[java-oidc-common] 08/08: Cleanups for merge
Codeberg
noreply at shibboleth.net
Tue Feb 17 20:59:15 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/JCOMOIDC-139
in repository java-oidc-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/a31a25a69a1f168f375828d8970612fbe5714cee
commit a31a25a69a1f168f375828d8970612fbe5714cee
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Feb 17 18:34:22 2026 +0000
Cleanups for merge
- Fix redirect_uri in token request
- allow for a configurable strategy to obtain the redirect_uri
- Cleanup profile interfaces and add default methods for compatibility
- Add default methods for compatiblity
---
.../impl/AbstractTokenResponseLookupStrategy.java | 4 +-
.../OIDCAuthenticationProfileConfiguration.java | 7 +-
.../config/OIDCSSORelyingPartyConfiguration.java | 16 +++-
.../oidc/profile/context/OIDCAuthnContext.java | 94 ----------------------
.../context/OutboundMessageHandlerContext.java | 69 ----------------
.../AbstractTokenResponseLookupStrategy.java | 2 +-
.../profile/core/OAuthAuthorizationRequest.java | 6 +-
.../shibboleth/oidc/profile/core/StateToken.java | 6 +-
...uth2ResourceIndicatingProfileConfiguration.java | 10 ++-
.../DefaultOIDCAuthorizationConfiguration.java | 6 +-
.../encoding/impl/AuthCodeTokenRequestEncoder.java | 32 +++++++-
.../messaging/handler/impl/AddStateHandler.java | 2 +-
.../DefaultOAuth2TokenAudienceConfiguration.java | 6 +-
.../impl/DefaultOAuth2TokenConfiguration.java | 6 +-
14 files changed, 82 insertions(+), 184 deletions(-)
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AbstractTokenResponseLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AbstractTokenResponseLookupStrategy.java
index 4239fab3..986ca243 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AbstractTokenResponseLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AbstractTokenResponseLookupStrategy.java
@@ -25,10 +25,10 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import net.shibboleth.oidc.profile.context.AccessTokenResponseContext;
import net.shibboleth.shared.logic.Constraint;
-/** Base class for looking up the token response context.*/
+/** Base class for looking up the access token response context.*/
public abstract class AbstractTokenResponseLookupStrategy {
- /** Strategy used to locate the {@link AccessTokenResponseContext} to extract the id_token from.*/
+ /** Strategy used to locate the {@link AccessTokenResponseContext}.*/
@Nonnull
private final Function<ProfileRequestContext, AccessTokenResponseContext> tokenResponseContextLookupStrategy;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
index 538c2060..c1d0d5b0 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCAuthenticationProfileConfiguration.java
@@ -31,6 +31,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
/** Generic configuration for an OIDC 1.0 authentication request.*/
public interface OIDCAuthenticationProfileConfiguration extends OAuth2AuthorizationProfileConfiguration {
@@ -124,8 +125,10 @@ public interface OIDCAuthenticationProfileConfiguration extends OAuth2Authorizat
* @since 3.4.0
*/
@ConfigurationSetting(name="requestedClaims")
- @Nullable @NonnullElements @Unmodifiable @NotLive
- Map<String,Object> getRequestedClaims(@Nullable final ProfileRequestContext profileRequestContext);
+ @Nonnull @NonnullElements @Unmodifiable @NotLive
+ default Map<String,Object> getRequestedClaims(@Nullable final ProfileRequestContext profileRequestContext){
+ return CollectionSupport.emptyMap();
+ }
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
index b265986d..3dc26c45 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
@@ -50,8 +50,10 @@ public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionP
* @since 3.4.0
*/
@ConfigurationSetting(name="attributeExtractionStrategy")
- @Nullable Function<ProfileRequestContext,Collection<IdPAttribute>> getAttributeExtractionStrategy(
- @Nullable final ProfileRequestContext profileRequestContext);
+ @Nullable default Function<ProfileRequestContext,Collection<IdPAttribute>> getAttributeExtractionStrategy(
+ @Nullable final ProfileRequestContext profileRequestContext){
+ return null;
+ }
/**
* Get a principal name to feed into attribute resolution if {@link #isResolveAttributes(ProfileRequestContext)}
@@ -64,7 +66,10 @@ public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionP
* @since 3.4.0
*/
@ConfigurationSetting(name="attributeResolutionPrincipal")
- @Nullable String getAttributeResolutionPrincipal(@Nullable final ProfileRequestContext profileRequestContext);
+ @Nullable
+ default String getAttributeResolutionPrincipal(@Nullable final ProfileRequestContext profileRequestContext) {
+ return null;
+ }
/**
*
@@ -81,6 +86,9 @@ public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionP
* @since 3.4.0
*/
@ConfigurationSetting(name="shouldValidateAcrValue")
- boolean shouldValidateAcrValue(@Nullable final ProfileRequestContext profileRequestContext);
+ default boolean shouldValidateAcrValue(@Nullable final ProfileRequestContext profileRequestContext) {
+ // Evaluate the claims as a default
+ return true;
+ }
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/OIDCAuthnContext.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/OIDCAuthnContext.java
deleted file mode 100644
index e70a71a6..00000000
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/OIDCAuthnContext.java
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.oidc.profile.context;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.BaseContext;
-import org.opensaml.messaging.decoder.MessageDecoder;
-import org.opensaml.messaging.handler.MessageHandler;
-import org.opensaml.profile.action.ProfileAction;
-
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Manages state during proxied OIDC authentication via a Spring Controller.
- */
-public class OIDCAuthnContext extends BaseContext {
-
- /** Outbound message handler to run prior to encoding. */
- @Nullable private MessageHandler outboundMessageHandler;
-
- /** Profile action to execute to produce outbound message response. */
- @Nonnull private final ProfileAction encodeMessageAction;
-
- /** The function to use to obtain a decoder. */
- @Nonnull private final Function<String,MessageDecoder> decoderFactory;
-
- /**
- * Constructor.
- *
- * @param action message-encoding profile action
- * @param factory the message descoder factory
- */
- public OIDCAuthnContext(@Nonnull final ProfileAction action,
- @Nonnull final Function<String,MessageDecoder> factory) {
- encodeMessageAction = Constraint.isNotNull(action, "Profile action cannot be null");
- decoderFactory = Constraint.isNotNull(factory, "MessageDecoder factory cannot be null");
- }
-
- /**
- * Get the message-encoding profile action.
- *
- * @return profile action
- */
- @Nonnull public ProfileAction getEncodeMessageAction() {
- return encodeMessageAction;
- }
-
- /**
- * Get the outbound {@link MessageHandler} to run prior to encoding.
- *
- * @return the outbound {@link MessageHandler}
- */
- @Nullable public MessageHandler getOutboundMessageHandler() {
- return outboundMessageHandler;
- }
-
- /**
- * Set the outbound {@link MessageHandler} to run prior to encoding.
- *
- * @param handler outbound {@link MessageHandler} to set
- *
- * @return this context
- */
- @Nonnull public OIDCAuthnContext setOutboundMessageHandler(@Nullable final MessageHandler handler) {
- outboundMessageHandler = handler;
- return this;
- }
-
- /**
- * Get the factory function to obtain message decoders.
- *
- * @return factory function
- */
- @Nonnull public Function<String,MessageDecoder> getMessageDecoderFactory() {
- return decoderFactory;
- }
-
-}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/OutboundMessageHandlerContext.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/OutboundMessageHandlerContext.java
deleted file mode 100644
index 0c42af1d..00000000
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/OutboundMessageHandlerContext.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.oidc.profile.context;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.BaseContext;
-
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A context to stash controller parameters for use by message handlers.
- * For example, the OIDC RP preEncodeMessageHandlers.
- */
-public class OutboundMessageHandlerContext extends BaseContext {
-
- /** The spring webflow key.*/
- @Nullable private String webflowKey;
-
- /**
- * Convenience constructor.
- *
- * @param key the swf key
- */
- public OutboundMessageHandlerContext(@Nonnull final String key) {
- super();
- webflowKey = Constraint.isNotNull(key, "Spring Webflow Key can not be null");
- }
-
- /** Constructor to allow no-arg construction.*/
- public OutboundMessageHandlerContext() {
- // Do nothing
- }
-
- /**
- * Set the Spring Webflow execution key.
- *
- * @param key the swf execution key
- *
- * @return this
- */
- public OutboundMessageHandlerContext setWebflowKey(@Nonnull final String key) {
- webflowKey = Constraint.isNotNull(key, "Spring Webflow Key can not be null");
- return this;
- }
-
- /**
- * Get the Spring Webflow execution key.
- *
- * @return Returns the webflowKey.
- */
- @Nullable public String getWebflowKey() {
- return webflowKey;
- }
-
-}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/navigate/AbstractTokenResponseLookupStrategy.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/navigate/AbstractTokenResponseLookupStrategy.java
index 0a28dde9..621b25a3 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/navigate/AbstractTokenResponseLookupStrategy.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/context/navigate/AbstractTokenResponseLookupStrategy.java
@@ -28,7 +28,7 @@ import net.shibboleth.shared.logic.Constraint;
/** Base class for looking up the token response context.*/
public abstract class AbstractTokenResponseLookupStrategy {
- /** Strategy used to locate the {@link AccessTokenResponseContext} to extract the id_token from.*/
+ /** Strategy used to locate the {@link AccessTokenResponseContext}.*/
@Nonnull
private final Function<ProfileRequestContext, AccessTokenResponseContext> tokenResponseContextLookupStrategy;
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java
index dc40caa2..f6629798 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/OAuthAuthorizationRequest.java
@@ -173,7 +173,7 @@ public class OAuthAuthorizationRequest {
*
* @param theState The state to set.
*/
- public void setState(@Nullable final StateToken theState) {
+ public void setStateToken(@Nullable final StateToken theState) {
state = theState;
}
@@ -185,7 +185,9 @@ public class OAuthAuthorizationRequest {
public void setState(@Nullable final State theState) {
if (theState != null){
state = new StateToken(theState.getValue(), null);
- }
+ } else {
+ state = null;
+ }
}
/**
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/StateToken.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/StateToken.java
index 87ee8ce1..602446fe 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/StateToken.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/core/StateToken.java
@@ -24,7 +24,7 @@ import net.minidev.json.JSONObject;
public class StateToken {
- /** The value of the state token in its string form ready to be added to an OAuth request. */
+ /** The value of the state token in its serialized form ready to be added to an OAuth request. */
private final String value;
/** The JSON object form of the state token if the state is encoded as a JSON object. */
@@ -34,7 +34,7 @@ public class StateToken {
*
* Constructor.
*
- * @param stateValue the value of the state token in its string, can be null
+ * @param stateValue the value of the state token in its serialized form, can be null
* @param jsonState the JSON object form of the state token, can be null.
*/
public StateToken(@Nullable final String stateValue, @Nullable final JSONObject jsonState) {
@@ -43,7 +43,7 @@ public class StateToken {
}
/**
- * Get the value of the state token in its string form ready to be added to an OAuth request.
+ * Get the value of the state token in its serialized form ready to be added to an OAuth request.
*
* @return the state token value
*/
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java
index 0040d13a..ceb203ac 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2ResourceIndicatingProfileConfiguration.java
@@ -16,6 +16,7 @@ package net.shibboleth.oidc.profile.oauth2.config;
import java.util.List;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -24,10 +25,13 @@ import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
/**
* Configuration for profiles that use the OAuth 2.0 resource parameter (RFC8707) to indicate the target service
* or resource for which access is being requested.
+ *
+ * @since 3.4.0
*/
public interface OAuth2ResourceIndicatingProfileConfiguration {
@@ -40,7 +44,9 @@ public interface OAuth2ResourceIndicatingProfileConfiguration {
* @return the set of resource indicators.
*/
@ConfigurationSetting(name="resourceIndicators")
- @Nullable @NonnullElements @Unmodifiable @NotLive List<String> getResourceIndicators(
- @Nullable final ProfileRequestContext profileRequestContext);
+ @Nonnull @NonnullElements @Unmodifiable @NotLive default List<String> getResourceIndicators(
+ @Nullable final ProfileRequestContext profileRequestContext){
+ return CollectionSupport.emptyList();
+ }
}
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
index c14bec43..731b1d24 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCAuthorizationConfiguration.java
@@ -1106,7 +1106,11 @@ public class DefaultOIDCAuthorizationConfiguration extends AbstractOIDCSSOConfig
/** {@inheritDoc} */
@Override
public List<String> getResourceIndicators(final ProfileRequestContext profileRequestContext) {
- return resourceIndicatorsLookupStrategy.apply(profileRequestContext);
+ final List<String> resourceIndicators = resourceIndicatorsLookupStrategy.apply(profileRequestContext);
+ if (resourceIndicators != null) {
+ return CollectionSupport.copyToList(resourceIndicators);
+ }
+ return CollectionSupport.emptyList();
}
/**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java
index 71c35a30..f39e8393 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java
@@ -15,6 +15,7 @@
package net.shibboleth.oidc.profile.encoding.impl;
import java.net.URI;
+import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -34,6 +35,8 @@ import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -46,6 +49,30 @@ public class AuthCodeTokenRequestEncoder extends AbstractRequestEncoderFunction
@Nonnull
private final Logger log = LoggerFactory.getLogger(AuthCodeTokenRequestEncoder.class);
+ /**
+ * The strategy used to look up the redirect URI to use in the token request. This will typically be the same
+ * URI used in the authorization request, but may be overridden if necessary. If not set, no redirect URI will be
+ * included in the token request which may result in an error on the OpenID Provider.
+ */
+ @Nonnull private Function<ProfileRequestContext, URI> redirectUriLookupStrategy;
+
+ public AuthCodeTokenRequestEncoder() {
+ super();
+ redirectUriLookupStrategy = FunctionSupport.constant(null);
+ }
+
+ /**
+ * Set the strategy used to look up the redirect URI to use in the token request. This will typically be the same
+ * URI used in the authorization request, but may be overridden if necessary. If not set, no redirect URI will be
+ * included in the token request which may result in an error on the OpenID Provider.
+ *
+ * @param strategy The RedirectUriLookupStrategy to set.
+ */
+ public void setRedirectUriLookupStrategy(@Nonnull final Function<ProfileRequestContext, URI> strategy) {
+ redirectUriLookupStrategy = Constraint.isNotNull(strategy,
+ "RedirectUriLookupStrategy can not be null");
+ }
+
@Override
@Nullable public ClassicHttpRequest doApply(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final OIDCProviderMetadata providerMetadata) {
@@ -67,9 +94,12 @@ public class AuthCodeTokenRequestEncoder extends AbstractRequestEncoderFunction
// return null;
//}
+ final URI redirectUri = redirectUriLookupStrategy.apply(profileRequestContext);
+
+ // TODO finish this encoder!
// If PKCE was set in the request (is not null) use it, else set it to null
final AuthorizationGrant codeGrant =
- new AuthorizationCodeGrant(authnResponse.getAuthorizationCode(), new URI("http://redirect/")); //TODO REDIRECT_URI
+ new AuthorizationCodeGrant(authnResponse.getAuthorizationCode(),redirectUri);
// authnRequest.getCodeVerifier() != null ? new CodeVerifier(authnRequest.getCodeVerifier())
// : null);
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AddStateHandler.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AddStateHandler.java
index 2e24316e..06d54131 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AddStateHandler.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AddStateHandler.java
@@ -61,7 +61,7 @@ public class AddStateHandler extends AbstractAuthenticationRequestParameterValue
log.trace("{} Generated state '{}'", getLogPrefix(), stateToken.getValue());
// Add to outer request
- getAuthenticationRequest().setState(stateToken);
+ getAuthenticationRequest().setStateToken(stateToken);
// Add to Request Object if exists
final ClaimsSet claims = getAuthenticationRequest().getRequestObjectClaimsSet();
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
index 6ecef61a..c6cd2aec 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenAudienceConfiguration.java
@@ -314,7 +314,11 @@ public class DefaultOAuth2TokenAudienceConfiguration extends AbstractOAuth2Inter
/** {@inheritDoc} */
@Override
public List<String> getResourceIndicators(final ProfileRequestContext profileRequestContext) {
- return resourceIndicatorsLookupStrategy.apply(profileRequestContext);
+ final List<String> resourceIndicators = resourceIndicatorsLookupStrategy.apply(profileRequestContext);
+ if (resourceIndicators != null) {
+ return CollectionSupport.copyToList(resourceIndicators);
+ }
+ return CollectionSupport.emptyList();
}
/**
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
index 8571f4c7..57916cc5 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/oauth2/config/impl/DefaultOAuth2TokenConfiguration.java
@@ -255,7 +255,11 @@ public class DefaultOAuth2TokenConfiguration extends AbstractOIDCSSOConfiguratio
/** {@inheritDoc} */
@Override
public List<String> getResourceIndicators(final ProfileRequestContext profileRequestContext) {
- return resourceIndicatorsLookupStrategy.apply(profileRequestContext);
+ final List<String> resourceIndicators = resourceIndicatorsLookupStrategy.apply(profileRequestContext);
+ if (resourceIndicators != null) {
+ return CollectionSupport.copyToList(resourceIndicators);
+ }
+ return CollectionSupport.emptyList();
}
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list