[java-plugin-shibd-oidc] branch main updated: Complete the requested claims lookup strategy
Phil Smart
philip.smart at jisc.ac.uk
Tue Oct 14 15:05:46 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-plugin-shibd-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-oidc.git;a=commit;h=ff88b8984f6228a1c8035091af71c2ffad170e2a
The following commit(s) were added to refs/heads/main by this push:
new ff88b89 Complete the requested claims lookup strategy
ff88b89 is described below
commit ff88b8984f6228a1c8035091af71c2ffad170e2a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Oct 14 16:05:44 2025 +0100
Complete the requested claims lookup strategy
- requested claims are taken from the new requestedClaims profile
configuration option
---
.../impl/RequestedClaimsLookupStrategy.java | 25 ++++-
.../impl/RequestedClaimsLookupStrategyTest.java | 110 +++++++++++++++++++++
2 files changed, 133 insertions(+), 2 deletions(-)
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategy.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategy.java
index 11f5cfd..b19c9f3 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategy.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategy.java
@@ -14,14 +14,21 @@
package net.shibboleth.sp.oidc.profile.impl;
+import java.util.Map;
+
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
+import org.slf4j.Logger;
+import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import net.minidev.json.JSONObject;
import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -32,7 +39,12 @@ import net.shibboleth.profile.context.RelyingPartyContext;
* is configured. If so, it returns the corresponding {@link OIDCClaimsRequest}; otherwise, it returns {@code null}.
* </p>
*/
-public class RequestedClaimsLookupStrategy extends AbstractAgentAndRelyingPartyContextLookupFunction<OIDCClaimsRequest> {
+public class RequestedClaimsLookupStrategy
+ extends AbstractAgentAndRelyingPartyContextLookupFunction<OIDCClaimsRequest> {
+
+ /** Logger. */
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(RequestedClaimsLookupStrategy.class);
/** {@inheritDoc} */
@Override
@@ -43,7 +55,16 @@ public class RequestedClaimsLookupStrategy extends AbstractAgentAndRelyingPartyC
if (rpConfig == null) {
return null;
}
- // TODO get this from the config?
+
+ final Map<String,Object> claims = rpConfig.getRequestedClaims(PRC_LOOKUP.apply(messageContext));
+ if (claims != null && !claims.isEmpty()) {
+ try {
+ return OIDCClaimsRequest.parse(new JSONObject(claims));
+ } catch (final ParseException e) {
+ log.warn("Unable to parse requested claims into a JSON Object",e);
+ return null;
+ }
+ }
return null;
}
diff --git a/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategyTest.java b/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategyTest.java
new file mode 100644
index 0000000..67738e5
--- /dev/null
+++ b/sp-oidc-impl/src/test/java/net/shibboleth/sp/oidc/profile/impl/RequestedClaimsLookupStrategyTest.java
@@ -0,0 +1,110 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.oidc.profile.impl;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertNull;
+
+import java.util.Map;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
+
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.sp.ddf.DDF;
+import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
+import net.shibboleth.sp.profile.InitiatorConstants;
+import net.shibboleth.sp.profile.SPConstants;
+
+/**
+ * Tests for the {@link RequestedClaimsLookupStrategy}.
+ */
+public class RequestedClaimsLookupStrategyTest extends AbstractAuthenticationLookupStrategyTest {
+
+ /** The strategy to test.*/
+ private RequestedClaimsLookupStrategy strategy;
+
+ /** The DDF to store input parameters.*/
+ private DDF ddf;
+
+ @Override
+ @BeforeMethod
+ public void setUp() throws ComponentInitializationException {
+ super.setUp();
+ strategy = new RequestedClaimsLookupStrategy();
+
+ ddf = new DDF(null).structure();
+ ddf.addmember(RemotedHttpServletRequest.STRUCTURE_NAME).structure();
+ ddf.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
+ ddf.addmember(SPConstants.TARGET).unsafe_string(RESOURCE_URL);
+ addDDFToAgentRequestContext(ddf);
+ }
+
+ @Test
+ public void testRequestedClaims_AddIdToken() {
+ final Map<String, Object> claimsMap = Map.of("id_token", Map.of("email", Map.of("essential", true)));
+ rpConfig.setRequestedClaimsLookupStrategy(FunctionSupport.constant(claimsMap));
+ final OIDCClaimsRequest result = strategy.apply(mc);
+ assertNotNull(result);
+ assert result != null;
+ assertNotNull(result.getIDTokenClaimsRequest());
+ assertNotNull(result.getIDTokenClaimsRequest().get("email"));
+ assertEquals(result.getIDTokenClaimsRequest().get("email").getClaimRequirement(), ClaimRequirement.ESSENTIAL);
+ }
+
+ @Test
+ public void testRequestedClaims_AddUserInfo() {
+ final Map<String, Object> claimsMap = Map.of("userinfo", Map.of("email", Map.of("essential", true)));
+ rpConfig.setRequestedClaimsLookupStrategy(FunctionSupport.constant(claimsMap));
+ final OIDCClaimsRequest result = strategy.apply(mc);
+ assertNotNull(result);
+ assert result != null;
+ assertNotNull(result.getUserInfoClaimsRequest());
+ assertNotNull(result.getUserInfoClaimsRequest().get("email"));
+ assertEquals(result.getUserInfoClaimsRequest().get("email").getClaimRequirement(), ClaimRequirement.ESSENTIAL);
+ }
+
+ @Test
+ public void testRequestedClaims_AddInvalidClaimRequest() {
+ final Map<String, Object> claimsMap = Map.of("wrong", Map.of("email", Map.of("essential", true)));
+ rpConfig.setRequestedClaimsLookupStrategy(FunctionSupport.constant(claimsMap));
+ final OIDCClaimsRequest result = strategy.apply(mc);
+ assertNotNull(result);
+ assertNull(result.getIDTokenClaimsRequest());
+ assertNull(result.getUserInfoClaimsRequest());
+ }
+
+ @Test
+ public void testRequestedClaims_AddInvalidClaimRequestTwo() {
+ final Map<String, Object> claimsMap = Map.of("invalid", new Object());
+ rpConfig.setRequestedClaimsLookupStrategy(FunctionSupport.constant(claimsMap));
+ final OIDCClaimsRequest result = strategy.apply(mc);
+ assertNotNull(result);
+ assertNull(result.getIDTokenClaimsRequest());
+ assertNull(result.getUserInfoClaimsRequest());
+ }
+
+ @Test
+ public void testRequestedClaims_NullConfig() {
+ rpConfig.setRequestedClaimsLookupStrategy(FunctionSupport.constant(null));
+ final OIDCClaimsRequest result = strategy.apply(mc);
+ assertNull(result);
+ }
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list