[java-oidc-common] 02/20: JCOMOIDC-142 - Add a Resource Indicator configuration setting
Codeberg
noreply at shibboleth.net
Tue Feb 17 20:14:37 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/JCOMOIDC-139
in repository java-oidc-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/6c2d7d91dcd7c2762b3e4b319d00e839d54f309f
commit 6c2d7d91dcd7c2762b3e4b319d00e839d54f309f
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Oct 10 16:54:34 2025 +0100
JCOMOIDC-142 - Add a Resource Indicator configuration setting
- Add new resource indicator profile interface
- Add new resource indicator interface implementation
- Add extend the new profile interface into the existing authorization
and token profile interfaces
- Add resource to the authentication request object
- Build the resource parameter into the authorisation/authentication
request
- Add a feature flag bit constant for the resource indicators
https://shibboleth.atlassian.net/browse/JCOMOIDC-142
---
.../config/OIDCAuthorizationConfiguration.java | 3 ++
.../profile/core/OIDCAuthenticationRequest.java | 29 ++++++++++++++
...h2AccessTokenProducingProfileConfiguration.java | 3 +-
.../OAuth2AuthorizationProfileConfiguration.java | 2 +-
...uth2ResourceIndicatingProfileConfiguration.java | 46 ++++++++++++++++++++++
.../DefaultOIDCAuthorizationConfiguration.java | 43 ++++++++++++++++++++
.../encoding/impl/AbstractOIDCMessageEncoder.java | 5 +++
7 files changed, 129 insertions(+), 2 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
index 3cd37a3c..821ea0ec 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthorizationConfiguration.java
@@ -49,6 +49,9 @@ public interface OIDCAuthorizationConfiguration extends OIDCAuthenticationProfil
/** Bit constant for ForceAuthn feature. */
static final int FEATURE_FORCEAUTHN = 0x4;
+
+ /** Bit constant for Resource Indicator feature. */
+ static final int FEATURE_RESOURCE_INDICATOR = 0x8;
/**
* Get whether all acr claim requests should be treated as Essential.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
index 93bfbc1a..34943d4d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -18,6 +18,7 @@ import java.net.URI;
import java.time.Duration;
import java.time.Instant;
import java.util.List;
+import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -31,6 +32,7 @@ import com.nimbusds.openid.connect.sdk.Prompt;
import com.nimbusds.openid.connect.sdk.claims.ACR;
import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -97,6 +99,9 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
/** The time at which the RP made the authentication request to the OP.*/
@Nullable private Instant authnRequestTime;
+ /** The list of resource indicators.*/
+ @Nonnull @NotLive private List<URI> resources;
+
/**
*
* Constructor.
@@ -353,6 +358,30 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
@Nullable public Instant getAuthnRequestTime() {
return authnRequestTime;
}
+
+ /**
+ * Set the set of resource indicators.
+ *
+ * @param resourcesIn the resource indicators to set.
+ *
+ * @since 3.4.0
+ */
+ public void setResources(@Nullable @NonnullElements final Set<URI> resourcesIn) {
+ if (resourcesIn != null) {
+ resources = CollectionSupport.copyToList(resourcesIn);
+ }
+ }
+
+ /**
+ * Get the set of resource indicators.
+ *
+ * @return the set of resource indicators.
+ *
+ * @since 3.4.0
+ */
+ @Nonnull @NotLive @Unmodifiable public Set<URI> getResources(){
+ return CollectionSupport.copyToSet(resources);
+ }
//TODO others relating to sections 5.2, 5.5, 6, and 7.2.1
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
index e0195346..17ba5963 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AccessTokenProducingProfileConfiguration.java
@@ -30,7 +30,8 @@ import net.shibboleth.shared.annotation.constraint.Positive;
/**
* Configuration common to OAuth 2.0 access token producing profiles.
*/
-public interface OAuth2AccessTokenProducingProfileConfiguration extends OAuth2ProfileConfiguration {
+public interface OAuth2AccessTokenProducingProfileConfiguration
+ extends OAuth2ProfileConfiguration, OAuth2ResourceIndicatingProfileConfiguration {
/**
* Get access token type.
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
index 4df1914d..87deff59 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2AuthorizationProfileConfiguration.java
@@ -30,7 +30,7 @@ import net.shibboleth.shared.annotation.constraint.Unmodifiable;
/**
* Configuration for a generic OAuth 2.0 authorization request.
*/
-public interface OAuth2AuthorizationProfileConfiguration {
+public interface OAuth2AuthorizationProfileConfiguration extends OAuth2ResourceIndicatingProfileConfiguration {
/** Enumeration of the HTTP methods used in various OAuth requests.*/
public enum HttpRequestMethod {
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java
new file mode 100644
index 00000000..fe1cd455
--- /dev/null
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.profile.oauth2.config;
+
+import java.util.Set;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.shared.annotation.ConfigurationSetting;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
+/**
+ * Configuration for profiles that use the OAuth 2.0 resource parameter (RFC8707) to indicate the target service
+ * or resource for which access is being requested.
+ */
+public interface OAuth2ResourceIndicatingProfileConfiguration {
+
+ /**
+ * Get the set of OAuth 2.0 resource indicators associated with the given profile request context that
+ * specify the intended audiences of an OAuth 2.0 access token.
+ *
+ * @param profileRequestContext the profile request context
+ *
+ * @return the set of resource indicators.
+ */
+ @ConfigurationSetting(name="resourceIndicators")
+ @Nullable @NonnullElements @Unmodifiable @NotLive Set<String> getResourceIndicators(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index b90f2c64..660392b8 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -151,6 +151,12 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
/** Whether client is required to use pushed authorization request. */
@Nonnull private Predicate<ProfileRequestContext> requirePushedAuthorizationRequestPredicate;
+
+ /**
+ * Lookup function to supply the resource indicators used to target the services or resources for which access is
+ * being requested.
+ */
+ @Nonnull private Function<ProfileRequestContext, Set<String>> resourceIndicatorsLookupStrategy;
/**
* Constructor.
@@ -196,6 +202,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
FunctionSupport.constant(PredicateSupport.alwaysTrue());
requireDpopJktPredicate = PredicateSupport.alwaysFalse();
requirePushedAuthorizationRequestPredicate = PredicateSupport.alwaysFalse();
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(CollectionSupport.emptySet());
}
/** {@inheritDoc} */
@@ -1088,4 +1095,40 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
@Nonnull final Predicate<ProfileRequestContext> condition) {
requirePushedAuthorizationRequestPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+
+ /** {@inheritDoc} */
+ @Override
+ public Set<String> getResourceIndicators(final ProfileRequestContext profileRequestContext) {
+ return resourceIndicatorsLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the lookup strategy used to find the set of OAuth 2.0 resource indicators associated with the given profile
+ * request context that specify the intended audiences for an OAuth 2.0 access token.
+ *
+ * @param strategy the strategy to set.
+ *
+ * @since 3.4.0
+ */
+ public void setResourceIndicatorsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
+ resourceIndicatorsLookupStrategy =
+ Constraint.isNotNull(strategy, "ResourceIndicators lookup strategy can not be null");
+ }
+
+ /**
+ * Set the set of OAuth 2.0 resource indicators that specify the intended audiences for an OAuth 2.0 access token.
+ *
+ * @param strategy the strategy to set.
+ *
+ * @since 3.4.0
+ */
+ public void setResourceIndicators(@Nullable @NonnullElements final Set<String> resourceIndicators) {
+ if (resourceIndicators == null || resourceIndicators.isEmpty()) {
+ scopesLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ scopesLookupStrategy = FunctionSupport.constant(
+ Set.copyOf(StringSupport.normalizeStringCollection(resourceIndicators)));
+ }
+ }
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
index 4c7773f7..c9f87dcd 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AbstractOIDCMessageEncoder.java
@@ -175,6 +175,11 @@ public abstract class AbstractOIDCMessageEncoder extends AbstractHttpServletResp
params.add(new Pair<>("code_challenge", req.getCodeChallenge()));
params.add(new Pair<>("code_challenge_method", codeChallengedMethod.getValue()));
}
+ if (!req.getResources().isEmpty()) {
+ for (final URI resource : req.getResources()) {
+ params.add(new Pair<>("resource", resource.toString()));
+ }
+ }
}
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list