[java-idp-oidc] 09/31: JOIDC-222 - Support for OpenID Federation

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch dev/JOIDC-222
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e2c9670967b837ef218e1495443b340260b3363f

commit e2c9670967b837ef218e1495443b340260b3363f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Feb 21 16:03:35 2025 +0200

    JOIDC-222 - Support for OpenID Federation
    
    https://shibboleth.atlassian.net/browse/JOIDC-222
    
    Refactored trust chain resolution:
    - optional pre-selected trust chain (via PAR or authorize-flow) is not fed to the fetching strategy
    - otherwise the cache may solely contain the pre-selected trust chain instead of new possibly shorter chains
---
 .../op/oidfed/profile/impl/ResolveTrustChains.java | 30 +++++++++++++++++-----
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java
index a0463397..a9eacb53 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java
@@ -20,6 +20,7 @@ import java.net.URL;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.function.BiFunction;
 import java.util.function.Function;
 
@@ -39,15 +40,16 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
 
 import net.minidev.json.JSONObject;
 import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.DefaultClientMetadataFromTrustChainLookupStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.PreSelectedTrustChainCriterion;
 import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubjectEntityIDCriterion;
 import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultPreSelectedTrustChainIDsLookupStrategy;
+import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustChainIDsLookupStrategy;
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.oidc.metadata.cache.MetadataCache;
 import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
 import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -94,6 +96,9 @@ public class ResolveTrustChains extends AbstractProfileAction {
     /** Strategy used to fetch the pre-selected trust chain entity IDs. */
     @Nonnull private Function<ProfileRequestContext, List<String>> preSelectedTrustChainIdsLookupStrategy;
 
+    /** Strategy used to get entity IDs from a trust chain. */
+    @Nonnull private Function<List<EntityStatement>, List<String>> trustChainIDsLookupStrategy;
+
     /** OAuth2 client id. */
     @NonnullBeforeExec private String clientId;
 
@@ -108,6 +113,7 @@ public class ResolveTrustChains extends AbstractProfileAction {
         trustChainContextCreationStrategy = tccs;
         metadataLookupStrategy = new DefaultClientMetadataFromTrustChainLookupStrategy();
         preSelectedTrustChainIdsLookupStrategy = new DefaultPreSelectedTrustChainIDsLookupStrategy();
+        trustChainIDsLookupStrategy = new DefaultTrustChainIDsLookupStrategy();
     }
 
     /**
@@ -177,6 +183,16 @@ public class ResolveTrustChains extends AbstractProfileAction {
                 "PreSelectedTrustChainIdsLookupStrategy cannot be null");
     }
 
+    /**
+     * Set the strategy used to get entity IDs from a trust chain.
+     * 
+     * @param strategy lookup strategy
+     */
+    public void setTrustChainIDsLookupStrategy(@Nonnull final Function<List<EntityStatement>, List<String>> strategy) {
+        checkSetterPreconditions();
+        trustChainIDsLookupStrategy = Constraint.isNotNull(strategy, "TrustChainIDsLookupStrategy cannot be null");
+    }
+
     /** {@inheritDoc} */
     @Override
     protected void doInitialize() throws ComponentInitializationException {
@@ -222,11 +238,6 @@ public class ResolveTrustChains extends AbstractProfileAction {
         log.debug("{} Resolving trust chain for {}", getLogPrefix(), clientId);
         assert clientId != null;
         final CriteriaSet criteriaSet = new CriteriaSet(new SubjectEntityIDCriterion(clientId));
-        final List<String> preSelectedChain = preSelectedTrustChainIdsLookupStrategy.apply(profileRequestContext);
-        if (preSelectedChain != null && !preSelectedChain.isEmpty()) {
-            log.debug("{} Trust chain has been pre-selected: {}", getLogPrefix(), preSelectedChain);
-            criteriaSet.add(new PreSelectedTrustChainCriterion(preSelectedChain));
-        }
         final List<List<List<EntityStatement>>> cacheResult;
         try {
             cacheResult = trustChainCache.get(criteriaSet);
@@ -238,6 +249,9 @@ public class ResolveTrustChains extends AbstractProfileAction {
             log.debug("{} No trust chains resolved for {}", getLogPrefix(), clientId);
             return;
         }
+        final List<String> preSelectedChain =
+                Optional.ofNullable(preSelectedTrustChainIdsLookupStrategy.apply(profileRequestContext))
+                .orElse(CollectionSupport.emptyList());
 
         final RelyingPartyTrustChainContext trustChainContext =
                 trustChainContextCreationStrategy.apply(profileRequestContext);
@@ -245,6 +259,10 @@ public class ResolveTrustChains extends AbstractProfileAction {
         final List<Pair<List<EntityStatement>, OIDCClientInformation>> policyCompliantChains = new ArrayList<>();
 
         for (final List<EntityStatement> chain : cacheResult.get(0)) {
+            if (!preSelectedChain.isEmpty() && !preSelectedChain.equals(trustChainIDsLookupStrategy.apply(chain))) {
+                log.debug("{} Ignored resolved trust chain that doesn't match with preselected chain", getLogPrefix());
+                continue;
+            }
             final Map<String, MetadataPolicy> mergedPolicies =
                     metadataPolicyMergingStrategy.apply(chain, EntityType.OPENID_RELYING_PARTY.getValue());
             log.debug("{} Merged policy for chain {}", getLogPrefix(), mergedPolicies);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.