[java-plugin-shibd-oidc] branch main updated: WIP: add access and refresh token in opaque session data

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/65dae3eb47f87d1e6cfc169f64a51551289c1a10

The following commit(s) were added to refs/heads/main by this push:
     new 65dae3e  WIP: add access and refresh token in opaque session data
65dae3e is described below

commit 65dae3eb47f87d1e6cfc169f64a51551289c1a10
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Nov 28 15:49:00 2025 +0000

    WIP: add access and refresh token in opaque session data
---
 .../sp/oidc/profile/impl/PrepareAgentResponse.java | 82 +++++++++++++++++++++-
 1 file changed, 81 insertions(+), 1 deletion(-)

diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
index 7379a31..adad921 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/PrepareAgentResponse.java
@@ -14,21 +14,101 @@
 
 package net.shibboleth.sp.oidc.profile.impl;
 
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
+import org.slf4j.Logger;
+
+import com.nimbusds.oauth2.sdk.token.AccessToken;
+import com.nimbusds.oauth2.sdk.token.RefreshToken;
+import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
 
+import net.shibboleth.oidc.profile.context.AccessTokenResponseContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction;
 
 /**
  * OIDC-specific subclass of a token consumer response action.
  * 
+ * <p>Extracts the access token and refresh token from the {@link AccessTokenResponseContext}
+ * and stores them in the session data return to the agent. These tokens can later be retrieved by the
+ * agent when needed—for example, to refresh user profile information via the
+ * UserInfo endpoint. The access token is used if it is still valid; otherwise,
+ * the refresh token is used to obtain a new access token.</p>
+ * 
  * TODO...
  */
 public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
+    
+    /** Class logger. */
+    @Nonnull private final Logger log = LoggerFactory.getLogger(PrepareAgentResponse.class);
+    
+    /** Strategy used to look up the {@link AccessTokenResponseContext} . */
+    @Nonnull private Function<ProfileRequestContext, AccessTokenResponseContext> 
+            accessTokenResponseContextLookupStrategy;
+    
+    /** The stashed token response context. */
+    @NonnullBeforeExec private AccessTokenResponseContext tokenResponseContext;
+    
+    /**
+     * Constructor.
+     */
+    public PrepareAgentResponse() {
+        accessTokenResponseContextLookupStrategy =
+                new ChildContextLookup<>(AccessTokenResponseContext.class).compose(
+                        new InboundMessageContextLookup());
+    }
+    
+    /**
+     * Set the strategy used to look up a {@link AccessTokenResponseContext}.
+     * 
+     * @param strategy lookup strategy
+     */
+    public void setAccessTokenResponseContextLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext, AccessTokenResponseContext> strategy) {
+        checkSetterPreconditions();
+        
+        accessTokenResponseContextLookupStrategy = Constraint.isNotNull(strategy,
+                "TokenResponseContext lookup strategy cannot be null");
+    }
+    
+    
+    /** {@inheritDoc} */
+    @Override
+    protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+        if (!super.doPreExecute(profileRequestContext)) {
+            return false;
+        }
+
+        tokenResponseContext = accessTokenResponseContextLookupStrategy.apply(profileRequestContext);
+        if (tokenResponseContext == null) {
+            log.warn("{} No AccessTokenResponseContext found", getLogPrefix());
+            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+            return false;
+        }
+        
+        return true;
+    }
 
     /** {@inheritDoc} */
     @Override
     protected String getSessionData(final ProfileRequestContext profileRequestContext) {
-        // TODO Auto-generated method stub
+        final OIDCTokenResponse tokenResponse = tokenResponseContext.getTokenResponse();
+        if (tokenResponse != null) {
+            final AccessToken accessToken = tokenResponse.getTokens().getAccessToken();
+            final RefreshToken refreshToken = tokenResponse.getTokens().getRefreshToken();
+            log.debug("{} Storing access and refresh tokens in session data", getLogPrefix());
+            
+            //TODO do this. Into a DDF structure?
+        }
         return null;
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.