[java-oidc-common] 13/20: JCOMOIDC-148 - Add AttributeExtractionStrategy to OIDCSSORelyingPartyConfiguration

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/JCOMOIDC-139
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/3468fccab0a2ffa049d8b9acb012011aedf565d7

commit 3468fccab0a2ffa049d8b9acb012011aedf565d7
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Nov 27 11:45:48 2025 +0000

    JCOMOIDC-148 - Add AttributeExtractionStrategy to
    OIDCSSORelyingPartyConfiguration
    
     - Added profile strategy
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-148
---
 .../config/OIDCSSORelyingPartyConfiguration.java   | 26 ++++++++++++++
 .../DefaultOIDCAuthorizationConfiguration.java     | 42 ++++++++++++++++++++--
 2 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
index 4bfd14a7..a9b0e765 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
@@ -14,9 +14,18 @@
 
 package net.shibboleth.oidc.profile.config;
 
+import java.util.Collection;
+import java.util.function.Function;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
 import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenEncryptionProfileConfiguration;
 import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
+import net.shibboleth.shared.annotation.ConfigurationSetting;
 
 /**
  * Profile configuration for an OIDC SSO Client or Relying Party.
@@ -24,5 +33,22 @@ import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
 public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionProfileConfiguration, 
     OverriddenIssuerProfileConfiguration, OIDCFlowAwareProfileConfiguration, 
     OAuth2ClientAuthenticableClientProfileConfiguration, OIDCSSOProfileConfiguration {
+    
+    /**
+     * Get a strategy function to apply to OIDC tokens to extract additional {@link IdPAttribute}
+     * objects from the data.
+     * 
+     * <p>This supplements the built-in behavior that decodes OIDC claims into in the combined id_token and UserInfo
+     * tokens.</p> 
+     * 
+     * @param profileRequestContext profile request context
+     * 
+     * @return extraction strategy
+     * 
+     * @since 3.4.0
+     */
+    @ConfigurationSetting(name="attributeExtractionStrategy")
+    @Nullable Function<ProfileRequestContext,Collection<IdPAttribute>> getAttributeExtractionStrategy(
+            @Nullable final ProfileRequestContext profileRequestContext);
 
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index fe18e384..8f82180b 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -29,6 +29,7 @@ import javax.annotation.Nullable;
 
 import org.opensaml.profile.context.ProfileRequestContext;
 
+import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.oidc.profile.config.OIDCAuthenticationRelyingPartyProfileConfiguration;
 import net.shibboleth.oidc.profile.config.OIDCAuthorizationConfiguration;
 import net.shibboleth.oidc.profile.config.OIDCSSOProfileConfiguration;
@@ -163,6 +164,10 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
      * Lookup function to supply a JSON map of requested claims.
      */
     @Nonnull private Function<ProfileRequestContext, Map<String, Object>> requestedClaimsLookupStrategy;
+    
+    /** Lookup function for attribute extraction strategy. */
+    @Nonnull Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<IdPAttribute>>>
+    attributeExtractionStrategyLookupStrategy;
 
     /**
      * Constructor.
@@ -210,6 +215,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
         requirePushedAuthorizationRequestPredicate = PredicateSupport.alwaysFalse();
         resourceIndicatorsLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
         requestedClaimsLookupStrategy =  FunctionSupport.constant(null);
+        attributeExtractionStrategyLookupStrategy = FunctionSupport.constant(null);
     }
 
     /** {@inheritDoc} */
@@ -1120,7 +1126,7 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
     public void setResourceIndicatorsLookupStrategy(
             @Nonnull final Function<ProfileRequestContext,  List<String>> strategy) {
         resourceIndicatorsLookupStrategy = 
-                Constraint.isNotNull(strategy, "ResourceIndicators lookup strategy can not be null");
+                Constraint.isNotNull(strategy, "Resource indicators lookup strategy can not be null");
     }
     
     /**
@@ -1159,6 +1165,38 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
     public void setRequestedClaimsLookupStrategy(
             @Nonnull final Function<ProfileRequestContext, Map<String, Object>> strategy) {
         requestedClaimsLookupStrategy = Constraint.isNotNull(strategy,
-                "requestedClaimsLookupStrategy can not be null");
+                "RequestedClaims lookup strategy can not be null");
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    public Function<ProfileRequestContext, Collection<IdPAttribute>> getAttributeExtractionStrategy(
+            @Nullable final ProfileRequestContext profileRequestContext) {
+        return attributeExtractionStrategyLookupStrategy.apply(profileRequestContext);
+    }
+    
+    /**
+     * Set the lookup strategy used to find the attribute extraction strategy for a given profile request context.
+     * 
+     * @param strategy The attributeExtractionStrategyLookupStrategy to set.
+     * 
+     * @since 3.4.0
+     */
+    public void setAttributeExtractionStrategyLookupStrategy(@Nonnull final
+            Function<ProfileRequestContext, Function<ProfileRequestContext, Collection<IdPAttribute>>> strategy) {
+        attributeExtractionStrategyLookupStrategy = Constraint.isNotNull(strategy,
+                "Attribute extraction strategy lookup strategy cannot be null");
+    }
+    
+    /**
+     * Set the attribute extraction strategy.
+     * 
+     * @param strategy strategy function
+     * 
+     * @since 3.4.0
+     */
+    public void setAttributeExtractionStrategy(
+            @Nonnull final Function<ProfileRequestContext,Collection<IdPAttribute>> strategy) {
+        attributeExtractionStrategyLookupStrategy = FunctionSupport.constant(strategy);
     }
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.