[java-oidc-common] 05/08: JCOMOIDC-150 - Add AttributeResolutionPrincipal to OIDCSSORelyingPartyConfiguration

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/JCOMOIDC-139
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/00ee2e62da2f9bc5e6b7dbeae621042a4b75630b

commit 00ee2e62da2f9bc5e6b7dbeae621042a4b75630b
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Nov 27 15:11:36 2025 +0000

    JCOMOIDC-150 - Add AttributeResolutionPrincipal to
    OIDCSSORelyingPartyConfiguration
    
     - And implementation in AbstractOIDCSSOConfiguration
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-150
---
 .../config/OIDCSSORelyingPartyConfiguration.java   | 12 ++++++++
 .../config/impl/AbstractOIDCSSOConfiguration.java  | 33 +++++++++++++++++++++-
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
index 7fa61b0c..b1749af8 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
@@ -52,5 +52,17 @@ public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionP
     @ConfigurationSetting(name="attributeExtractionStrategy")
     @Nullable Function<ProfileRequestContext,Collection<IdPAttribute>> getAttributeExtractionStrategy(
             @Nullable final ProfileRequestContext profileRequestContext);
+    
+    /**
+     * Get a principal name to feed into attribute resolution if {@link #isResolveAttributes(ProfileRequestContext)} is true.
+     * 
+     * @param profileRequestContext profile request context
+     * 
+     * @return principal name to use during resolution
+     * 
+     * @since 3.4.0
+     */
+    @ConfigurationSetting(name="attributeResolutionPrincipal")
+    @Nullable String getAttributeResolutionPrincipal(@Nullable final ProfileRequestContext profileRequestContext);
 
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 0b041947..40256873 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -107,6 +107,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
 
     /** Whether scope validation is strict, i.e. request for unallowed scopes is an error. */
     @Nonnull private Predicate<ProfileRequestContext> strictScopeValidationPredicate;
+    
+    /** Lookup function for attribute resolution principal. */
+    @Nonnull Function<ProfileRequestContext,String> attributeResolutionPrincipalLookupStrategy;
 
     /**
      * Creates a new configuration instance.
@@ -138,7 +141,8 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
         customRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(null);
 
         alwaysIssueBearerAccessTokenPredicate = PredicateSupport.alwaysFalse();
-        strictScopeValidationPredicate = PredicateSupport.alwaysFalse();
+        strictScopeValidationPredicate = PredicateSupport.alwaysFalse();        
+        attributeResolutionPrincipalLookupStrategy = FunctionSupport.constant(null);
     }
     
     /** {@inheritDoc} */
@@ -702,5 +706,32 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
         strictScopeValidationPredicate = Constraint.isNotNull(condition,
                 "Strict scope validation predicate cannot be null");
     }
+    
+    /** {@inheritDoc} */
+    @Nullable public String getAttributeResolutionPrincipal(@Nullable final ProfileRequestContext profileRequestContext) {
+        return attributeResolutionPrincipalLookupStrategy.apply(profileRequestContext);
+    }
+
+    /**
+     * Set a principal name to feed into attribute resolution if {@link #isResolveAttributes(ProfileRequestContext)}
+     * is true.
+     * 
+     * @param principal principal name to set
+     */
+    public void setAttributeResolutionPrincipal(@Nullable final String principal) {
+        attributeResolutionPrincipalLookupStrategy = FunctionSupport.constant(principal);
+    }
+    
+    /**
+     * Set a lookup strategy for the principal name to feed into attribute resolution if
+     * {@link #isResolveAttributes(ProfileRequestContext)} is true
+     * 
+     * @param strategy lookup strategy
+     */
+    public void setAttributeResolutionPrincipalLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext,String> strategy) {
+        attributeResolutionPrincipalLookupStrategy =
+                Constraint.isNotNull(strategy, "Resolution principal lookup strategy cannot be null");
+    }
 
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.