[java-oidc-common] 18/20: JSHIBDOIDC-8 - Add back missing token validation logic

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/JCOMOIDC-139
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/616f45ba3867021bd27d8fa5a6a1a1bd45bf83db

commit 616f45ba3867021bd27d8fa5a6a1a1bd45bf83db
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Feb 5 17:47:42 2026 +0000

    JSHIBDOIDC-8 - Add back missing token validation logic
    
     - add a profile config setting that allows ACR claim validation to be
    turned on or off. That is, does the ACR claim in the id_token match one
    of those requested.
    
    https://shibboleth.atlassian.net/browse/JSHIBDOIDC-8
---
 .../config/OIDCSSORelyingPartyConfiguration.java   | 20 ++++++++++-
 .../config/impl/AbstractOIDCSSOConfiguration.java  | 42 ++++++++++++++++++++--
 2 files changed, 58 insertions(+), 4 deletions(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
index b1749af8..b265986d 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
@@ -54,7 +54,8 @@ public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionP
             @Nullable final ProfileRequestContext profileRequestContext);
     
     /**
-     * Get a principal name to feed into attribute resolution if {@link #isResolveAttributes(ProfileRequestContext)} is true.
+     * Get a principal name to feed into attribute resolution if {@link #isResolveAttributes(ProfileRequestContext)} 
+     * is true.
      * 
      * @param profileRequestContext profile request context
      * 
@@ -64,5 +65,22 @@ public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionP
      */
     @ConfigurationSetting(name="attributeResolutionPrincipal")
     @Nullable String getAttributeResolutionPrincipal(@Nullable final ProfileRequestContext profileRequestContext);
+    
+    /** 
+     * 
+     * Should the ACR value in the id_token be validated against those in the authentication request? 
+     * 
+     * <p>It does not make any determination about whether the requested ACR values were marked as
+     * essential or optional in the authentication request; it simply determines whether the validation 
+     * step should run.</p> 
+     * 
+     * @param profileRequestContext the profile request context
+     * 
+     * @return true if the ACR value should be validated, false otherwise.
+     * 
+     * @since 3.4.0
+     */
+    @ConfigurationSetting(name="shouldValidateAcrValue")
+    boolean shouldValidateAcrValue(@Nullable final ProfileRequestContext profileRequestContext);
 
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 47f5d686..d61689e8 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -110,11 +110,17 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
     @Nonnull private Predicate<ProfileRequestContext> strictScopeValidationPredicate;
     
     /** Lookup function for attribute resolution principal. */
-    @Nonnull Function<ProfileRequestContext,String> attributeResolutionPrincipalLookupStrategy;    
+    @Nonnull private Function<ProfileRequestContext,String> attributeResolutionPrincipalLookupStrategy;    
     
     /** Lookup function for attribute extraction strategy. */
-    @Nonnull Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<IdPAttribute>>>
-    attributeExtractionStrategyLookupStrategy;
+    @Nonnull private Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<IdPAttribute>>>
+    attributeExtractionStrategyLookupStrategy;    
+    
+    /**
+     * A predicate to determine if the ACR value in an id_token should be validated against those in the request. 
+     * Defaults to true.
+     */
+    @Nonnull private Predicate<ProfileRequestContext> shouldValidateAcrValue;
 
     /**
      * Creates a new configuration instance.
@@ -149,6 +155,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
         strictScopeValidationPredicate = PredicateSupport.alwaysFalse();        
         attributeResolutionPrincipalLookupStrategy = FunctionSupport.constant(null);
         attributeExtractionStrategyLookupStrategy = FunctionSupport.constant(null);
+        shouldValidateAcrValue = PredicateSupport.alwaysTrue();
     }
     
     /** {@inheritDoc} */
@@ -771,5 +778,34 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
             @Nonnull final Function<ProfileRequestContext,Collection<IdPAttribute>> strategy) {
         attributeExtractionStrategyLookupStrategy = FunctionSupport.constant(strategy);
     }
+    
+
+    /** {@inheritDoc} */
+    @Override
+    public boolean shouldValidateAcrValue(final ProfileRequestContext profileRequestContext) {
+        return shouldValidateAcrValue.test(profileRequestContext);
+    }
+    
+    /**
+     * Set a predicate to determine if the ACR value in the id_token should be validated against those in the request.
+     *
+     * @param predicate The predicate to set
+     *  
+     * @since 3.4.0
+     */
+    public void setShouldValidateAcrValuePredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+        shouldValidateAcrValue = Constraint.isNotNull(predicate,
+                "Should validate ACR value predicate can not be null");
+    }
+    /**
+     * Set a flag to determine if the ACR value in the id_token should be validated against those in the request.
+     * 
+     * @param flag The flag to set.
+     * 
+     * @since 3.4.0
+     */
+    public void setShouldValidateAcrValue(final boolean flag) {
+        shouldValidateAcrValue = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+    }
 
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.