[java-oidc-common] 03/20: JCOMOIDC-142 - Add a Resource Indicator configuration setting
Codeberg
noreply at shibboleth.net
Tue Feb 17 20:14:38 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/JCOMOIDC-139
in repository java-oidc-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/517aee70dc08afe84d0f65b4616924343c2dab9f
commit 517aee70dc08afe84d0f65b4616924343c2dab9f
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Oct 10 17:12:34 2025 +0100
JCOMOIDC-142 - Add a Resource Indicator configuration setting
- Add missing resource indicator profile implementations.
- Change Set to List of URIs.
https://shibboleth.atlassian.net/browse/JCOMOIDC-142
---
.../profile/core/OIDCAuthenticationRequest.java | 8 ++--
...uth2ResourceIndicatingProfileConfiguration.java | 4 +-
.../DefaultOIDCAuthorizationConfiguration.java | 19 ++++-----
.../DefaultOAuth2TokenAudienceConfiguration.java | 46 ++++++++++++++++++++++
.../impl/DefaultOAuth2TokenConfiguration.java | 44 +++++++++++++++++++++
5 files changed, 106 insertions(+), 15 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
index 34943d4d..afc4d777 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OIDCAuthenticationRequest.java
@@ -18,7 +18,6 @@ import java.net.URI;
import java.time.Duration;
import java.time.Instant;
import java.util.List;
-import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -113,6 +112,7 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
// Must contain the openid scope.
getScope().add(DEFAULT_OPENID_SCOPE);
acrs = CollectionSupport.emptyList();
+ resources = CollectionSupport.emptyList();
}
/**
@@ -366,7 +366,7 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
*
* @since 3.4.0
*/
- public void setResources(@Nullable @NonnullElements final Set<URI> resourcesIn) {
+ public void setResources(@Nullable @NonnullElements final List<URI> resourcesIn) {
if (resourcesIn != null) {
resources = CollectionSupport.copyToList(resourcesIn);
}
@@ -379,8 +379,8 @@ public class OIDCAuthenticationRequest extends OAuthAuthorizationRequest {
*
* @since 3.4.0
*/
- @Nonnull @NotLive @Unmodifiable public Set<URI> getResources(){
- return CollectionSupport.copyToSet(resources);
+ @Nonnull @NotLive @Unmodifiable public List<URI> getResources(){
+ return CollectionSupport.copyToList(resources);
}
//TODO others relating to sections 5.2, 5.5, 6, and 7.2.1
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java
index fe1cd455..0040d13a 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java
@@ -14,7 +14,7 @@
package net.shibboleth.oidc.profile.oauth2.config;
-import java.util.Set;
+import java.util.List;
import javax.annotation.Nullable;
@@ -40,7 +40,7 @@ public interface OAuth2ResourceIndicatingProfileConfiguration {
* @return the set of resource indicators.
*/
@ConfigurationSetting(name="resourceIndicators")
- @Nullable @NonnullElements @Unmodifiable @NotLive Set<String> getResourceIndicators(
+ @Nullable @NonnullElements @Unmodifiable @NotLive List<String> getResourceIndicators(
@Nullable final ProfileRequestContext profileRequestContext);
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index 660392b8..8dda59cf 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -17,6 +17,7 @@ package net.shibboleth.oidc.profile.config.impl;
import java.security.Principal;
import java.time.Duration;
import java.util.Collection;
+import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.function.BiFunction;
@@ -156,7 +157,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* Lookup function to supply the resource indicators used to target the services or resources for which access is
* being requested.
*/
- @Nonnull private Function<ProfileRequestContext, Set<String>> resourceIndicatorsLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext, List<String>> resourceIndicatorsLookupStrategy;
/**
* Constructor.
@@ -202,7 +203,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
FunctionSupport.constant(PredicateSupport.alwaysTrue());
requireDpopJktPredicate = PredicateSupport.alwaysFalse();
requirePushedAuthorizationRequestPredicate = PredicateSupport.alwaysFalse();
- resourceIndicatorsLookupStrategy = FunctionSupport.constant(CollectionSupport.emptySet());
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
}
/** {@inheritDoc} */
@@ -1098,7 +1099,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
/** {@inheritDoc} */
@Override
- public Set<String> getResourceIndicators(final ProfileRequestContext profileRequestContext) {
+ public List<String> getResourceIndicators(final ProfileRequestContext profileRequestContext) {
return resourceIndicatorsLookupStrategy.apply(profileRequestContext);
}
@@ -1111,7 +1112,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
* @since 3.4.0
*/
public void setResourceIndicatorsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
+ @Nonnull final Function<ProfileRequestContext, List<String>> strategy) {
resourceIndicatorsLookupStrategy =
Constraint.isNotNull(strategy, "ResourceIndicators lookup strategy can not be null");
}
@@ -1119,16 +1120,16 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
/**
* Set the set of OAuth 2.0 resource indicators that specify the intended audiences for an OAuth 2.0 access token.
*
- * @param strategy the strategy to set.
+ * @param resourceIndicators the set of resource indicators.
*
* @since 3.4.0
*/
- public void setResourceIndicators(@Nullable @NonnullElements final Set<String> resourceIndicators) {
+ public void setResourceIndicators(@Nullable @NonnullElements final List<String> resourceIndicators) {
if (resourceIndicators == null || resourceIndicators.isEmpty()) {
- scopesLookupStrategy = FunctionSupport.constant(null);
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(null);
} else {
- scopesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(resourceIndicators)));
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(
+ List.copyOf(StringSupport.normalizeStringCollection(resourceIndicators)));
}
}
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
index cdc61b37..6ecef61a 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
@@ -15,6 +15,7 @@
package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.time.Duration;
+import java.util.List;
import java.util.Map;
import java.util.function.BiFunction;
import java.util.function.Function;
@@ -26,8 +27,10 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.Positive;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
@@ -61,6 +64,12 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractOAuth2Inter
/** Whether the access token to be issued is always a bearer access token. */
@Nonnull private Predicate<ProfileRequestContext> alwaysIssueBearerAccessTokenPredicate;
+
+ /**
+ * Lookup function to supply the resource indicators used to target the services or resources for which access is
+ * being requested.
+ */
+ @Nonnull private Function<ProfileRequestContext, List<String>> resourceIndicatorsLookupStrategy;
/** Constructor. */
public DefaultOAuth2TokenAudienceConfiguration() {
@@ -85,6 +94,7 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractOAuth2Inter
accessTokenClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
alwaysIssueBearerAccessTokenPredicate = PredicateSupport.alwaysFalse();
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
}
/** {@inheritDoc} */
@@ -300,5 +310,41 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractOAuth2Inter
alwaysIssueBearerAccessTokenPredicate = Constraint.isNotNull(condition,
"Always issue bearer access token predicate cannot be null");
}
+
+ /** {@inheritDoc} */
+ @Override
+ public List<String> getResourceIndicators(final ProfileRequestContext profileRequestContext) {
+ return resourceIndicatorsLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the lookup strategy used to find the set of OAuth 2.0 resource indicators associated with the given profile
+ * request context that specify the intended audiences for an OAuth 2.0 access token.
+ *
+ * @param strategy the strategy to set.
+ *
+ * @since 3.4.0
+ */
+ public void setResourceIndicatorsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, List<String>> strategy) {
+ resourceIndicatorsLookupStrategy =
+ Constraint.isNotNull(strategy, "ResourceIndicators lookup strategy can not be null");
+ }
+
+ /**
+ * Set the set of OAuth 2.0 resource indicators that specify the intended audiences for an OAuth 2.0 access token.
+ *
+ * @param resourceIndicators the set of resource indicators.
+ *
+ * @since 3.4.0
+ */
+ public void setResourceIndicators(@Nullable @NonnullElements final List<String> resourceIndicators) {
+ if (resourceIndicators == null || resourceIndicators.isEmpty()) {
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(
+ List.copyOf(StringSupport.normalizeStringCollection(resourceIndicators)));
+ }
+ }
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
index 617e8995..21a3b0d0 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
@@ -15,6 +15,7 @@
package net.shibboleth.oidc.profile.oauth2.config.impl;
import java.util.Collection;
+import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.function.BiFunction;
@@ -64,6 +65,12 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
/** Whether initial access token audience is solely to self (i.e. UserInfo) use. */
@Nonnull private Predicate<ProfileRequestContext> limitInitialAccessTokenToSelfPredicate;
+
+ /**
+ * Lookup function to supply the resource indicators used to target the services or resources for which access is
+ * being requested.
+ */
+ @Nonnull private Function<ProfileRequestContext, List<String>> resourceIndicatorsLookupStrategy;
/**
* Constructor.
@@ -85,6 +92,7 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
enforceRefreshTokenRotationPredicate = PredicateSupport.alwaysFalse();
issueIdTokenViaRefreshTokenPredicate = PredicateSupport.alwaysTrue();
limitInitialAccessTokenToSelfPredicate = PredicateSupport.alwaysFalse();
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
}
@Override
@@ -242,4 +250,40 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
@Nonnull final Predicate<ProfileRequestContext> condition) {
limitInitialAccessTokenToSelfPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+
+ /** {@inheritDoc} */
+ @Override
+ public List<String> getResourceIndicators(final ProfileRequestContext profileRequestContext) {
+ return resourceIndicatorsLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the lookup strategy used to find the set of OAuth 2.0 resource indicators associated with the given profile
+ * request context that specify the intended audiences for an OAuth 2.0 access token.
+ *
+ * @param strategy the strategy to set.
+ *
+ * @since 3.4.0
+ */
+ public void setResourceIndicatorsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, List<String>> strategy) {
+ resourceIndicatorsLookupStrategy =
+ Constraint.isNotNull(strategy, "ResourceIndicators lookup strategy can not be null");
+ }
+
+ /**
+ * Set the set of OAuth 2.0 resource indicators that specify the intended audiences for an OAuth 2.0 access token.
+ *
+ * @param resourceIndicators the set of resource indicators.
+ *
+ * @since 3.4.0
+ */
+ public void setResourceIndicators(@Nullable @NonnullElements final List<String> resourceIndicators) {
+ if (resourceIndicators == null || resourceIndicators.isEmpty()) {
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ resourceIndicatorsLookupStrategy = FunctionSupport.constant(
+ List.copyOf(StringSupport.normalizeStringCollection(resourceIndicators)));
+ }
+ }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list