[java-oidc-common] branch dev/JCOMOIDC-139 updated: JCOMOIDC-141 - Add authnContextClassRefLookupStrategy to OIDC SSO RP configuration

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch dev/JCOMOIDC-139
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=d6b872cbc5337a01b6ed42425692e3eabba6a392

The following commit(s) were added to refs/heads/dev/JCOMOIDC-139 by this push:
     new d6b872c  JCOMOIDC-141 - Add authnContextClassRefLookupStrategy to OIDC SSO RP configuration
d6b872c is described below

commit d6b872cbc5337a01b6ed42425692e3eabba6a392
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Oct 3 14:14:23 2025 +0100

    JCOMOIDC-141 - Add authnContextClassRefLookupStrategy to OIDC SSO RP
    configuration
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-141
---
 ...enticationRelyingPartyProfileConfiguration.java | 20 +++++++++
 .../config/impl/AbstractOIDCSSOConfiguration.java  | 47 ++++++++++++++++++++++
 2 files changed, 67 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
index ca37e6d..f08afa9 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationRelyingPartyProfileConfiguration.java
@@ -14,13 +14,20 @@
 
 package net.shibboleth.oidc.profile.config;
 
+import java.util.List;
+
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.profile.context.ProfileRequestContext;
 
+import com.nimbusds.openid.connect.sdk.claims.ACR;
+
 import net.shibboleth.shared.annotation.ConfigurationSetting;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
 /** 
  * Configuration of an OIDC 1.0 authentication request.
@@ -119,5 +126,18 @@ public interface OIDCAuthenticationRelyingPartyProfileConfiguration extends OIDC
       */
     @ConfigurationSetting(name="tlsServerValidationSufficient")
     boolean isTlsServerValidationSufficient(@Nullable final ProfileRequestContext profileRequestContext);
+    
+    /**
+     * Get the {@link ACR} values to include in an OIDC authentication request.
+     * 
+     * @param profileRequestContext current profile request context
+     * 
+     * @return list of class references
+     * 
+     * @since 3.4.0
+     */
+    @ConfigurationSetting(name="authnContextClassRefs")
+    @Nonnull @NonnullElements @NotLive @Unmodifiable List<String> getAuthnContextClassRefs(
+            @Nullable final ProfileRequestContext profileRequestContext);
 
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 0b04194..3c7fdf6 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -17,6 +17,7 @@ package net.shibboleth.oidc.profile.config.impl;
 import java.net.URI;
 import java.time.Duration;
 import java.util.Collection;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.function.BiFunction;
@@ -28,6 +29,9 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.core.AuthnContextClassRef;
+
+import com.nimbusds.openid.connect.sdk.claims.ACR;
 
 import net.shibboleth.oidc.profile.config.OIDCSSOProviderConfiguration;
 import net.shibboleth.oidc.profile.config.OIDCSSORelyingPartyConfiguration;
@@ -36,6 +40,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Positive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.FunctionSupport;
@@ -107,6 +112,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
 
     /** Whether scope validation is strict, i.e. request for unallowed scopes is an error. */
     @Nonnull private Predicate<ProfileRequestContext> strictScopeValidationPredicate;
+    
+    /** Lookup function to supply default authentication methods. */
+    @Nonnull private Function<ProfileRequestContext,Collection<String>> authnContextClassRefLookupStrategy;
 
     /**
      * Creates a new configuration instance.
@@ -139,6 +147,8 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
 
         alwaysIssueBearerAccessTokenPredicate = PredicateSupport.alwaysFalse();
         strictScopeValidationPredicate = PredicateSupport.alwaysFalse();
+        
+        authnContextClassRefLookupStrategy = FunctionSupport.constant(null);
     }
     
     /** {@inheritDoc} */
@@ -702,5 +712,42 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
         strictScopeValidationPredicate = Constraint.isNotNull(condition,
                 "Strict scope validation predicate cannot be null");
     }
+    
+    /**
+     * Set a lookup strategy for the {@link ACR} values to include in an OpenID request.
+     *
+     * @param strategy lookup strategy
+     * 
+     * @since 3.4.0
+     */
+    public void setAuthnContextClassRefsLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
+        authnContextClassRefLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+    }
+
+    /** {@inheritDoc} */
+    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getAuthnContextClassRefs(
+            @Nullable final ProfileRequestContext profileRequestContext) {
+        final Collection<String> refs = authnContextClassRefLookupStrategy.apply(profileRequestContext);
+        if (refs != null) {
+            return CollectionSupport.copyToList(refs);
+        }
+        return CollectionSupport.emptyList();
+    }
+        
+    /**
+     * Set the {@link AuthnContextClassRef} values to include in SAML request.
+     * 
+     * @param contexts default authentication context class references to use
+     * 
+     * @since 3.4.0
+     */
+    public void setAuthnContextClassRefs(@Nullable @NonnullElements final Collection<String> contexts) {
+        if (contexts != null) {
+            authnContextClassRefLookupStrategy = FunctionSupport.constant(CollectionSupport.copyToList(contexts));
+        } else {
+            authnContextClassRefLookupStrategy = FunctionSupport.constant(null);
+        }
+    }
 
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.