[java-plugin-shibd-oidc] branch main updated: Add requested_acrs to saved authentication request state

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/a15a9a2ba06423e9bf4a3a0b694844fd85350fea

The following commit(s) were added to refs/heads/main by this push:
     new a15a9a2  Add requested_acrs to saved authentication request state
a15a9a2 is described below

commit a15a9a2ba06423e9bf4a3a0b694844fd85350fea
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jan 26 16:35:28 2026 +0000

    Add requested_acrs to saved authentication request state
---
 .../profile/AuthenticationRequestStateData.java    | 50 ++++++++++++++++++++--
 1 file changed, 47 insertions(+), 3 deletions(-)

diff --git a/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/AuthenticationRequestStateData.java b/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/AuthenticationRequestStateData.java
index a0b3e6e..ee9cec6 100644
--- a/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/AuthenticationRequestStateData.java
+++ b/sp-oidc-api/src/main/java/net/shibboleth/sp/oidc/profile/AuthenticationRequestStateData.java
@@ -17,6 +17,8 @@ package net.shibboleth.sp.oidc.profile;
 
 import java.time.Duration;
 import java.time.Instant;
+import java.util.List;
+import java.util.Objects;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -25,11 +27,15 @@ import javax.annotation.concurrent.NotThreadSafe;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
+import com.nimbusds.openid.connect.sdk.claims.ACR;
 import com.nimbusds.openid.connect.sdk.claims.ClaimRequirement;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
 
 import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
  * A DTO class that carries authentication request information that needs to be recovered to validate the authentication
@@ -63,6 +69,14 @@ public class AuthenticationRequestStateData {
     /** The time at which the RP made the authentication request to the OP.*/
     @Nullable private Instant authnRequestTime;
     
+    /** List of authentication context class references requested in the authentication request.*/
+    @Nonnull @Unmodifiable @NotLive private List<String> acrs;
+    
+    /** Constructor.*/
+    public AuthenticationRequestStateData() {
+        acrs = CollectionSupport.emptyList();
+    }
+    
     /**
      * Set the identifier of the client that is making the authentication request. Can be used to ensure the audience
      * of the response matches the client that made the request.
@@ -166,6 +180,8 @@ public class AuthenticationRequestStateData {
      * set the maxAge, a null value indicates no maxAge was specified in the authentication request.
      * 
      * @param age The max_age to set.
+     * 
+     * @return the updated object
      */
     @Nonnull public AuthenticationRequestStateData setMaxAge(@Nullable final Duration age) {
         maxAge = age;
@@ -177,6 +193,8 @@ public class AuthenticationRequestStateData {
      * parameter requested it.
      * 
      * @param requested is the auth_time requested and hence required inside the id_token.
+     * 
+     * @return the updated object
      */
     @Nonnull public AuthenticationRequestStateData setAuthTimeRequired(final boolean requested) {
         authTimeRequired = requested;
@@ -198,8 +216,10 @@ public class AuthenticationRequestStateData {
      * Set the time at which this RP sent this authentication request to the OP.
      * 
      * @param time the time the request was made
+     * 
+     * @return the updated object
      */
-    public AuthenticationRequestStateData setAuthnRequestTime(@Nullable final Instant time) {
+    @Nonnull public AuthenticationRequestStateData setAuthnRequestTime(@Nullable final Instant time) {
         authnRequestTime = time;
         return this;
     }
@@ -214,6 +234,29 @@ public class AuthenticationRequestStateData {
         return authnRequestTime;
     }
     
+    /**
+     * Set the acrs requested in the authentication request.
+     * 
+     * @param acrs The acrs to set.
+     * 
+     * @return the updated object
+     */
+    public AuthenticationRequestStateData setAcrs(@Nullable final List<String> acrsIn) {
+        if (acrsIn != null) {
+            acrs = CollectionSupport.copyToList(acrsIn);
+        }
+        return this;
+    }
+    /**
+     * Get the acrs requested in the authentication request.
+     * 
+     * @return the acrs.
+     */
+    @JsonProperty("requested_acrs")
+    @Nonnull @Unmodifiable @NotLive public List<String> getAcrs() {
+        return acrs;
+    }
+    
     /**
      * Create an instance of this class from the given authentication request and authentication authority.
      * 
@@ -232,7 +275,8 @@ public class AuthenticationRequestStateData {
                 .setPkceCodeVerifier(request.getCodeVerifier())
                 .setMaxAge(request.getMaxAge())
                 .setAuthnRequestTime(request.getAuthnRequestTime())
-                .setClientId(request.getClientID().getValue());
+                .setClientId(request.getClientID().getValue())
+                .setAcrs(request.getAcrs().stream().filter(Objects::nonNull).map(ACR::getValue).toList());
 
         state.setAuthTimeRequired(isAuthTimeRequired(request));
         return state;
@@ -277,7 +321,7 @@ public class AuthenticationRequestStateData {
 
         return "AuthenticationRequestStateData [nonce="+nonceSuffix+", authenticatingAuthority=" + authenticatingAuthority
                 + ", pkceCodeVerifier="+pkceCodeVerifierSuffix+", maxAge=" + maxAge + ", authTimeRequired="
-                + authTimeRequired + ", authnRequestTime=" + authnRequestTime + "]";
+                + authTimeRequired + ", authnRequestTime=" + authnRequestTime + ", acrs=" + acrs + "]";
     }
     
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.