[java-oidc-common] 02/02: JCOMOIDC-165 - Add checkAddress to profile config

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/04fd42a87379256192ed3df36a6a5f8dce9d0154

commit 04fd42a87379256192ed3df36a6a5f8dce9d0154
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed May 6 16:24:32 2026 +0100

    JCOMOIDC-165 - Add checkAddress to profile config
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-165
---
 .../config/OIDCSSORelyingPartyConfiguration.java   | 18 ++++++++++++
 .../config/impl/AbstractOIDCSSOConfiguration.java  | 32 ++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
index 3889f4b2..8f270dc0 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCSSORelyingPartyConfiguration.java
@@ -116,5 +116,23 @@ public interface OIDCSSORelyingPartyConfiguration extends OAuth2TokenEncryptionP
     default boolean isExtractStandardAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
         return true;
     }
+    
+    /**
+     * Get whether the client address must match between request issuance and response receipt.
+     * 
+     * <p>Defaults to "false".</p>
+     * 
+     * <p>TODO: Default implementation should be removed in 4.0.0</p>
+     * 
+     * @param profileRequestContext current profile request context
+     * 
+     * @return whether to compare addresses
+     * 
+     * @since 3.4.0
+     */
+    @ConfigurationSetting(name="checkAddress")
+    default boolean isCheckAddress(@Nullable final ProfileRequestContext profileRequestContext) {
+        return false;
+    }
 
 }
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
index 0e060223..a762fcc2 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/AbstractOIDCSSOConfiguration.java
@@ -124,6 +124,9 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
     
     /** Whether to perform standard response data extraction. */
     @Nonnull private Predicate<ProfileRequestContext> extractStandardAttributesPredicate;
+    
+    /** Whether the client address must match between request issuance and response receipt. */
+    @Nonnull private Predicate<ProfileRequestContext> checkAddressPredicate;
 
     /**
      * Creates a new configuration instance.
@@ -160,6 +163,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
         attributeExtractionStrategyLookupStrategy = FunctionSupport.constant(null);
         validateAcrValue = PredicateSupport.alwaysTrue();
         extractStandardAttributesPredicate = PredicateSupport.alwaysTrue();
+        checkAddressPredicate = PredicateSupport.alwaysFalse();
     }
     
     /** {@inheritDoc} */
@@ -813,6 +817,7 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
     }
     
     /** {@inheritDoc} */
+    @Override
     public boolean isExtractStandardAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
         return extractStandardAttributesPredicate.test(profileRequestContext);
     }
@@ -840,4 +845,31 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
                 Constraint.isNotNull(condition, "Standard extraction predicate cannot be null");
     }
 
+    /** {@inheritDoc} */
+    @Override
+    public boolean isCheckAddress(@Nullable final ProfileRequestContext profileRequestContext) {
+        return checkAddressPredicate.test(profileRequestContext);
+    }
+    
+    /**
+     * Set whether the client address must match between request issuance and response receipt.
+     * 
+     * @param flag flag to set
+     * 
+     * @since 3.4.0
+     */
+    public void setCheckAddress(final boolean flag) {
+        checkAddressPredicate = PredicateSupport.constant(flag);
+    }
+    
+    /**
+     * Set whether the client address must match between request issuance and response receipt.
+     * 
+     * @param condition condition to set
+     * 
+     * @since 3.4.0
+     */
+    public void setCheckAddressPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        checkAddressPredicate = Constraint.isNotNull(condition, "Address checking predicate cannot be null");
+    }
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.