikkonen
henri.mikkonen at iki.fi
Mon Jun 16 13:41:21 UTC 2025
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=dc71ff47edb9dcf62b3256497db835c08e2e8252
The following commit(s) were added to refs/heads/main by this push:
new dc71ff4 JCOMOIDC-134 - Add profile option for requiring single audience value in JWT authentication
dc71ff4 is described below
commit dc71ff47edb9dcf62b3256497db835c08e2e8252
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Jun 16 16:41:03 2025 +0300
JCOMOIDC-134 - Add profile option for requiring single audience value in JWT authentication
https://shibboleth.atlassian.net/browse/JCOMOIDC-134
- New profile configuration setting 'requireSingleJWTAudience' in OAuth2ClientAuthenticableClientProfileConfiguration
- Implemented in AbstractOAuth2ClientAuthenticableProfileConfiguration, defaults to false
- Added configurable condition to AudienceClaimsValidator in addition to the flag
---
.../jwt/claims/impl/AudienceClaimsValidator.java | 35 ++++++++--
.../claims/impl/AudienceClaimsValidatorTest.java | 80 ++++++++++++++++++++--
.../RequireSingleJWTAudienceLookupFunction.java | 53 ++++++++++++++
...entAuthenticableClientProfileConfiguration.java | 15 +++-
...th2ClientAuthenticableProfileConfiguration.java | 40 +++++++++++
5 files changed, 208 insertions(+), 15 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
index 01309e3..eae605a 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
@@ -18,8 +18,10 @@ import java.util.List;
import java.util.Objects;
import java.util.Set;
import java.util.function.BiFunction;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -58,7 +60,13 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
* Defaults to {@literal false}.
*/
private boolean extraAudienceValidation;
-
+
+ /**
+ * Optional condition for {{@link #extraAudienceValidation}. If it returns true, any extra audience must be
+ * contained in the List returned from the additionalAudiencesLookupStrategy.
+ */
+ @Nullable private Predicate<ProfileRequestContext> extraAudienceValidationCondition;
+
/** Constructor. */
public AudienceClaimsValidator() {
additionalAudiencesLookupStrategy = (prc, claims) -> CollectionSupport.emptySet();
@@ -82,7 +90,7 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
*/
public void setAudienceLookupStrategy(
@Nonnull final BiFunction<ProfileRequestContext,JWTClaimsSet, String> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
+ checkSetterPreconditions();
audienceLookupStrategy = Constraint.isNotNull(strategy, "Audience lookup strategy can not be null");
}
@@ -96,8 +104,7 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
*/
public void setAdditionalAudiencesLookupStrategy(
@Nonnull final BiFunction<ProfileRequestContext, JWTClaimsSet, Set<String>> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
- ifDestroyedThrowDestroyedComponentException();
+ checkSetterPreconditions();
additionalAudiencesLookupStrategy = Constraint.isNotNull(strategy,
"Additional audiences lookup strategy can not be null");
@@ -126,12 +133,25 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
* @since 2.2.0
*/
public void setExtraAudienceValidation(final boolean flag) {
- ifInitializedThrowUnmodifiabledComponentException();
- ifDestroyedThrowDestroyedComponentException();
+ checkSetterPreconditions();
extraAudienceValidation = flag;
}
+ /**
+ * Set condition whether to enable extra audience validation. If set to null, solely rely on
+ * {@link #extraAudienceValidation}. If condition is set, OR-operator is exploited.
+ *
+ * @param condition the condition to set
+ *
+ * @since 3.3.0
+ */
+ public void setExtraAudienceValidationCondition(@Nullable final Predicate<ProfileRequestContext> condition) {
+ checkSetterPreconditions();
+
+ extraAudienceValidationCondition = condition;
+ }
+
/**
* Resolve the set of accepted audiences. This method is mostly a hook for classes extending this validator: in
* this case it simply returns the resolved single accepted audience in the set.
@@ -186,7 +206,8 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
// If there is more than one audience and validation is enabled, we must have these listed
// explicitly in additionalAudiences.
- if (audListFiltered.size() > 1 && extraAudienceValidation) {
+ if (audListFiltered.size() > 1 && (extraAudienceValidation ||
+ (extraAudienceValidationCondition != null && extraAudienceValidationCondition.test(context)))) {
// Remove the accepted audience
final List<String> audListFilteredWithoutAcceptedAud =
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidatorTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidatorTest.java
index ad615ef..238626e 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidatorTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidatorTest.java
@@ -109,7 +109,20 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
validator.initialize();
validator.validate(claimsSet, prc);
}
-
+
+ @Test
+ public void doValidTest_NoAudienceAllowCondition()
+ throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet =
+ new JWTClaimsSet.Builder().build();
+ validator.setId("test-validator");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id");
+ validator.setExtraAudienceValidationCondition(prc -> true);
+ validator.setAllowMissing(true);
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
@Test(expectedExceptions = JWTValidationException.class)
public void doValidTest_NoAudienceDisallow()
throws JWTValidationException, ComponentInitializationException {
@@ -151,6 +164,20 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
validator.validate(claimsSet, prc);
}
+ @Test
+ public void doValidTest_AdditionalAudiencesConditionNotInToken()
+ throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet =
+ new JWTClaimsSet.Builder().audience("client-id").build();
+ validator.setId("test-validator");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id");
+ // Token only contains one audience, so this is not going to be checked
+ validator.setAdditionalAudiencesLookupStrategy((prc, claims)-> Set.of("additional-client-1"));
+ validator.setExtraAudienceValidationCondition(prc -> true);
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
@Test
public void doValidTest_AdditionalAudiencesFound()
@@ -166,7 +193,22 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
validator.initialize();
validator.validate(claimsSet, prc);
}
-
+
+ @Test
+ public void doValidTest_AdditionalAudiencesConditionFound()
+ throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet =
+ new JWTClaimsSet.Builder().audience(
+ List.of("client-id","additional-client-1","additional-client-2")).build();
+ validator.setId("test-validator");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id");
+ validator.setAdditionalAudiencesLookupStrategy(
+ (prc, claims)-> Set.of("additional-client-1", "additional-client-2"));
+ validator.setExtraAudienceValidationCondition(prc -> true);
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
@Test(expectedExceptions = JWTValidationException.class)
public void doValidTest_AdditionalAudiencesFound_AcceptedAudienceNotFound()
throws JWTValidationException, ComponentInitializationException {
@@ -181,7 +223,22 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
validator.initialize();
validator.validate(claimsSet, prc);
}
-
+
+ @Test(expectedExceptions = JWTValidationException.class)
+ public void doValidTest_AdditionalAudiencesConditionFound_AcceptedAudienceNotFound()
+ throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet =
+ new JWTClaimsSet.Builder().audience(
+ List.of("client-id","additional-client-1","additional-client-2")).build();
+ validator.setId("test-validator");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id-not-found");
+ validator.setAdditionalAudiencesLookupStrategy(
+ (prc, claims)-> Set.of("additional-client-1", "additional-client-2"));
+ validator.setExtraAudienceValidationCondition(prc -> true);
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
+
@Test(expectedExceptions = JWTValidationException.class)
public void doRejectedTest_NullAudienceInContext()
throws JWTValidationException, ComponentInitializationException {
@@ -192,7 +249,7 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
validator.initialize();
validator.validate(claimsSet, prc);
}
-
+
@Test(expectedExceptions = JWTValidationException.class)
public void doRejectedTest_NullAudienceInJWT()
throws JWTValidationException, ComponentInitializationException {
@@ -217,7 +274,16 @@ public class AudienceClaimsValidatorTest extends AbstractClaimsValidatorTest {
validator.validate(claimsSet, prc);
}
-
-
-
+ @Test
+ public void doValidTest_AdditionalAudiencesConditionNotChecked()
+ throws JWTValidationException, ComponentInitializationException {
+ final JWTClaimsSet claimsSet =
+ new JWTClaimsSet.Builder().audience(
+ List.of("client-id","additional-client-1","additional-client-2")).build();
+ validator.setId("test-validator");
+ validator.setAudienceLookupStrategy((prc,claims) -> "client-id");
+ validator.setExtraAudienceValidationCondition(prc -> false);
+ validator.initialize();
+ validator.validate(claimsSet, prc);
+ }
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RequireSingleJWTAudienceLookupFunction.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RequireSingleJWTAudienceLookupFunction.java
new file mode 100644
index 0000000..0925895
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/navigate/RequireSingleJWTAudienceLookupFunction.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.config.navigate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
+
+/**
+ * A predicate that returns
+ * {@link OAuth2ClientAuthenticableClientProfileConfiguration#isRequireSingleJWTAudience(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function, by default a child
+ * of the {@link ProfileRequestContext}.
+ *
+ * <p>
+ * If a specific setting is unavailable, a false value is returned.
+ * </p>
+ *
+ * @since 3.3.0
+ */
+public class RequireSingleJWTAudienceLookupFunction extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof OAuth2ClientAuthenticableClientProfileConfiguration ocacpc) {
+ return ocacpc.isRequireSingleJWTAudience(input);
+ }
+ }
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
index cc9e33d..af28126 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ClientAuthenticableClientProfileConfiguration.java
@@ -78,7 +78,7 @@ public interface OAuth2ClientAuthenticableClientProfileConfiguration
*
* @param profileRequestContext the profile request context
*
- * @return true if the audience claim should use a targeted endpoint of the recipient, false if the the audience
+ * @return true if the audience claim should use a targeted endpoint of the recipient, false if the audience
* value must be the issuer identifier of the recipient
*
* @since 3.3.0
@@ -99,4 +99,17 @@ public interface OAuth2ClientAuthenticableClientProfileConfiguration
@Nullable @NotEmpty String getClientAuthenticationJWTType(
@Nullable final ProfileRequestContext profileRequestContext);
+ /**
+ * Get whether single audience value is required in the JWT audience claim. Otherwise the claim can be a list of
+ * values.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return true if single audience value is required, false if multiple values are allowed
+ *
+ * @since 3.3.0
+ */
+ @ConfigurationSetting(name="requireSingleJWTAudience")
+ boolean isRequireSingleJWTAudience(@Nullable final ProfileRequestContext profileRequestContext);
+
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
index 09ccb87..53ba9b3 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/AbstractOAuth2ClientAuthenticableProfileConfiguration.java
@@ -110,6 +110,11 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
/** Lookup function to determine the 'typ' header parameter value for a client authentication JWT.*/
@Nonnull private Function<ProfileRequestContext,String> clientAuthenticationJWTTypeLookupStrategy;
+ /**
+ * Whether single audience value is required in the JWT audience claim.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> requireSingleJWTAudiencePredicate;
+
/**
* Constructor.
*
@@ -141,6 +146,7 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
dpopProofNonceGeneratorLookupStrategy = FunctionSupport.constant(null);
useTargetedEndpointAsJWTAudiencePredicate = PredicateSupport.alwaysTrue();
clientAuthenticationJWTTypeLookupStrategy = FunctionSupport.constant(null);
+ requireSingleJWTAudiencePredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -694,4 +700,38 @@ public abstract class AbstractOAuth2ClientAuthenticableProfileConfiguration
public void setClientAuthenticationJWTType(@Nullable final String type) {
clientAuthenticationJWTTypeLookupStrategy = FunctionSupport.constant(type);
}
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isRequireSingleJWTAudience(@Nullable final ProfileRequestContext profileRequestContext) {
+ return requireSingleJWTAudiencePredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set a condition whether single audience value is required in the JWT audience claim. Otherwise the claim can be
+ * a list of values.
+ *
+ * @param condition condition to set.
+ *
+ * @since 3.3.0
+ */
+ public void setRequireSingleJWTAudiencePredicate(
+ @Nonnull final Predicate<ProfileRequestContext> condition) {
+ requireSingleJWTAudiencePredicate = Constraint.isNotNull(condition,
+ "RequireSingleJWTAudiencePredicate Condition cannot be null");
+ }
+
+ /**
+ * Set a flag whether single audience value is required in the JWT audience claim. Otherwise the claim can be a list
+ * of values.
+ *
+ * @param flag the flag to set
+ *
+ * @since 3.3.0
+ */
+ public void setRequireSingleJWTAudience(final boolean flag) {
+ requireSingleJWTAudiencePredicate =
+ flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list