[java-oidc-common] branch main updated: JSHIBDOIDC-6 - Add back PKCE support

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/c709fa4ad121d5b92615c74f067a7a5f33ef1764

The following commit(s) were added to refs/heads/main by this push:
     new c709fa4a JSHIBDOIDC-6 - Add back PKCE support
c709fa4a is described below

commit c709fa4ad121d5b92615c74f067a7a5f33ef1764
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Apr 16 17:25:59 2026 +0100

    JSHIBDOIDC-6 - Add back PKCE support
    
         - Add back PKCE support to the token request encoder
    
    https://shibboleth.atlassian.net/browse/JSHIBDOIDC-6
---
 .../encoding/impl/AuthCodeTokenRequestEncoder.java | 33 ++++++++++++++--------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java
index f39e8393..f9475f19 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java
@@ -31,6 +31,7 @@ import com.nimbusds.oauth2.sdk.AuthorizationCodeGrant;
 import com.nimbusds.oauth2.sdk.AuthorizationGrant;
 import com.nimbusds.oauth2.sdk.TokenRequest;
 import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import com.nimbusds.oauth2.sdk.pkce.CodeVerifier;
 import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
 import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
 
@@ -48,6 +49,9 @@ public class AuthCodeTokenRequestEncoder extends AbstractRequestEncoderFunction
     /** Class logger. */
     @Nonnull
     private final Logger log = LoggerFactory.getLogger(AuthCodeTokenRequestEncoder.class);
+
+    /** The lookup strategy to pull out the PKCE code_verifier to send in the token request.*/
+    @Nonnull private Function<ProfileRequestContext, String> pkceCodeVerifierLookupStrategy;
     
    /** 
     * The strategy used to look up the redirect URI to use in the token request. This will typically be the same 
@@ -59,12 +63,13 @@ public class AuthCodeTokenRequestEncoder extends AbstractRequestEncoderFunction
     public AuthCodeTokenRequestEncoder() {
         super();
         redirectUriLookupStrategy = FunctionSupport.constant(null);
+        pkceCodeVerifierLookupStrategy = FunctionSupport.constant(null);
     }
     
     /**
      * Set the strategy used to look up the redirect URI to use in the token request. This will typically be the same 
      * URI used in the authorization request, but may be overridden if necessary. If not set, no redirect URI will be 
-     * included in the token request which may result in an error on the OpenID Provider.
+     * included in the token request which may result in an error at the OpenID Provider.
      * 
      * @param strategy The RedirectUriLookupStrategy to set.
      */
@@ -73,6 +78,18 @@ public class AuthCodeTokenRequestEncoder extends AbstractRequestEncoderFunction
                 "RedirectUriLookupStrategy can not be null");
     }
     
+    /**
+     * Set the strategy used to look up the PKCE code_verifier to send in the token request.
+     * 
+     * @param strategy The PKCE lookup strategy to set.
+     */
+    public void setPkceCodeVerifierLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext, String> strategy) {
+        checkSetterPreconditions();
+        pkceCodeVerifierLookupStrategy = Constraint.isNotNull(strategy,
+                "PKCE code verifier lookup strategy can not be null");
+    }
+    
     @Override
     @Nullable public ClassicHttpRequest doApply(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final OIDCProviderMetadata providerMetadata) {
@@ -88,20 +105,14 @@ public class AuthCodeTokenRequestEncoder extends AbstractRequestEncoderFunction
                 log.warn("No authentication response from upstream OpenID Provider to base token request off");
                 return null;
             }
-           // final var authnRequest = getAuthenticationRequest();
-           // if (authnRequest == null) {
-            //    log.warn("No authentication request to base token request off");
-            //    return null;
-            //}
-            
+
             final URI redirectUri = redirectUriLookupStrategy.apply(profileRequestContext);
+            final String pkceCodeVerifier = pkceCodeVerifierLookupStrategy.apply(profileRequestContext);
             
-            // TODO finish this encoder!
             // If PKCE was set in the request (is not null) use it, else set it to null
             final AuthorizationGrant codeGrant =
-                    new AuthorizationCodeGrant(authnResponse.getAuthorizationCode(),redirectUri);  
-                           // authnRequest.getCodeVerifier() != null ? new CodeVerifier(authnRequest.getCodeVerifier()) 
-                            //        : null);
+                    new AuthorizationCodeGrant(authnResponse.getAuthorizationCode(),redirectUri,  
+                            pkceCodeVerifier != null ? new CodeVerifier(pkceCodeVerifier) : null);
             
             final TokenRequest tokenRequest = new TokenRequest(providerMetadata.getTokenEndpointURI(),
                             authnContext.getClientAuthentication(), codeGrant);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.