[java-oidc-common] branch dev/JCOMOIDC-139 updated: JCOMOIDC-138 - Add RequestedClaims to the RelyingParty profile configuration

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch dev/JCOMOIDC-139
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=e8602f981653ce24a0db4f8d5d3a7a6b285ec1c1

The following commit(s) were added to refs/heads/dev/JCOMOIDC-139 by this push:
     new e8602f9  JCOMOIDC-138 - Add RequestedClaims to the RelyingParty profile configuration
e8602f9 is described below

commit e8602f981653ce24a0db4f8d5d3a7a6b285ec1c1
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Oct 14 14:56:00 2025 +0100

    JCOMOIDC-138 - Add RequestedClaims to the RelyingParty profile
    configuration
    
     - Add getRequestedClaims to OIDCAuthenticationProfileConfiguration
     - Add requestedClaims lookup strategy implementation to
    DefaultOIDCAuthorizationConfiguration
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-138
---
 .../OIDCAuthenticationProfileConfiguration.java    | 22 ++++++++++++++--
 .../DefaultOIDCAuthorizationConfiguration.java     | 29 ++++++++++++++++++++++
 2 files changed, 49 insertions(+), 2 deletions(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
index 8f2b807..538c206 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
@@ -17,6 +17,7 @@ package net.shibboleth.oidc.profile.config;
 import java.security.Principal;
 import java.time.Duration;
 import java.util.Collection;
+import java.util.Map;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
@@ -26,7 +27,10 @@ import org.opensaml.profile.context.ProfileRequestContext;
 
 import net.shibboleth.oidc.profile.oauth2.config.OAuth2AuthorizationProfileConfiguration;
 import net.shibboleth.shared.annotation.ConfigurationSetting;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
 /** Generic configuration for an OIDC 1.0 authentication request.*/
 public interface OIDCAuthenticationProfileConfiguration extends OAuth2AuthorizationProfileConfiguration {
@@ -95,7 +99,7 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
      */
     @ConfigurationSetting(name="maxAuthenticationAge")
     @Nullable
-    public Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext);
+    Duration getMaxAuthenticationAge(@Nullable final ProfileRequestContext profileRequestContext);
     
     /**
      * Get the display parameter to use.
@@ -107,7 +111,21 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
      */
     @ConfigurationSetting(name="display")
     @Nullable
-    public String getDisplay(@Nullable final ProfileRequestContext profileRequestContext);
+    String getDisplay(@Nullable final ProfileRequestContext profileRequestContext);
+    
+    
+    /**
+     * Get the requested individual claims to set onto the authentication request.
+     * 
+     * @param profileRequestContext profile request context
+     * 
+     * @return the claims parameter to set on the authentication request.
+     * 
+     * @since 3.4.0
+     */
+    @ConfigurationSetting(name="requestedClaims")
+    @Nullable @NonnullElements @Unmodifiable @NotLive 
+    Map<String,Object> getRequestedClaims(@Nullable final ProfileRequestContext profileRequestContext);
        
 
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 8dda59c..fe18e38 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -158,6 +158,11 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
      * being requested.
      */
     @Nonnull private Function<ProfileRequestContext, List<String>> resourceIndicatorsLookupStrategy;
+    
+    /**
+     * Lookup function to supply a JSON map of requested claims.
+     */
+    @Nonnull private Function<ProfileRequestContext, Map<String, Object>> requestedClaimsLookupStrategy;
 
     /**
      * Constructor.
@@ -204,6 +209,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
         requireDpopJktPredicate = PredicateSupport.alwaysFalse();
         requirePushedAuthorizationRequestPredicate = PredicateSupport.alwaysFalse();
         resourceIndicatorsLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
+        requestedClaimsLookupStrategy =  FunctionSupport.constant(null);
     }
 
     /** {@inheritDoc} */
@@ -1132,4 +1138,27 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
                     List.copyOf(StringSupport.normalizeStringCollection(resourceIndicators)));
         }
     }
+
+    /** {@inheritDoc} */
+    @Override
+    public Map<String, Object> getRequestedClaims(final ProfileRequestContext profileRequestContext) {
+        final Map<String, Object> requestedClaims = requestedClaimsLookupStrategy.apply(profileRequestContext);
+        if (requestedClaims != null) {
+            return CollectionSupport.copyToMap(requestedClaims);
+        }
+        return CollectionSupport.emptyMap();
+    }
+    
+    /**
+     * Set the lookup strategy used to find the requested claims related to an authentication request. 
+     * 
+     * @param strategy The requestedClaimsLookupStrategy to set.
+     * 
+     * @since 3.4.0
+     */
+    public void setRequestedClaimsLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext, Map<String, Object>> strategy) {
+        requestedClaimsLookupStrategy = Constraint.isNotNull(strategy,
+                "requestedClaimsLookupStrategy can not be null");
+    }
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.