[java-idp-plugin-oidc-op-oidfed] 02/02: Adapt into current shape of java-oidfed-common.
Codeberg
noreply at shibboleth.net
Fri May 15 13:25:43 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch dev/OIDFED-COMMON
in repository java-idp-plugin-oidc-op-oidfed.
View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-oidc-op-oidfed/commit/8885a6453166216f5ee1cc9a71f5b6eef2f18430
commit 8885a6453166216f5ee1cc9a71f5b6eef2f18430
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 15 16:24:44 2026 +0300
Adapt into current shape of java-oidfed-common.
- ProviderMetadataEntityConfigurationMetadataDecorator decorates the entity configuration's 'openid_provider' metadata
---
.../oidc/op/oidfed/metadata/BaseJWTWrapper.java | 50 --
.../oidc/op/oidfed/metadata/BasePayload.java | 45 -
.../op/oidfed/metadata/EntityConfiguration.java | 24 -
.../oidc/op/oidfed/metadata/EntityStatement.java | 37 -
.../op/oidfed/metadata/ResolveEntityResponse.java | 24 -
.../oidc/op/oidfed/metadata/SignedKeyset.java | 25 -
.../op/oidfed/metadata/SubordinateStatement.java | 24 -
.../plugin/oidc/op/oidfed/metadata/TrustMark.java | 24 -
.../oidc/op/oidfed/metadata/TrustMarkStatus.java | 24 -
.../payload/BaseExpirableSubjectPayload.java | 39 -
.../metadata/payload/BaseMetadataPayload.java | 30 -
.../payload/EntityConfigurationPayload.java | 67 --
.../metadata/payload/EntityStatementPayload.java | 41 -
.../payload/ResolveEntityResponsePayload.java | 41 -
.../metadata/payload/SignedKeysetPayload.java | 33 -
.../payload/SubordinateStatementPayload.java | 59 --
.../oidfed/metadata/payload/TrustMarkPayload.java | 51 --
.../metadata/payload/TrustMarkStatusPayload.java | 40 -
.../op/oidfed/metadata/payload/claim/Metadata.java | 83 --
.../metadata/payload/claim/TrustMarkOwner.java | 49 --
.../oidfed/profile/ProvidedTrustChainResolver.java | 32 -
.../op/oidfed/profile/TrustedRemoteEntity.java | 74 --
.../profile/TrustedRemoteResolverEntity.java | 81 --
...nAutomaticRegistrationProfileConfiguration.java | 54 --
...ionEntityConfigurationProfileConfiguration.java | 82 --
...tityStatementProducingProfileConfiguration.java | 73 --
...onExplicitRegistrationProfileConfiguration.java | 52 --
.../config/OIDFederationProfileConfiguration.java | 23 -
...FederationRegistrationProfileConfiguration.java | 40 -
...ederationResolveEntityProfileConfiguration.java | 56 --
...erationResponseCachingProfileConfiguration.java | 47 -
...FederationSignedKeysetProfileConfiguration.java | 32 -
...ionTrustMarkValidatingProfileConfiguration.java | 74 --
.../navigate/AuthorityHintsLookupFunction.java | 48 -
.../CachedErrorResponseLifetimeLookupFunction.java | 46 -
...achedSuccessResponseLifetimeLookupFunction.java | 46 -
.../ClaimsSetDecorationTypeLookupFunction.java | 50 --
...laimsSetManipulationStrategyLookupFunction.java | 52 --
.../EntityStatementLifetimeLookupFunction.java | 52 --
.../LocalMetadataPolicyLookupFunction.java | 49 --
.../MandatoryTrustMarksLookupFunction.java | 48 -
.../MaximumTrustMarkLifetimeLookupFunction.java | 52 --
...tionalClaimsLookupStrategiesLookupFunction.java | 52 --
...ChainClaimsSetDecorationTypeLookupFunction.java | 50 --
.../RemoteTrustMarkValidationPredicate.java | 43 -
.../TokenEndpointAuthMethodLookupFunction.java | 56 --
.../context/RelyingPartyTrustChainContext.java | 4 +-
.../oidfed/profile/context/VerifiedTrustChain.java | 4 +-
.../navigate/TrustAnchorIdLookupFunction.java | 2 +-
.../support/ClientInformationExtensionSupport.java | 95 --
.../ExplicitClientRegistrationRequestDecoder.java | 8 +-
.../decoding/impl/ResolveEntityRequestDecoder.java | 2 +-
.../messaging/impl/AbstractSignedJWTResponse.java | 87 --
.../impl/EntityConfigurationResponse.java | 55 --
.../impl/ExplicitClientRegistrationRequest.java | 102 ---
.../impl/ExplicitClientRegistrationResponse.java | 88 --
.../messaging/impl/ResolveEntityRequest.java | 140 ---
.../messaging/impl/ResolveEntityResponse.java | 87 --
.../messaging/impl/SignedKeysetResponse.java | 55 --
...FederationEndpointResponseFetchingStrategy.java | 328 -------
...actTrustEngineSignatureValidationComponent.java | 103 ---
.../cache/BaseExpirableMetadataContainer.java | 61 --
.../cache/BaseExpirableStatementContainer.java | 97 --
...icationSecurityConfigurationLookupFunction.java | 117 ---
.../DefaultClientAuthenticationLookupFunction.java | 113 ---
...tEntityStatementContentValidationCondition.java | 181 ----
...faultEntityStatementMetadataFilterStrategy.java | 120 ---
...ntityStatementSignatureValidationCondition.java | 96 --
...atementValidationCriteriaSetLookupFunction.java | 116 ---
...tPrivateKeyJwtClientAuthenticationFunction.java | 315 -------
...ultResponseContainerExpirationTimeStrategy.java | 47 -
...DefaultTrustChainHeaderValidationCondition.java | 196 -----
...FederationEndpointEntityStatementCriterion.java | 78 --
.../metadata/cache/IssuerEntityIDCriterion.java | 78 --
.../cache/IssuerEntityStatementCriterion.java | 78 --
.../cache/PreSelectedTrustChainCriterion.java | 80 --
.../ResponseContainerExpirationCriterion.java | 79 --
...ignatureValidationKeyContainerJwtCriterion.java | 101 ---
.../metadata/cache/SubjectEntityIDCriterion.java | 79 --
.../cache/SubjectEntityStatementCriterion.java | 78 --
.../cache/SubjectLocallyTrustedKeysCriterion.java | 79 --
.../metadata/cache/SubjectStatementCriterion.java | 79 --
.../cache/TrustAnchorEntityIDsCriterion.java | 80 --
.../oidfed/metadata/cache/TrustMarkCriterion.java | 79 --
.../metadata/cache/TrustMarkOwnersCriterion.java | 81 --
...tityConfigurationCriteriaSetLookupFunction.java | 47 -
...DefaultEntityConfigurationFetchingStrategy.java | 138 ---
.../EntityConfigurationContainer.java | 59 --
.../ProvidedEntityConfigurationContainer.java | 54 --
...videdEntityConfigurationContainerCriterion.java | 88 --
...faultSignedKeysetCriteriaSetLookupFunction.java | 49 --
.../DefaultSignedKeysetFetchingStrategy.java | 145 ---
.../cache/keyset/SignedKeysetCacheIdentifier.java | 105 ---
.../cache/keyset/SignedKeysetContainer.java | 68 --
.../cache/keyset/SubjectSignedKeysetCriterion.java | 78 --
.../keyset/SubjectSignedKeysetUriCriterion.java | 79 --
...onfigurationMetadataSkeletonLookupStrategy.java | 86 --
...ntityConfigurationResponseFetchingStrategy.java | 60 --
...StatementSignatureValidationFilterStrategy.java | 63 --
.../local/DefaultLocalTrustAnchorsValidator.java | 58 --
...busResponseContainerExpirationTimeStrategy.java | 58 --
...faultResolveEntityResponseFetchingStrategy.java | 67 --
.../metadata/cache/local/LocalKeyContainer.java | 55 --
.../cache/local/NimbusResponseContainer.java | 71 --
.../cache/local/NimbusResponseCriterion.java | 80 --
.../cache/local/ResolveEntityRequestCriterion.java | 80 --
.../local/ResolveEntityResponseContainer.java | 61 --
...ultResolveEntityTrustChainFetchingStrategy.java | 162 ----
.../ResolveEntityCacheContainerIdentifier.java | 143 ---
.../ResolveEntityCacheIdentifierCriterion.java | 78 --
.../resolver/ResolveEntityResponseContainer.java | 69 --
...inateStatementCriteriaToIdentifierStrategy.java | 93 --
...efaultSubordinateStatementFetchingStrategy.java | 236 -----
.../SubordinateStatementCacheIdentifier.java | 103 ---
.../subordinate/SubordinateStatementContainer.java | 69 --
.../DefaultTrustChainFetchingStrategy.java | 463 ----------
...rustChainSignatureValidationFilterStrategy.java | 176 ----
...stChainSubjectIdentifierExtractionStrategy.java | 45 -
.../trustchain/ProvidedTrustChainContainer.java | 49 --
.../ProvidedTrustChainContainerCriterion.java | 81 --
.../cache/trustchain/TrustChainsContainer.java | 98 ---
.../DefaultTrustMarkFetchingStrategy.java | 158 ----
.../DefaultTrustMarkStatusFetchingStrategy.java | 144 ---
...ustMarkValidationCriteriaSetLookupFunction.java | 124 ---
.../cache/trustmark/TrustMarkCacheIdentifier.java | 120 ---
.../cache/trustmark/TrustMarkContainer.java | 68 --
.../trustmark/TrustMarkIdentifierCriterion.java | 78 --
.../trustmark/TrustMarkStatusCacheIdentifier.java | 103 ---
.../cache/trustmark/TrustMarkStatusContainer.java | 80 --
.../TrustMarkStatusIdentifierCriterion.java | 78 --
.../constraints/FederationPolicyConstraint.java | 42 -
.../FederationPolicyConstraintHelper.java | 78 --
.../impl/AbstractFederationPolicyConstraint.java | 82 --
.../impl/DefaultAllowedEntityTypesConstraint.java | 160 ----
.../impl/DefaultMaxPathLengthConstraint.java | 67 --
.../impl/DefaultNamingConstraintsConstraint.java | 122 ---
.../metadata/impl/AbstractJWTWrapperImpl.java | 92 --
.../metadata/impl/EntityConfigurationImpl.java | 65 --
.../oidfed/metadata/impl/EntityStatementImpl.java | 59 --
.../metadata/impl/ResolveEntityResponseImpl.java | 64 --
.../op/oidfed/metadata/impl/SignedKeysetImpl.java | 63 --
.../metadata/impl/SubordinateStatementImpl.java | 64 --
.../op/oidfed/metadata/impl/TrustMarkImpl.java | 63 --
.../oidfed/metadata/impl/TrustMarkStatusImpl.java | 64 --
.../metadata/jackson/InstantDeserializer.java | 52 --
.../oidfed/metadata/jackson/JWKDeserializer.java | 72 --
.../metadata/jackson/JWKSetDeserializer.java | 72 --
.../jackson/LocalKeyContainerDeserializer.java | 58 --
.../metadata/payload/claim/impl/MetadataImpl.java | 293 ------
.../payload/claim/impl/TrustMarkOwnerImpl.java | 120 ---
.../impl/BaseExpirableSubjectPayloadImpl.java | 102 ---
.../payload/impl/BaseMetadataPayloadImpl.java | 66 --
.../metadata/payload/impl/BasePayloadImpl.java | 131 ---
.../impl/EntityConfigurationPayloadImpl.java | 186 ----
.../payload/impl/EntityStatementPayloadImpl.java | 108 ---
.../impl/ResolveEntityResponsePayloadImpl.java | 106 ---
.../payload/impl/SignedKeysetPayloadImpl.java | 82 --
.../impl/SubordinateStatementPayloadImpl.java | 161 ----
.../payload/impl/TrustMarkPayloadImpl.java | 149 ----
.../payload/impl/TrustMarkStatusPayloadImpl.java | 101 ---
.../FederationMetadataPolicyDeserializer.java | 159 ----
.../policy/FederationMetadataPolicyHelper.java | 80 --
.../policy/FederationMetadataPolicyOperator.java | 57 --
.../AbstractFederationMetadataPolicyOperator.java | 56 --
...DefaultFederationMetadataPolicyAddOperator.java | 115 ---
...ultFederationMetadataPolicyDefaultOperator.java | 44 -
.../DefaultFederationMetadataPolicyEnforcer.java | 95 --
...tFederationMetadataPolicyEssentialOperator.java | 46 -
...ultFederationMetadataPolicyMergingStrategy.java | 102 ---
...faultFederationMetadataPolicyOneOfOperator.java | 72 --
...ltFederationMetadataPolicySubsetOfOperator.java | 94 --
...FederationMetadataPolicySupersetOfOperator.java | 92 --
...faultFederationMetadataPolicyValueOperator.java | 88 --
.../metadata/util/EntityStatementHelper.java | 203 -----
...FederationRegistrationProfileConfiguration.java | 196 -----
...erationResponseCachingProfileConfiguration.java | 90 --
...nAutomaticRegistrationProfileConfiguration.java | 117 ---
...ionEntityConfigurationProfileConfiguration.java | 237 -----
...onExplicitRegistrationProfileConfiguration.java | 341 -------
...ederationResolveEntityProfileConfiguration.java | 274 ------
...FederationSignedKeysetProfileConfiguration.java | 199 -----
.../impl/AbstractBuildEntityStatementAction.java | 301 -------
.../impl/AbstractTrustChainResolutionAction.java | 16 +-
.../impl/AddExtensionsToClientInformation.java | 4 +-
...edClientInformationStoreClaimsSetDecorator.java | 4 +-
.../profile/impl/BuildEntityConfiguration.java | 215 -----
.../impl/BuildExplicitRegistrationResponse.java | 1 +
.../BuildResolveEntityErrorResponseFromEvent.java | 13 +-
.../profile/impl/BuildResolveEntityResponse.java | 5 +-
.../op/oidfed/profile/impl/BuildSignedKeyset.java | 6 +-
.../oidfed/profile/impl/CallResolveEntityApi.java | 30 +-
.../impl/DefaultProvidedTrustChainResolver.java | 4 +-
...TrustMarkFromMetadataCacheFetchingFunction.java | 205 -----
.../profile/impl/EntityStatementContext.java | 133 ---
.../impl/EntityStatementUpdateStrategy.java | 57 --
.../impl/FormExplicitRegistrationResponse.java | 3 +-
...ormOutboundFederationConfigurationResponse.java | 214 -----
.../impl/FormOutboundResolveEntityResponse.java | 16 +-
.../impl/FormOutboundSignedKeysetResponse.java | 12 +-
.../impl/InitializeEntityStatementContext.java | 199 -----
.../InitializeEntityStatementContextForKeyset.java | 1 +
...ClaimsSetFromEntityStatementLookupFunction.java | 85 --
.../profile/impl/LookupCachedNimbusResponse.java | 140 ---
.../impl/LookupCachedResolveEntityResponse.java | 7 +-
...tadataEntityConfigurationMetadataDecorator.java | 174 ++++
.../impl/RelyingPartyCachedMessageContext.java | 75 --
.../op/oidfed/profile/impl/ResolveTrustChains.java | 10 +-
.../op/oidfed/profile/impl/ResolveTrustMarks.java | 12 +-
.../op/oidfed/profile/impl/SelectTrustChain.java | 2 +-
...eAutomaticRegistrationProfileConfiguration.java | 14 +-
.../impl/ValidateProvidedEntityConfiguration.java | 2 +-
.../profile/impl/ValidateProvidedTrustChain.java | 4 +-
.../profile/impl/ValidateResolveEntityRequest.java | 7 +-
.../profile/impl/ValidateSelectedTrustChain.java | 9 +-
.../op/oidfed/profile/impl/ValidateTrustMarks.java | 10 +-
...videdEntityConfigurationValidationStrategy.java | 10 +-
...efaultProvidedTrustChainValidationStrategy.java | 8 +-
...actRequestObjectProvidedTrustChainResolver.java | 6 +-
...mbinedMetadataFromTrustChainLookupStrategy.java | 2 +-
...ntityConfigurationTrustMarksLookupStrategy.java | 77 --
.../navigate/DefaultEntityTypesLookupFunction.java | 2 +-
...DefaultSelectedTrustChainIDsLookupStrategy.java | 2 +-
.../DefaultTrustAnchorHintsLookupStrategy.java | 89 --
.../DefaultTrustChainIDsLookupStrategy.java | 2 +-
...ultTrustChainMetadataPolicyMergingStrategy.java | 4 +-
.../DefaultTrustChainSelectionStrategy.java | 2 +-
...DefaultTrustChainTrustMarksParsingStrategy.java | 4 +-
...ChainTrustedTrustMarkIssuersLookupStrategy.java | 4 +-
...tChainTrustedTrustMarkOwnersLookupStrategy.java | 6 +-
...tRegistrationRequestClientIDLookupFunction.java | 6 +-
...onRequestEntityConfigurationLookupFunction.java | 4 +-
...entRegistrationRequestJWKSetLookupFunction.java | 6 +-
...lientRegistrationRequestTrustChainResolver.java | 6 +-
...ormationFederationEntityCredentialResolver.java | 127 ---
...ientInformationSignedKeysetJWKSetDecorator.java | 8 +-
...faultEntityConfigurationCredentialResolver.java | 90 --
.../DefaultLocalTrustAnchorCredentialResolver.java | 109 ---
...DefaultPayloadJOSEObjectCredentialResolver.java | 84 --
...yloadSignatureValidationCredentialResolver.java | 82 --
...aultSubordinateStatementCredentialResolver.java | 121 ---
.../DefaultTrustMarkOwnerCredentialResolver.java | 91 --
.../DefaultTrustMarkStatusCredentialResolver.java | 102 ---
...ticationSignatureSigningParametersResolver.java | 117 ---
.../impl/ConstraintsSyntaxClaimsValidator.java | 100 ---
.../jwt/claims/impl/CritClaimsValidator.java | 97 --
...faultMetadataPolicyOperatorsLookupStrategy.java | 103 ---
.../impl/MetadataPolicyCritClaimsValidator.java | 105 ---
.../impl/NonEmptyStringArrayClaimsValidator.java | 88 --
.../impl/TrustMarkOwnersClaimsValidator.java | 81 --
.../jwt/claims/impl/TrustMarksClaimsValidator.java | 109 ---
.../META-INF/net.shibboleth.idp/postconfig.xml | 979 +--------------------
.../oidfed/metadata-lookup-ext-oidfed-beans.xml | 30 +-
.../entity-configuration-beans.xml | 165 ----
.../entity-configuration-flow.xml | 39 -
.../idp/flows/oidfed/register/register-beans.xml | 50 +-
.../oidfed/resolve-entity/resolve-entity-beans.xml | 18 +-
.../oidfed/signed-keyset/signed-keyset-beans.xml | 16 +-
.../idp/service/relying-party/postconfig.xml | 96 +-
.../conf/oidfed/oidfed-trustchain-resolver.xml | 2 +-
.../plugin/oidc/op/oidfed/TrustChainTestUtil.java | 16 +-
.../DefaultTrustChainFetchingStrategyTest.java | 22 +-
.../flow/oidfed/AbstractFederationFlowTest.java | 10 +-
.../flow/oidfed/EntityConfigurationFlowTest.java | 8 +-
.../profile/flow/oidfed/RegistrationFlowTest.java | 4 +-
.../profile/flow/oidfed/ResolveEntityFlowTest.java | 4 +-
.../profile/flow/oidfed/SignedKeysetFlowTest.java | 6 +-
.../EntityConfigurationMetadataCacheTest.java | 14 +-
.../cache/SignedKeysetMetadataCacheTest.java | 18 +-
.../SubordinateStatementMetadataCacheTest.java | 20 +-
.../oidfed/cache/TrustChainMetadataCacheTest.java | 12 +-
.../CustomEntityConfigurationFilterStrategy.java | 8 +-
.../CustomSubordinateStatementFilterStrategy.java | 8 +-
.../support/CustomTrustChainFilterStrategy.java | 4 +-
.../oidfed/oidfed-entity-configuration-claims.xml | 44 -
.../conf/oidfed/oidfed-trustchain-resolver.xml | 6 +-
.../idp/module/conf/oidfed/oidfed.properties | 1 +
276 files changed, 486 insertions(+), 20968 deletions(-)
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/BaseJWTWrapper.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/BaseJWTWrapper.java
deleted file mode 100644
index 19fa380..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/BaseJWTWrapper.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
-/**
- * Base wrapper interface containing {@link SignedJWT} and its parsed payload.
- *
- * @param <T> payload format
- */
-public interface BaseJWTWrapper<T extends BasePayload> {
-
- /**
- * Get the entity statement as JWT.
- *
- * @return JWT
- */
- @Nonnull public SignedJWT getJwt();
-
- /**
- * Get the issuer claim of the entity statement.
- *
- * @return issuer
- */
- @Nonnull @NotEmpty public String getIssuer();
-
- /**
- * Get the payload of the entity statement.
- *
- * @return payload
- */
- @Nonnull public T getParsedPayload();
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/BasePayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/BasePayload.java
deleted file mode 100644
index d20a39c..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/BasePayload.java
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import java.time.Instant;
-import java.util.Map;
-
-/**
- * Base payload for claims used within all payloads.
- */
-public interface BasePayload {
-
- /**
- * Get the issuer.
- *
- * @return issuer
- */
- public String getIssuer();
-
- /**
- * Get the issuance time.
- *
- * @return issuance time
- */
- public Instant getIssuedAt();
-
- /**
- * Get the map of custom claims.
- *
- * @return The map of any other claims not directly mapped.
- */
- public Map<String, Object> getCustomClaims();
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/EntityConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/EntityConfiguration.java
deleted file mode 100644
index 4b4e5cd..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/EntityConfiguration.java
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityConfigurationPayload;
-
-/**
- * A wrapper interface extending {@link EntityStatement} with parsed claims related to entity configuration.
- */
-public interface EntityConfiguration extends EntityStatement<EntityConfigurationPayload> {
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/EntityStatement.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/EntityStatement.java
deleted file mode 100644
index 5438fe8..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/EntityStatement.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityStatementPayload;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
-/**
- * A wrapper inteface containing the {@link SignedJWT} and parsed claims related to entity statement.
- *
- * @param <T> payload format
- */
-public interface EntityStatement<T extends EntityStatementPayload> extends BaseJWTWrapper<T> {
-
- /**
- * Get the subject claim of the entity statement.
- *
- * @return subject
- */
- @Nonnull @NotEmpty public String getSubject();
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResolveEntityResponse.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResolveEntityResponse.java
deleted file mode 100644
index f4339b9..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/ResolveEntityResponse.java
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.ResolveEntityResponsePayload;
-
-/**
- * A wrapper interface extending {@link BaseJWTWrapper} with parsed claims related to resolve entity response.
- */
-public interface ResolveEntityResponse extends BaseJWTWrapper<ResolveEntityResponsePayload> {
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SignedKeyset.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SignedKeyset.java
deleted file mode 100644
index 926d381..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SignedKeyset.java
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.SignedKeysetPayload;
-
-/**
- * A wrapper inteface containing the {@link SignedJWT} and parsed claims related to signed keyset.
- */
-public interface SignedKeyset extends BaseJWTWrapper<SignedKeysetPayload> {
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SubordinateStatement.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SubordinateStatement.java
deleted file mode 100644
index aa01966..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/SubordinateStatement.java
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.SubordinateStatementPayload;
-
-/**
- * A wrapper interface extending {@link EntityStatement} with parsed claims related to subordinate statements.
- */
-public interface SubordinateStatement extends EntityStatement<SubordinateStatementPayload> {
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMark.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMark.java
deleted file mode 100644
index 71858b2..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMark.java
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.TrustMarkPayload;
-
-/**
- * A wrapper interface extending {@link BaseJWTWrapper} with parsed claims related to trust mark.
- */
-public interface TrustMark extends BaseJWTWrapper<TrustMarkPayload> {
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMarkStatus.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMarkStatus.java
deleted file mode 100644
index 56e8b4a..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/TrustMarkStatus.java
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.TrustMarkStatusPayload;
-
-/**
- * A wrapper interface extending {@link BaseJWTWrapper} with parsed claims related to trust mark status.
- */
-public interface TrustMarkStatus extends BaseJWTWrapper<TrustMarkStatusPayload> {
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/BaseExpirableSubjectPayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/BaseExpirableSubjectPayload.java
deleted file mode 100644
index e39d662..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/BaseExpirableSubjectPayload.java
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload;
-
-import java.time.Instant;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BasePayload;
-
-/**
- * Base payload carrying subject and expiration.
- */
-public interface BaseExpirableSubjectPayload extends BasePayload {
-
- /**
- * Get the subject.
- *
- * @return subject
- */
- public String getSubject();
-
- /**
- * Get the expiration time.
- *
- * @return expiration time
- */
- public Instant getExpiration();
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/BaseMetadataPayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/BaseMetadataPayload.java
deleted file mode 100644
index abf345e..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/BaseMetadataPayload.java
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
-
-/**
- * Base payload carrying metadata claim.
- */
-public interface BaseMetadataPayload extends BaseExpirableSubjectPayload {
-
- /**
- * Get the metadata.
- *
- * @return metadata
- */
- public Metadata getMetadata();
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/EntityConfigurationPayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/EntityConfigurationPayload.java
deleted file mode 100644
index 2d5db58..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/EntityConfigurationPayload.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload;
-
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.TrustMarkOwner;
-
-/**
- * Entity Configuration payload claims as defined by the OpenID Federation 1.0 Section 3.2. This class extends the
- * list of claims defined by {@link EntityStatementPayload} with the claims that MUST or MAY appear in Entity
- * Configurations but not in Subordinate Statements.
- */
-public interface EntityConfigurationPayload extends EntityStatementPayload {
-
- /**
- * Get the array of strings representing the Entity Identifiers of Immediate Superiors.
- *
- * @return authority hints
- */
- @Nullable public List<String> getAuthorityHints();
-
- /**
- * Get the array of strings representing the Entity Identifiers of Trust Anchors trusted by the Entity.
- *
- * @return trust anchor hints
- */
- @Nullable public List<String> getTrustAnchorHints();
-
- /**
- * Get the array of Trust Marks.
- *
- * @return trust marks
- */
- @Nullable public List<Map<String, String>> getTrustMarks();
-
- /**
- * Get the map of arrays of Entity Identifiers that are trusted to represent the accreditation authority for Trust
- * Marks.
- *
- * @return trust mark issuers
- */
- @Nullable public Map<String, List<String>> getTrustMarkIssuers();
-
- /**
- * Get the map of Owners of the Trust Marks.
- *
- * @return trust mark owners
- */
- @Nullable public Map<String, TrustMarkOwner> getTrustMarkOwners();
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/EntityStatementPayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/EntityStatementPayload.java
deleted file mode 100644
index d9bc403..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/EntityStatementPayload.java
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload;
-
-import java.util.List;
-
-import com.nimbusds.jose.jwk.JWKSet;
-
-/**
- * Entity Statement payload claims as defined by the OpenID Federation 1.0 Section 3.1. These claims MUST or MAY appear
- * in both Entity Configurations and Subordinate Statements.
- */
-public interface EntityStatementPayload extends BaseMetadataPayload {
-
- /**
- * Get the JWK set.
- *
- * @return JWK set
- */
- public JWKSet getJwks();
-
- /**
- * Get the critical claims.
- *
- * @return critical claims
- */
- public List<String> getCritical();
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/ResolveEntityResponsePayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/ResolveEntityResponsePayload.java
deleted file mode 100644
index 2ced07b..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/ResolveEntityResponsePayload.java
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload;
-
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nullable;
-
-/**
- * Resolve Entity response payload claims as defined by the OpenID Federation 1.0 Section 8.3.2.
- */
-public interface ResolveEntityResponsePayload extends BaseMetadataPayload {
-
- /**
- * Get the array containing the sequence of Entity Statements that compose the Trust Chain.
- *
- * @return trust chain
- */
- @Nullable public List<String> getTrustChain();
-
- /**
- * Get the array of Trust Marks.
- *
- * @return trust marks
- */
- @Nullable public List<Map<String, String>> getTrustMarks();
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/SignedKeysetPayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/SignedKeysetPayload.java
deleted file mode 100644
index 87d2415..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/SignedKeysetPayload.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload;
-
-import java.util.List;
-
-import com.nimbusds.jose.jwk.JWK;
-
-/**
- * Signed keyset payload claims as defined by the OpenID Federation 1.0 Section 5.2.1.
- */
-public interface SignedKeysetPayload extends BaseExpirableSubjectPayload {
-
- /**
- * Get the JWK set.
- *
- * @return JWK set
- */
- public List<JWK> getKeys();
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/SubordinateStatementPayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/SubordinateStatementPayload.java
deleted file mode 100644
index 93a4ece..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/SubordinateStatementPayload.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload;
-
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-
-/**
- * Subordinate Statement payload claims as defined by the OpenID Federation 1.0 Section 3.3. This class extends the
- * list of claims defined by {@link EntityStatementPayload} with the claims that MUST or MAY appear in Subordinate
- * Statements but not in Entity Configurations.
- */
-public interface SubordinateStatementPayload extends EntityStatementPayload {
-
- /**
- * Get the map that defines Trust Chain constraints.
- *
- * @return constraints
- */
- @Nullable public Map<String, Object> getConstraints();
-
- /**
- * Get the map that defines a metadata policy.
- *
- * @return metadata policy
- */
- @Nullable public Map<String, Map<String, MetadataPolicy>> getMetadataPolicy();
-
- /**
- * Get the list of critical metadata policy operators.
- *
- * @return critical metadata policy operators
- */
- @Nullable public List<String> getMetadataPolicyCritical();
-
- /**
- * Get the fetch endpoint URL from which the entity statement was issued.
- *
- * @return fetch endpoint URL
- */
- @Nullable public String getSourceEndpoint();
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/TrustMarkPayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/TrustMarkPayload.java
deleted file mode 100644
index 0a0dcbb..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/TrustMarkPayload.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload;
-
-import javax.annotation.Nullable;
-
-/**
- * Trust Mark payload claims as defined by the OpenID Federation 1.0 Section 7.1.
- */
-public interface TrustMarkPayload extends BaseExpirableSubjectPayload {
-
- /**
- * Get the identifier of the type of the Trust Mark.
- *
- * @return trust mark type
- */
- @Nullable public String getTrustMarkType();
-
- /**
- * Get the URL that references a logo for the issued Trust Mark.
- *
- * @return logo URL
- */
- @Nullable public String getLogoUri();
-
- /**
- * Get the URL referring to human-readable information about the issuance of the Trust Mark.
- *
- * @return reference URL
- */
- @Nullable public String getReference();
-
- /**
- * Get the Trust Mark delegation JWT.
- *
- * @return delegation JWT
- */
- @Nullable public String getDelegation();
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/TrustMarkStatusPayload.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/TrustMarkStatusPayload.java
deleted file mode 100644
index 02d787d..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/TrustMarkStatusPayload.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BasePayload;
-
-/**
- * Trust Mark Status payload claims as defined by the OpenID Federation 1.0 Section 8.4.2.
- */
-public interface TrustMarkStatusPayload extends BasePayload {
-
- /**
- * Get the Trust Mark.
- *
- * @return trust mark
- */
- @Nullable public String getTrustMark();
-
- /**
- * Get the status indicator for the Trust Mark.
- *
- * @return status
- */
- @Nullable public String getStatus();
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/Metadata.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/Metadata.java
deleted file mode 100644
index 38468e4..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/Metadata.java
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim;
-
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-/**
- * Metadata claim as defined by the OpenID Federation 1.0 Section 5.
- */
-public interface Metadata {
-
- /**
- * Get the federation entity metadata.
- *
- * @return federation entity metadata
- */
- @Nullable public Map<String,Object> getFederationEntityMetadata();
-
- /**
- * Get the OpenID Connect Relying Party metadata.
- *
- * @return OIDC RP metadata
- */
- @Nullable public Map<String,Object> getOpenidRelyingPartyMetadata();
-
- /**
- * Get the OpenID Connect OpenID Provider metadata.
- *
- * @return OIDC OP metadata
- */
- @Nullable public Map<String,Object> getOpenidProviderMetadata();
-
- /**
- * Get the OAuth Authorization Server metadata.
- *
- * @return OAuth AS metadata
- */
- @Nullable public Map<String,Object> getOauthAuthorizationServerMetadata();
-
- /**
- * Get the OAuth Client metadata.
- *
- * @return OAuth client metadata
- */
- @Nullable public Map<String,Object> getOauthClientMetadata();
-
- /**
- * Get the OAuth Protected Resource metadata.
- *
- * @return OAuth protected resource metadata
- */
- @Nullable public Map<String,Object> getOauthResourceMetadata();
-
- /**
- * Get the map of custom claims.
- *
- * @return The map of any other claims not directly mapped.
- */
- public Map<String,Map<String, Object>> getCustomClaims();
-
- /**
- * Get all claims (standard and custom) in a map keyed by entity types.
- *
- * @return all claims
- */
- @Nonnull public Map<String,Map<String,Object>> getAllClaims();
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/TrustMarkOwner.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/TrustMarkOwner.java
deleted file mode 100644
index 114ece6..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/TrustMarkOwner.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim;
-
-import java.util.Map;
-
-import javax.annotation.Nullable;
-
-import com.nimbusds.jose.jwk.JWKSet;
-
-/**
- * Trust mark owner claim to be used with a map of trust_mark_owners as defined by the OpenID Federation 1.0 Section
- * 3.1.2.
- */
-public interface TrustMarkOwner {
-
- /**
- * Get the subject.
- *
- * @return subject
- */
- @Nullable public String getSub();
-
- /**
- * Get the JWK set.
- *
- * @return JWK set
- */
- @Nullable public JWKSet getJwks();
-
- /**
- * Get the map of custom claims.
- *
- * @return The map of any other claims not directly mapped.
- */
- @Nullable public Map<String, Object> getCustomClaims();
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/ProvidedTrustChainResolver.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/ProvidedTrustChainResolver.java
deleted file mode 100644
index 15e1732..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/ProvidedTrustChainResolver.java
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile;
-
-import java.util.List;
-
-import javax.annotation.concurrent.ThreadSafe;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.shared.resolver.Resolver;
-
-/**
- * A resolver that is capable of finding provided trust chains from the {@link ProfileRequestContext}.
- */
- at ThreadSafe
-public interface ProvidedTrustChainResolver extends Resolver<List<EntityStatement<?>>, ProfileRequestContext> {
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/TrustedRemoteEntity.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/TrustedRemoteEntity.java
deleted file mode 100644
index 624ed2e..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/TrustedRemoteEntity.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile;
-
-import javax.annotation.Nonnull;
-
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A trusted remote entity whose federation endpoints are exploited.
- */
-public class TrustedRemoteEntity {
-
- /** The entity ID of the remote entity. */
- @Nonnull @NotEmpty private final String entityId;
-
- /**
- * Constructor.
- *
- * @param entity entity ID of the remote entity
- */
- public TrustedRemoteEntity(@Nonnull @NotEmpty @ParameterName(name="entity") final String entity) {
- entityId = Constraint.isNotEmpty(entity, "Entity ID cannot be empty");
- }
-
- /**
- * Get the entity ID of the remote entity.
- *
- * @return entity ID of the remote entity
- */
- @Nonnull @NotEmpty public String getEntityId() {
- return entityId;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("entityId", getEntityId())
- .toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final TrustedRemoteEntity other = (TrustedRemoteEntity) obj;
- return entityId.equals(other.entityId);
- }
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/TrustedRemoteResolverEntity.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/TrustedRemoteResolverEntity.java
deleted file mode 100644
index 4871224..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/TrustedRemoteResolverEntity.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile;
-
-import java.util.Collection;
-
-import javax.annotation.Nonnull;
-
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A trusted entity whose federation_resolve_endpoint is exploited.
- */
-public class TrustedRemoteResolverEntity extends TrustedRemoteEntity {
-
- /** The trust anchors to be used within the API request. */
- @Nonnull @NotEmpty private final Collection<String> trustAnchors;
-
- /**
- * Constructor.
- *
- * @param entity ntity ID of the remote resolver
- * @param anchors trust anchors to be used within the API request
- */
- public TrustedRemoteResolverEntity(@Nonnull @NotEmpty @ParameterName(name="entity") final String entity,
- @Nonnull @NotEmpty @ParameterName(name="anchors") final Collection<String> anchors) {
- super(entity);
- trustAnchors = Constraint.isNotEmpty(anchors, "Trust Anchors cannot be empty");
- }
-
- /**
- * Get the trust anchors to be used within the API request.
- *
- * @return trust anchors to be used within the API request
- */
- @Nonnull @NotEmpty public Collection<String> getTrustAnchors() {
- return trustAnchors;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("entityId", getEntityId())
- .add("trustAnchors", getTrustAnchors())
- .toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final TrustedRemoteResolverEntity other = (TrustedRemoteResolverEntity) obj;
- return getEntityId().equals(other.getEntityId()) &&
- trustAnchors.containsAll(other.trustAnchors) && other.trustAnchors.containsAll(trustAnchors);
- }
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationAutomaticRegistrationProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationAutomaticRegistrationProfileConfiguration.java
deleted file mode 100644
index 7ef25f5..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationAutomaticRegistrationProfileConfiguration.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.shared.annotation.ConfigurationSetting;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
-/**
- * Profile configuration for an OpenID Federation Automatic Registration.
- */
-public interface OIDFederationAutomaticRegistrationProfileConfiguration extends OIDFederationRegistrationProfileConfiguration {
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidfed/automaticregistration";
-
- /**
- * Get claims set decoration type.
- *
- * @param profileRequestContext profile request context
- *
- * @return claims set decoration type, or null for default
- */
- @ConfigurationSetting(name="defaultClaimsSetDecorationType")
- @Nullable @NotEmpty String getDefaultClaimsSetDecorationType(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get claims set decoration type for a client with request-provided trust chain.
- *
- * @param profileRequestContext profile request context
- *
- * @return claims set decoration type, or null for default
- */
- @ConfigurationSetting(name="providedChainClaimsSetDecorationType")
- @Nullable @NotEmpty String getProvidedChainClaimsSetDecorationType(
- @Nullable final ProfileRequestContext profileRequestContext);
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityConfigurationProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityConfigurationProfileConfiguration.java
deleted file mode 100644
index ffcd001..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityConfigurationProfileConfiguration.java
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import java.time.Duration;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.shared.annotation.ConfigurationSetting;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Positive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-
-/**
- * Profile configuration for an OpenID Federation Entity Configuration.
- */
-public interface OIDFederationEntityConfigurationProfileConfiguration extends OverriddenIssuerProfileConfiguration,
- OIDFederationProfileConfiguration, OIDFederationEntityStatementProducingProfileConfiguration,
- OIDFederationResponseCachingProfileConfiguration{
-
- /** OIDC base protocol URI. Section 4 is relevant. */
- public static final String PROTOCOL_URI = "https://openid.net/specs/openid-federation-1_0.html";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidfed/configuration";
-
- /**
- * Get the authority hints to be included to the entity configuration.
- *
- * @param profileRequestContext profile request context
- *
- * @return authority hints to be included to the entity configuration
- */
- @ConfigurationSetting(name="authorityHints")
- @Nonnull @NonnullElements @NotLive @Unmodifiable List<String> getAuthorityHints(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get entity statement lifetime.
- *
- * <p>Defaults to 24 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return entity statement lifetime
- */
- @ConfigurationSetting(name="entityStatementLifetime")
- @Positive @Nonnull Duration getEntityStatementLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the lookup strategies for optional claims to be included to the entity configuration.
- *
- * @param profileRequestContext profile request context
- *
- * @return optional claims to be included to the entity configuration
- */
- @ConfigurationSetting(name="optionalClaimsLookupStrategies")
- @Nonnull @NonnullElements @NotLive @Unmodifiable
- Map<String,Function<ProfileRequestContext,Object>> getOptionalClaimsLookupStrategies(
- @Nullable final ProfileRequestContext profileRequestContext);
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityStatementProducingProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityStatementProducingProfileConfiguration.java
deleted file mode 100644
index 30b379a..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationEntityStatementProducingProfileConfiguration.java
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import java.time.Duration;
-import java.util.Map;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.shared.annotation.ConfigurationSetting;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-
-/**
- * Configuration common to OpenID Federation Entity Statement producing profiles.
- */
-public interface OIDFederationEntityStatementProducingProfileConfiguration extends OIDFederationProfileConfiguration {
-
- /**
- * Get the bi-function for manipulating entity statement claims set.
- *
- * @param profileRequestContext profile request context
- *
- * @return the bi-function for manipulating entity statement claims set
- */
- @ConfigurationSetting(name="entityStatementClaimsSetManipulationStrategy")
- @Nullable BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getEntityStatementClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get entity statement lifetime.
- *
- * <p>Defaults to 24 hours.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return entity statement lifetime
- */
- @ConfigurationSetting(name="entityStatementLifetime")
- @Nonnull Duration getEntityStatementLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the lookup strategies for optional claims to be included to the entity statement.
- *
- * @param profileRequestContext profile request context
- *
- * @return optional claims to be included to the entity statement
- */
- @ConfigurationSetting(name="optionalClaimsLookupStrategies")
- @Nonnull @NonnullElements @NotLive @Unmodifiable
- Map<String,Function<ProfileRequestContext,Object>> getOptionalClaimsLookupStrategies(
- @Nullable final ProfileRequestContext profileRequestContext);
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationExplicitRegistrationProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationExplicitRegistrationProfileConfiguration.java
deleted file mode 100644
index 588cfcd..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationExplicitRegistrationProfileConfiguration.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import java.util.Set;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2FlowAwareProfileConfiguration;
-import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.shared.annotation.ConfigurationSetting;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-
-/**
- * Profile configuration for an OpenID Federation Explicit Registration.
- */
-public interface OIDFederationExplicitRegistrationProfileConfiguration
- extends OIDFederationRegistrationProfileConfiguration, OAuth2FlowAwareProfileConfiguration,
- OIDFederationEntityStatementProducingProfileConfiguration, OverriddenIssuerProfileConfiguration {
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidfed/explicitregistration";
-
- /**
- * Get the enabled token endpoint authentication methods.
- *
- * @param profileRequestContext profile request context
- *
- * @return enabled token endpoint authentication methods
- */
- @ConfigurationSetting(name="tokenEndpointAuthMethods")
- @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getTokenEndpointAuthMethods(
- @Nullable final ProfileRequestContext profileRequestContext);
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationProfileConfiguration.java
deleted file mode 100644
index 2d46204..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationProfileConfiguration.java
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ProfileConfiguration;
-
-/** Common interface for OpenID Federation 1.0 Profile Configurations.*/
-public interface OIDFederationProfileConfiguration extends OAuth2ProfileConfiguration {
-
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationRegistrationProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationRegistrationProfileConfiguration.java
deleted file mode 100644
index b6eb87a..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationRegistrationProfileConfiguration.java
+++ /dev/null
@@ -1,40 +0,0 @@
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ProfileConfiguration;
-import net.shibboleth.shared.annotation.ConfigurationSetting;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-
-/**
- * Profile configuration for an OpenID Federation profiles related to client registration.
- */
-public interface OIDFederationRegistrationProfileConfiguration
- extends OAuth2ProfileConfiguration, OIDFederationTrustMarkValidatingProfileConfiguration {
-
- /** OpenID Federation base protocol URI. */
- public static final String PROTOCOL_URI = "https://openid.net/specs/openid-federation-1_0.html";
-
- /**
- * Get local metadata policy to be merged into the federation policy.
- *
- * <p>Defaults to empty map.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return local metadata policy
- */
- @ConfigurationSetting(name="localMetadataPolicy")
- @Nonnull @NonnullElements @NotLive @Unmodifiable
- Map<String, MetadataPolicy> getLocalMetadataPolicy(@Nullable final ProfileRequestContext profileRequestContext);
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationResolveEntityProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationResolveEntityProfileConfiguration.java
deleted file mode 100644
index bdc7ca3..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationResolveEntityProfileConfiguration.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import java.time.Duration;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
-import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.shared.annotation.ConfigurationSetting;
-import net.shibboleth.shared.annotation.constraint.Positive;
-
-/**
- * Profile configuration for an OpenID Federation Resolve Entity.
- */
-public interface OIDFederationResolveEntityProfileConfiguration extends OverriddenIssuerProfileConfiguration,
- OIDFederationProfileConfiguration, OIDFederationResponseCachingProfileConfiguration,
- OAuth2ClientAuthenticableProfileConfiguration, OAuth2ClientAuthenticableClientProfileConfiguration,
- OIDFederationTrustMarkValidatingProfileConfiguration {
-
- /** OIDC base protocol URI. */
- public static final String PROTOCOL_URI = "https://openid.net/specs/openid-federation-1_0.html";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidfed/resolve-entity";
-
- /**
- * Get cached error response lifetime.
- *
- * <p>Defaults to 5 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return cached error response lifetime
- */
- @ConfigurationSetting(name="cachedErrorResponseLifetime")
- @Positive @Nonnull
- Duration getCachedErrorResponseLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationResponseCachingProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationResponseCachingProfileConfiguration.java
deleted file mode 100644
index 651e2d2..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationResponseCachingProfileConfiguration.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import java.time.Duration;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
-import net.shibboleth.shared.annotation.ConfigurationSetting;
-import net.shibboleth.shared.annotation.constraint.Positive;
-
-/**
- * Common interface for OpenID Federation Profiles producing cacheable response messages.
- */
-public interface OIDFederationResponseCachingProfileConfiguration extends OverriddenIssuerProfileConfiguration,
- OIDFederationProfileConfiguration {
-
- /**
- * Get cached success response lifetime.
- *
- * <p>Defaults to 5 minutes.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return cached success response lifetime
- */
- @ConfigurationSetting(name="cachedSuccessResponseLifetime")
- @Positive @Nonnull
- Duration getCachedSuccessResponseLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationSignedKeysetProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationSignedKeysetProfileConfiguration.java
deleted file mode 100644
index eb93b46..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationSignedKeysetProfileConfiguration.java
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import net.shibboleth.profile.config.OverriddenIssuerProfileConfiguration;
-
-/**
- * Profile configuration for an OpenID Federation Entity Configuration.
- */
-public interface OIDFederationSignedKeysetProfileConfiguration extends OverriddenIssuerProfileConfiguration,
- OIDFederationProfileConfiguration, OIDFederationEntityStatementProducingProfileConfiguration,
- OIDFederationResponseCachingProfileConfiguration{
-
- /** OIDC base protocol URI. Section 4 is relevant. */
- public static final String PROTOCOL_URI = "https://openid.net/specs/openid-federation-1_0.html";
-
- /** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/oidfed/keyset";
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationTrustMarkValidatingProfileConfiguration.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationTrustMarkValidatingProfileConfiguration.java
deleted file mode 100644
index a047dfc..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/OIDFederationTrustMarkValidatingProfileConfiguration.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config;
-
-import java.time.Duration;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2ProfileConfiguration;
-import net.shibboleth.shared.annotation.ConfigurationSetting;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Positive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-
-/**
- * Profile configuration for an OpenID Federation profiles related to trust mark consumption.
- */
-public interface OIDFederationTrustMarkValidatingProfileConfiguration extends OAuth2ProfileConfiguration {
-
- /** OpenID Federation base protocol URI. */
- public static final String PROTOCOL_URI = "https://openid.net/specs/openid-federation-1_0.html";
-
- /**
- * Get the mandatory trust mark identifiers required by this profile configuration.
- *
- * @param profileRequestContext profile request context
- *
- * @return mandatory trust mark identifiers
- */
- @ConfigurationSetting(name="mandatoryTrustMarks")
- @Nonnull @NonnullElements @NotLive @Unmodifiable List<String> getMandatoryTrustMarks(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get maximum lifetime for trust marks.
- *
- * <p>Defaults to one year.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return maximum lifetime
- */
- @ConfigurationSetting(name="maximumTrustMarkLifetime")
- @Positive @Nonnull
- Duration getMaximumTrustMarkLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether trust marks should be remotely validated.
- *
- * @param profileRequestContext profile request context
- *
- * @return whether trust marks should be remotely validated
- */
- @ConfigurationSetting(name="remoteTrustMarkValidation")
- boolean isRemoteTrustMarkValidation(@Nullable final ProfileRequestContext profileRequestContext);
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/AuthorityHintsLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/AuthorityHintsLookupFunction.java
deleted file mode 100644
index d1d40ab..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/AuthorityHintsLookupFunction.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationEntityConfigurationProfileConfiguration;
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that obtains {@link OIDFederationEntityConfigurationProfileConfiguration#getAuthorityHints(ProfileRequestContext)}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class AuthorityHintsLookupFunction extends AbstractRelyingPartyLookupFunction<List<String>> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public List<String> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDFederationEntityConfigurationProfileConfiguration ofec) {
- return ofec.getAuthorityHints(input);
- }
- }
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/CachedErrorResponseLifetimeLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/CachedErrorResponseLifetimeLookupFunction.java
deleted file mode 100644
index 3c476b6..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/CachedErrorResponseLifetimeLookupFunction.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.time.Duration;
-import java.util.Optional;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationResolveEntityProfileConfiguration;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns
- * {@link OIDFederationResolveEntityProfileConfiguration#getCachedErrorResponseLifetime(ProfileRequestContext)}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class CachedErrorResponseLifetimeLookupFunction
- extends AbstractRelyingPartyLookupFunction<Duration> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
- return Optional.ofNullable(getRelyingPartyContextLookupStrategy().apply(input))
- .map(relyingPartyContext -> relyingPartyContext.getProfileConfig())
- .filter(OIDFederationResolveEntityProfileConfiguration.class::isInstance)
- .map(OIDFederationResolveEntityProfileConfiguration.class::cast)
- .map(config -> config.getCachedErrorResponseLifetime(input))
- .orElse(null);
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/CachedSuccessResponseLifetimeLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/CachedSuccessResponseLifetimeLookupFunction.java
deleted file mode 100644
index 720705c..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/CachedSuccessResponseLifetimeLookupFunction.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.time.Duration;
-import java.util.Optional;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationResponseCachingProfileConfiguration;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns
- * {@link OIDFederationResponseCachingProfileConfiguration#getCachedSuccessResponseLifetime(ProfileRequestContext)}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class CachedSuccessResponseLifetimeLookupFunction
- extends AbstractRelyingPartyLookupFunction<Duration> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
- return Optional.ofNullable(getRelyingPartyContextLookupStrategy().apply(input))
- .map(relyingPartyContext -> relyingPartyContext.getProfileConfig())
- .filter(OIDFederationResponseCachingProfileConfiguration.class::isInstance)
- .map(OIDFederationResponseCachingProfileConfiguration.class::cast)
- .map(config -> config.getCachedSuccessResponseLifetime(input))
- .orElse(null);
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/ClaimsSetDecorationTypeLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/ClaimsSetDecorationTypeLookupFunction.java
deleted file mode 100644
index 2590ec5..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/ClaimsSetDecorationTypeLookupFunction.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationAutomaticRegistrationProfileConfiguration;
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns
- * {@link OIDFederationAutomaticRegistrationProfileConfiguration#getDefaultClaimsSetDecorationType(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class ClaimsSetDecorationTypeLookupFunction extends AbstractRelyingPartyLookupFunction<String> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public String apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDFederationAutomaticRegistrationProfileConfiguration ofarpc) {
- return ofarpc.getDefaultClaimsSetDecorationType(input);
- }
- }
-
- return null;
- }
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/EntityStatementClaimsSetManipulationStrategyLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/EntityStatementClaimsSetManipulationStrategyLookupFunction.java
deleted file mode 100644
index f1d134c..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/EntityStatementClaimsSetManipulationStrategyLookupFunction.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.util.Map;
-import java.util.function.BiFunction;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationEntityStatementProducingProfileConfiguration;
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns entity statement claims set manipulation strategy from
- * {@link OIDFederationEntityStatementProducingProfileConfiguration} if such a profile is available from a
- * {@link RelyingPartyContext} obtained via a lookup function, by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class EntityStatementClaimsSetManipulationStrategyLookupFunction extends
- AbstractRelyingPartyLookupFunction<BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> apply(
- @Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDFederationEntityStatementProducingProfileConfiguration ofesppc) {
- return ofesppc.getEntityStatementClaimsSetManipulationStrategy(input);
- }
- }
- return null;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/EntityStatementLifetimeLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/EntityStatementLifetimeLookupFunction.java
deleted file mode 100644
index c2504ab..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/EntityStatementLifetimeLookupFunction.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.time.Duration;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationEntityStatementProducingProfileConfiguration;
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns
- * {@link OIDFederationEntityStatementProducingProfileConfiguration#getEntityStatementLifetime(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function, by default a child
- * of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class EntityStatementLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDFederationEntityStatementProducingProfileConfiguration ofec) {
- return ofec.getEntityStatementLifetime(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/LocalMetadataPolicyLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/LocalMetadataPolicyLookupFunction.java
deleted file mode 100644
index 3b845c4..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/LocalMetadataPolicyLookupFunction.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.util.Map;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationRegistrationProfileConfiguration;
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-
-/**
- * A function that obtains
- * {@link OIDFederationRegistrationProfileConfiguration#getLocalMetadataPolicy(ProfileRequestContext)}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class LocalMetadataPolicyLookupFunction extends AbstractRelyingPartyLookupFunction<Map<String, MetadataPolicy>> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Map<String, MetadataPolicy> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDFederationRegistrationProfileConfiguration ofrpc) {
- return ofrpc.getLocalMetadataPolicy(input);
- }
- }
- return null;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/MandatoryTrustMarksLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/MandatoryTrustMarksLookupFunction.java
deleted file mode 100644
index 707e1ca..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/MandatoryTrustMarksLookupFunction.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationTrustMarkValidatingProfileConfiguration;
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that obtains
- * {@link OIDFederationTrustMarkValidatingProfileConfiguration#getMandatoryTrustMarks(ProfileRequestContext)}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class MandatoryTrustMarksLookupFunction extends AbstractRelyingPartyLookupFunction<List<String>> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public List<String> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDFederationTrustMarkValidatingProfileConfiguration ofrpc) {
- return ofrpc.getMandatoryTrustMarks(input);
- }
- }
- return null;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/MaximumTrustMarkLifetimeLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/MaximumTrustMarkLifetimeLookupFunction.java
deleted file mode 100644
index 56e9fc9..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/MaximumTrustMarkLifetimeLookupFunction.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.time.Duration;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationTrustMarkValidatingProfileConfiguration;
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns
- * {@link OIDFederationTrustMarkValidatingProfileConfiguration#getMaximumTrustMarkLifetime(ProfileRequestContext)} if such a
- * profile is available from a {@link RelyingPartyContext} obtained via a lookup function, by default a child of the
- * {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class MaximumTrustMarkLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDFederationTrustMarkValidatingProfileConfiguration ofrpc) {
- return ofrpc.getMaximumTrustMarkLifetime(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/OptionalClaimsLookupStrategiesLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/OptionalClaimsLookupStrategiesLookupFunction.java
deleted file mode 100644
index f28141c..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/OptionalClaimsLookupStrategiesLookupFunction.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationEntityStatementProducingProfileConfiguration;
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns optional entity configuration claims lookup strategies from
- * {@link OIDFederationEntityStatementProducingProfileConfiguration} if such a profile is available from a
- * {@link RelyingPartyContext} obtained via a lookup function, by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class OptionalClaimsLookupStrategiesLookupFunction extends
- AbstractRelyingPartyLookupFunction<Map<String,Function<ProfileRequestContext,Object>>> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Map<String,Function<ProfileRequestContext,Object>> apply(
- @Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDFederationEntityStatementProducingProfileConfiguration ofecpc) {
- return ofecpc.getOptionalClaimsLookupStrategies(input);
- }
- }
- return null;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/ProvidedChainClaimsSetDecorationTypeLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/ProvidedChainClaimsSetDecorationTypeLookupFunction.java
deleted file mode 100644
index 13fd28b..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/ProvidedChainClaimsSetDecorationTypeLookupFunction.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationAutomaticRegistrationProfileConfiguration;
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that returns
- * {@link OIDFederationAutomaticRegistrationProfileConfiguration#getProvidedChainClaimsSetDecorationType(
- * ProfileRequestContext)} if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup
- * function, by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class ProvidedChainClaimsSetDecorationTypeLookupFunction extends AbstractRelyingPartyLookupFunction<String> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public String apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof OIDFederationAutomaticRegistrationProfileConfiguration ofarpc) {
- return ofarpc.getProvidedChainClaimsSetDecorationType(input);
- }
- }
-
- return null;
- }
-
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/RemoteTrustMarkValidationPredicate.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/RemoteTrustMarkValidationPredicate.java
deleted file mode 100644
index 5ef0467..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/RemoteTrustMarkValidationPredicate.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.util.Optional;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationTrustMarkValidatingProfileConfiguration;
-import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
-
-/**
- * A predicate implementation that forwards to
- * {@link OIDFederationTrustMarkValidatingProfileConfiguration#isRemoteTrustMarkValidation(ProfileRequestContext)},
- * defaults to true.
- */
-public class RemoteTrustMarkValidationPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- @Override
- public boolean test(@Nullable final ProfileRequestContext input) {
- return Optional.ofNullable(getRelyingPartyContextLookupStrategy().apply(input))
- .map(rpc -> rpc.getProfileConfig())
- .filter(OIDFederationTrustMarkValidatingProfileConfiguration.class::isInstance)
- .map(OIDFederationTrustMarkValidatingProfileConfiguration.class::cast)
- .map(pc -> pc.isRemoteTrustMarkValidation(input))
- .orElse(true);
- }
-}
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java
deleted file mode 100644
index 13f161f..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/navigate/TokenEndpointAuthMethodLookupFunction.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate;
-
-import java.util.Optional;
-import java.util.Set;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationExplicitRegistrationProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-
-/**
- * A function that obtains
- * {@link OIDFederationExplicitRegistrationProfileConfiguration#getTokenEndpointAuthMethods(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}. That result is then transformed into a list
- * of {@link ClientAuthenticationMethod}s.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class TokenEndpointAuthMethodLookupFunction
- extends AbstractRelyingPartyLookupFunction<Set<ClientAuthenticationMethod>> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Set<ClientAuthenticationMethod> apply(@Nullable final ProfileRequestContext input) {
- return Optional.ofNullable(getRelyingPartyContextLookupStrategy().apply(input))
- .map(relyingPartyContext -> relyingPartyContext.getProfileConfig())
- .filter(OIDFederationExplicitRegistrationProfileConfiguration.class::isInstance)
- .map(OIDFederationExplicitRegistrationProfileConfiguration.class::cast)
- .map(config -> config.getTokenEndpointAuthMethods(input).stream()
- .map(ClientAuthenticationMethod::new)
- .collect(Collectors.toUnmodifiableSet()))
- .orElse(null);
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/RelyingPartyTrustChainContext.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/RelyingPartyTrustChainContext.java
index 5677288..6fa27d3 100644
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/RelyingPartyTrustChainContext.java
+++ b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/RelyingPartyTrustChainContext.java
@@ -26,8 +26,8 @@ import org.opensaml.messaging.context.BaseContext;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteResolverEntity;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.profile.TrustedRemoteResolverEntity;
import net.shibboleth.shared.annotation.constraint.Live;
/**
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/VerifiedTrustChain.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/VerifiedTrustChain.java
index 3390b46..34bb544 100644
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/VerifiedTrustChain.java
+++ b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/VerifiedTrustChain.java
@@ -18,8 +18,8 @@ import java.util.List;
import javax.annotation.Nonnull;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.payload.claim.Metadata;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/navigate/TrustAnchorIdLookupFunction.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/navigate/TrustAnchorIdLookupFunction.java
index 0c7eebf..b346e11 100644
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/navigate/TrustAnchorIdLookupFunction.java
+++ b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/context/navigate/TrustAnchorIdLookupFunction.java
@@ -23,9 +23,9 @@ import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.support.ClientInformationExtensionSupport;
import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMetadataContextLookupFunction;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
+import net.shibboleth.oidfed.support.ClientInformationExtensionSupport;
import net.shibboleth.shared.logic.Constraint;
/**
diff --git a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/support/ClientInformationExtensionSupport.java b/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/support/ClientInformationExtensionSupport.java
deleted file mode 100644
index 87539c0..0000000
--- a/idp-oidfed-op-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/support/ClientInformationExtensionSupport.java
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.support;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
-/**
- * Helper methods for our client information extensions related to OpenID federation.
- */
-public class ClientInformationExtensionSupport {
-
- /** Identifier for validated trust anchor within client information. */
- @Nonnull @NotEmpty public static final String KEY_VALIDATED_TRUST_ANCHOR = "oidfed_validated_trust_anchor";
-
- /** Identifier for validated trust chain within client information. */
- @Nonnull @NotEmpty public static final String KEY_VALIDATED_TRUST_CHAIN = "oidfed_validated_trust_chain";
-
- /** Identifier for validated trust mark IDs within client information. */
- @Nonnull @NotEmpty public static final String KEY_VALIDATED_TRUST_MARK_IDS = "oidfed_validated_trust_mark_ids";
-
- /**
- * Parse validated trust anchor from the given client information.
- *
- * @param clientInformation client information
- * @return validated trust anchor
- */
- @Nullable
- public static String parseValidatedTrustAnchor(@Nonnull final OIDCClientInformation clientInformation) {
- return Optional.ofNullable(clientInformation.getOIDCMetadata().getCustomField(KEY_VALIDATED_TRUST_ANCHOR))
- .filter(String.class::isInstance)
- .map(obj -> obj.toString())
- .orElse(null);
- }
-
- /**
- * Parse validated trust chain from the given client information.
- *
- * @param clientInformation client information
- * @return validated trust chain
- */
- @Nullable
- public static List<String> parseValidatedTrustChain(@Nonnull final OIDCClientInformation clientInformation) {
- return Optional.ofNullable(clientInformation.getOIDCMetadata().getCustomField(KEY_VALIDATED_TRUST_CHAIN))
- .filter(List.class::isInstance)
- .map(obj -> (List<?>) obj)
- .map(list -> list.stream().map(String.class::cast).toList())
- .orElse(null);
- }
-
- /**
- * Parse validated trust mark IDs from the given client information..
- *
- * @param clientInformation client information
- * @return validated trust mark IDs
- */
- @Nullable public static Map<String, List<String>> parseValidatedTrustMarkIds(
- @Nonnull final OIDCClientInformation clientInformation) {
- return Optional.ofNullable(clientInformation.getOIDCMetadata().getCustomField(KEY_VALIDATED_TRUST_MARK_IDS))
- .filter(Map.class::isInstance)
- .map(obj -> (Map<?,?>) obj)
- .map(map -> map.entrySet().stream()
- .filter(entry -> entry.getKey() instanceof String)
- .filter(entry -> entry.getValue() instanceof List<?>)
- .collect(Collectors.toMap(entry -> entry.getKey().toString(),
- entry -> ((List<?>) entry.getValue()).stream()
- .filter(Objects::nonNull)
- .map(Objects::toString)
- .toList())))
- .orElse(null);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ExplicitClientRegistrationRequestDecoder.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ExplicitClientRegistrationRequestDecoder.java
index e261c01..629195e 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ExplicitClientRegistrationRequestDecoder.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ExplicitClientRegistrationRequestDecoder.java
@@ -33,10 +33,10 @@ import com.nimbusds.oauth2.sdk.http.JakartaServletUtils;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.idp.plugin.oidc.op.decoding.impl.RequestUtil;
import net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl.BaseOAuth2RequestDecoder;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
+import net.shibboleth.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.util.EntityStatementHelper;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ResolveEntityRequestDecoder.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ResolveEntityRequestDecoder.java
index 97f3f55..ad03e4d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ResolveEntityRequestDecoder.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/decoding/impl/ResolveEntityRequestDecoder.java
@@ -36,7 +36,7 @@ import com.nimbusds.oauth2.sdk.http.JakartaServletUtils;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.idp.plugin.oidc.op.decoding.impl.RequestUtil;
import net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl.BaseOAuth2RequestDecoder;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityRequest;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/AbstractSignedJWTResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/AbstractSignedJWTResponse.java
deleted file mode 100644
index fd5c123..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/AbstractSignedJWTResponse.java
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.common.contenttype.ContentType;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.Response;
-import com.nimbusds.oauth2.sdk.http.HTTPResponse;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * An abstract class for the responses containing a signed JWT / entity statement.
- */
-public abstract class AbstractSignedJWTResponse implements Response {
-
- /** The JWT included in the response. */
- @Nonnull private final SignedJWT jwt;
-
- /**
- * Constructor.
- *
- * @param statement JWT
- */
- public AbstractSignedJWTResponse(@Nonnull final SignedJWT statement) {
- jwt = Constraint.isNotNull(statement, "Entity statement cannot be null");
- final JOSEObjectType type = jwt.getHeader().getType();
- if (!getJWTTypeHeader().equals(type)) {
- throw new ConstraintViolationException("Unexcepted type header (" + type + "), expected "
- + getJWTTypeHeader());
- }
- }
-
- /**
- * Get the JWT included in the response.
- *
- * @return JWT
- */
- @Nonnull public SignedJWT getJWT() {
- return jwt;
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean indicatesSuccess() {
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- public HTTPResponse toHTTPResponse() {
- final HTTPResponse httpResponse = new HTTPResponse(HTTPResponse.SC_OK);
- httpResponse.setEntityContentType(getHttpResponseContentType());
- httpResponse.setContent(getJWT().serialize());
- return httpResponse;
- }
-
- /**
- * Get the content type of the response.
- *
- * @return content type
- */
- @Nonnull protected abstract ContentType getHttpResponseContentType();
-
- /**
- * Get the JWT type header.
- *
- * @return JWT type header
- */
- @Nonnull protected abstract JOSEObjectType getJWTTypeHeader();
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/EntityConfigurationResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/EntityConfigurationResponse.java
deleted file mode 100644
index 7086ef8..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/EntityConfigurationResponse.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.common.contenttype.ContentType;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-
-/**
- * Response message to the OpenID federation entity configuration endpoint.
- */
-public class EntityConfigurationResponse extends AbstractSignedJWTResponse {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("entity-statement+jwt");
-
- /** The content type. */
- @Nonnull public static final ContentType HTTP_RESPONSE_CONTENT_TYPE =
- new ContentType("application", JWT_TYPE_HEADER.toString());
-
- /**
- *
- * Constructor.
- *
- * @param statement entity statement
- */
- public EntityConfigurationResponse(@Nonnull final SignedJWT statement) {
- super(statement);
- }
-
- /** {@inheritDoc} */
- protected ContentType getHttpResponseContentType() {
- return HTTP_RESPONSE_CONTENT_TYPE;
- }
-
- /** {@inheritDoc} */
- protected JOSEObjectType getJWTTypeHeader() {
- return JWT_TYPE_HEADER;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ExplicitClientRegistrationRequest.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ExplicitClientRegistrationRequest.java
deleted file mode 100644
index 288eb30..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ExplicitClientRegistrationRequest.java
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl;
-
-import java.net.URI;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.nimbusds.oauth2.sdk.Request;
-import com.nimbusds.oauth2.sdk.http.HTTPRequest;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Request message to the OpenID federation explicit registration endpoint.
- */
-public class ExplicitClientRegistrationRequest implements Request {
-
- /** The endpoint URI of the request. */
- @Nonnull private final URI endpointUri;
-
- /** The entity configuration from the request. */
- @Nullable private final EntityConfiguration entityConfiguration;
-
- /** The trust chain from the request. */
- @Nullable private final List<EntityStatement<?>> trustChain;
-
- /**
- * Constructor.
- *
- * @param uri endpoint URI
- * @param configuration client configuration
- */
- public ExplicitClientRegistrationRequest(@Nonnull final URI uri,
- @Nonnull final EntityConfiguration configuration) {
- endpointUri = Constraint.isNotNull(uri, "Endpoint URI cannot be null");
- entityConfiguration = Constraint.isNotNull(configuration, "Entity configuration cannot be null");
- trustChain = null;
- }
-
- /**
- * Constructor.
- *
- * @param uri endpoint URI
- * @param chain trust chain
- */
- public ExplicitClientRegistrationRequest(@Nonnull final URI uri,
- @Nonnull @NotEmpty final List<EntityStatement<?>> chain) {
- endpointUri = Constraint.isNotNull(uri, "Endpoint URI cannot be null");
- Constraint.isNotEmpty(chain, "Trust chain cannot be empty");
- trustChain = chain;
- entityConfiguration = null;
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull
- public URI getEndpointURI() {
- return endpointUri;
- }
-
- /** {@inheritDoc} */
- @Override
- public HTTPRequest toHTTPRequest() {
- //TODO
- return null;
- }
-
- /**
- * Get the entity configuration from the request.
- *
- * @return entity configuration
- */
- @Nullable public EntityConfiguration getEntityConfiguration() {
- return entityConfiguration;
- }
-
- /**
- * Get the trust chain from the request.
- *
- * @return trust chain
- */
- @Nullable public List<EntityStatement<?>> getTrustChain() {
- return trustChain;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ExplicitClientRegistrationResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ExplicitClientRegistrationResponse.java
deleted file mode 100644
index 66ee22e..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ExplicitClientRegistrationResponse.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.common.contenttype.ContentType;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.oauth2.sdk.http.HTTPResponse;
-
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/**
- * Response message to the OpenID federation explicit registration endpoint.
- */
-public class ExplicitClientRegistrationResponse extends AbstractSignedJWTResponse {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("explicit-registration-response+jwt");
-
- /** The content type. */
- @Nonnull public static final ContentType HTTP_RESPONSE_CONTENT_TYPE =
- new ContentType("application", JWT_TYPE_HEADER.toString());
-
- /**
- *
- * Constructor.
- *
- * @param statement entity statement
- */
- public ExplicitClientRegistrationResponse(@Nonnull final SignedJWT statement) {
- super(statement);
- }
-
- /** {@inheritDoc} */
- protected ContentType getHttpResponseContentType() {
- return HTTP_RESPONSE_CONTENT_TYPE;
- }
-
- /** {@inheritDoc} */
- protected JOSEObjectType getJWTTypeHeader() {
- return JWT_TYPE_HEADER;
- }
-
- /**
- * Parses a federation explicit registration success response from the given HTTP response.
- *
- * @param httpResponse the HTTP response
- * @return explicit registration success response
- * @throws ParseException if HTTP response could not be parsed into registration response
- */
- @Nonnull
- public static ExplicitClientRegistrationResponse parse(@Nonnull final HTTPResponse httpResponse)
- throws ParseException {
-
- httpResponse.ensureStatusCode(HTTPResponse.SC_OK);
- httpResponse.ensureEntityContentType(HTTP_RESPONSE_CONTENT_TYPE);
- final String content = httpResponse.getContent();
-
- if (StringSupport.trimOrNull(content) == null) {
- throw new ParseException("Message body is empty");
- }
-
- try {
- final SignedJWT jwt = SignedJWT.parse(httpResponse.getContent());
- assert jwt != null;
- return new ExplicitClientRegistrationResponse(jwt);
- } catch (final java.text.ParseException | ConstraintViolationException e) {
- throw new ParseException(e.getMessage(), e);
- }
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ResolveEntityRequest.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ResolveEntityRequest.java
deleted file mode 100644
index 10e9f2e..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ResolveEntityRequest.java
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl;
-
-import java.net.URI;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.google.common.base.MoreObjects;
-import com.nimbusds.oauth2.sdk.AbstractOptionallyAuthenticatedRequest;
-import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
-import com.nimbusds.oauth2.sdk.http.HTTPRequest;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Request message to the OpenID federation resolve entity API.
- */
-public class ResolveEntityRequest extends AbstractOptionallyAuthenticatedRequest {
-
- /** The requested subject. */
- @Nonnull @NotEmpty private final String subject;
-
- /** The requested trust anchors. */
- @Nonnull @NotEmpty private final List<String> trustAnchors;
-
- /** The requested entity types to resolve. */
- @Nonnull private final List<String> entityTypes;
-
- /**
- *
- * Constructor.
- *
- * @param uri endpoint URI
- * @param sub subject
- * @param anchors trust anchors
- * @param types optional entity types
- * @param clientAuthentication optional client authentication
- */
- public ResolveEntityRequest(@Nonnull final URI uri,
- @Nonnull @NotEmpty final String sub,
- @Nonnull @NotEmpty final List<String> anchors,
- @Nullable final List<String> types,
- @Nullable final ClientAuthentication clientAuthentication) {
- super(Constraint.isNotNull(uri, "Endpoint URI cannot be null"), clientAuthentication);
- subject = Constraint.isNotNull(sub, "Subject cannot be empty");
- Constraint.isNotEmpty(anchors, "Trust anchors cannot be empty");
- trustAnchors = anchors;
- entityTypes = types == null ? CollectionSupport.emptyList() : CollectionSupport.copyToList(types);
- }
-
- /**
- * Returns the requested subject.
- *
- * @return The subject.
- */
- @Nonnull @NotEmpty public String getSubject() {
- return subject;
- }
-
- /**
- * Returns the requested trust anchor.
- *
- * @return The trust anchor.
- */
- @Nonnull @NotEmpty public List<String> getTrustAnchors() {
- return trustAnchors;
- }
-
- /**
- * Returns the requested entity type to resolve.
- *
- * @return The entity type to resolve.
- */
- @Nonnull public List<String> getEntityTypes() {
- return entityTypes;
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull public URI getEndpointURI() {
- final URI result = super.getEndpointURI();
- assert result != null;
- return result;
- }
-
- /** {@inheritDoc} */
- @Override
- public HTTPRequest toHTTPRequest() {
- //TODO
- return null;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("subject", getSubject())
- .add("trustAnchors", getTrustAnchors())
- .add("entityTypes", getEntityTypes())
- .add("endpointURI", getEndpointURI())
- .add("clientAuthentication", getClientAuthentication())
- .toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final ResolveEntityRequest other = (ResolveEntityRequest) obj;
- return getEndpointURI().equals(other.getEndpointURI()) && subject.equals(other.subject) &&
- entityTypes.containsAll(other.entityTypes) && other.entityTypes.containsAll(entityTypes) &&
- trustAnchors.containsAll(other.trustAnchors) && other.trustAnchors.containsAll(trustAnchors) &&
- getClientAuthentication() == null ? other.getClientAuthentication() == null :
- getClientAuthentication().equals(other.getClientAuthentication());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ResolveEntityResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ResolveEntityResponse.java
deleted file mode 100644
index 483d4e4..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/ResolveEntityResponse.java
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.common.contenttype.ContentType;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.oauth2.sdk.http.HTTPResponse;
-
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/**
- * Response message to the OpenID federation resolve entity endpoint.
- */
-public class ResolveEntityResponse extends AbstractSignedJWTResponse {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("resolve-response+jwt");
-
- /** The content type. */
- @Nonnull public static final ContentType HTTP_RESPONSE_CONTENT_TYPE =
- new ContentType("application", JWT_TYPE_HEADER.toString());
-
- /**
- * Constructor.
- *
- * @param statement JWT
- */
- public ResolveEntityResponse(@Nonnull final SignedJWT statement) {
- super(statement);
- }
-
- /** {@inheritDoc} */
- protected ContentType getHttpResponseContentType() {
- return HTTP_RESPONSE_CONTENT_TYPE;
- }
-
- /** {@inheritDoc} */
- protected JOSEObjectType getJWTTypeHeader() {
- return JWT_TYPE_HEADER;
- }
-
- /**
- * Parses a federation resolve entity success response from the given HTTP response.
- *
- * @param httpResponse the HTTP response
- * @return resolve entity success response
- * @throws ParseException if HTTP response could not be parsed into resolve entity response
- */
- @Nonnull
- public static ResolveEntityResponse parse(@Nonnull final HTTPResponse httpResponse)
- throws ParseException {
-
- httpResponse.ensureStatusCode(HTTPResponse.SC_OK);
- httpResponse.ensureEntityContentType(HTTP_RESPONSE_CONTENT_TYPE);
- final String content = httpResponse.getContent();
-
- if (StringSupport.trimOrNull(content) == null) {
- throw new ParseException("Message body is empty");
- }
-
- try {
- final SignedJWT jwt = SignedJWT.parse(httpResponse.getContent());
- assert jwt != null;
- return new ResolveEntityResponse(jwt);
- } catch (final java.text.ParseException | ConstraintViolationException e) {
- throw new ParseException(e.getMessage(), e);
- }
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/SignedKeysetResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/SignedKeysetResponse.java
deleted file mode 100644
index 8fb4788..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/messaging/impl/SignedKeysetResponse.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.common.contenttype.ContentType;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-
-/**
- * Response message to the OpenID federation signed keyset endpoint.
- */
-public class SignedKeysetResponse extends AbstractSignedJWTResponse {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("jwk-set+jwt");
-
- /** The content type. */
- @Nonnull public static final ContentType HTTP_RESPONSE_CONTENT_TYPE =
- new ContentType("application", JWT_TYPE_HEADER.toString());
-
- /**
- *
- * Constructor.
- *
- * @param statement entity statement
- */
- public SignedKeysetResponse(@Nonnull final SignedJWT statement) {
- super(statement);
- }
-
- /** {@inheritDoc} */
- protected ContentType getHttpResponseContentType() {
- return HTTP_RESPONSE_CONTENT_TYPE;
- }
-
- /** {@inheritDoc} */
- protected JOSEObjectType getJWTTypeHeader() {
- return JWT_TYPE_HEADER;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java
deleted file mode 100644
index 79734a8..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractFederationEndpointResponseFetchingStrategy.java
+++ /dev/null
@@ -1,328 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.io.IOException;
-import java.net.URISyntaxException;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.List;
-import java.util.Optional;
-import java.util.function.BiConsumer;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.apache.hc.client5.http.classic.HttpClient;
-import org.apache.hc.client5.http.protocol.HttpClientContext;
-import org.apache.hc.core5.http.ClassicHttpRequest;
-import org.apache.hc.core5.http.ClassicHttpResponse;
-import org.apache.hc.core5.http.HttpRequest;
-import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.ProtocolException;
-import org.opensaml.security.httpclient.HttpClientSecurityParameters;
-import org.opensaml.security.httpclient.HttpClientSecuritySupport;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * An abstract base class for fetching strategies related to OpenID Federation endpoints.
- *
- * @param <R> data needed for request
- * @param <C> metadata container class stored to the metadata cache
- */
-public abstract class
- AbstractFederationEndpointResponseFetchingStrategy<R extends Object, C extends BaseExpirableMetadataContainer>
- extends AbstractIdentifiableInitializableComponent implements Function<CriteriaSet, C> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AbstractFederationEndpointResponseFetchingStrategy.class);
-
- /** HTTP client to use. */
- @NonnullAfterInit protected HttpClient httpClient;
-
- /** HTTP client security parameters. */
- @Nullable private HttpClientSecurityParameters httpClientSecurityParameters;
-
- /** JSON object mapper used for decoding JSON into Map. */
- @NonnullAfterInit protected ObjectMapper objectMapper;
-
- /** Strategy to fetch request data from the criteria set. */
- @NonnullAfterInit private Function<CriteriaSet, R> criteriaToRequestDataStrategy;
-
- /** Strategy to fetch lifetime for container with valid contents. */
- @NonnullAfterInit private Function<CriteriaSet, Duration> criteriaToValidContainerLifetimeStrategy;
-
- /** Strategy to fetch lifetime for container with invalid contents. */
- @NonnullAfterInit private Function<CriteriaSet, Duration> criteriaToInvalidContainerLifetimeStrategy;
-
- /** Strategy to fetch lifetime for containers whose contents could not be fetched. */
- @NonnullAfterInit private Function<CriteriaSet, Duration> criteriaToExceptionContainerLifetimeStrategy;
-
- /** Strategy to fetch client authentication decorator for HTTP request and its parameters. */
- @Nullable protected
- Function<CriteriaSet, BiConsumer<HttpRequest,List<NameValuePair>>> clientAuthenticationLookupStrategy;
-
- /**
- * Set the {@link HttpClient} to use.
- *
- * @param client HTTP client to use
- */
- public void setHttpClient(@Nonnull final HttpClient client) {
- checkSetterPreconditions();
- httpClient = Constraint.isNotNull(client, "HttpClient cannot be null");
- }
-
- /**
- * Set the optional client security parameters.
- *
- * @param params the new client security parameters
- */
- public void setHttpClientSecurityParameters(@Nullable final HttpClientSecurityParameters params) {
- checkSetterPreconditions();
- httpClientSecurityParameters = params;
- }
-
- /**
- * Set the strategy to fetch request data from the criteria set.
- *
- * @param strategy lookup strategy
- */
- public void setCriteriaToRequestDataStrategy(@Nonnull final Function<CriteriaSet, R> strategy) {
- checkSetterPreconditions();
- criteriaToRequestDataStrategy =
- Constraint.isNotNull(strategy, "Criteria to request data strategy cannot be null");
- }
-
- /**
-
- * Set the JSON {@link ObjectMapper} used for decoding JSON into Map.
- *
- * @param mapper object mapper
- */
- public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- checkSetterPreconditions();
-
- objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
- }
-
- /**
- * Set the strategy to fetch lifetime for container with valid contents.
- *
- * @param strategy lifetime strategy
- */
- public void setCriteriaToValidContainerLifetimeStrategy(@Nonnull final Function<CriteriaSet, Duration> strategy) {
- checkSetterPreconditions();
-
- criteriaToValidContainerLifetimeStrategy =
- Constraint.isNotNull(strategy, "Criteria to valid container lifetime strategy cannot be null");
- }
-
- /**
- * Set the strategy to fetch lifetime for container with invalid contents.
- *
- * @param strategy lifetime strategy
- */
- public void setCriteriaToInvalidContainerLifetimeStrategy(
- @Nonnull final Function<CriteriaSet, Duration> strategy) {
- checkSetterPreconditions();
-
- criteriaToInvalidContainerLifetimeStrategy =
- Constraint.isNotNull(strategy, "Criteria to invalid container lifetime strategy cannot be null");
- }
-
- /**
- * Set the strategy to fetch lifetime for container whose contents could not be fetched.
- *
- * @param strategy lifetime strategy
- */
- public void setCriteriaToExceptionContainerLifetimeStrategy(
- @Nonnull final Function<CriteriaSet, Duration> strategy) {
- checkSetterPreconditions();
-
- criteriaToExceptionContainerLifetimeStrategy =
- Constraint.isNotNull(strategy, "Criteria to exception container lifetime strategy cannot be null");
- }
-
- /**
- * Set the strategy to fetch client authentication decorator for HTTP request and its parameters.
- *
- * @param strategy client authentication strategy
- */
- public void setClientAuthenticationLookupStrategy(
- @Nullable final Function<CriteriaSet, BiConsumer<HttpRequest, List<NameValuePair>>> strategy) {
- checkSetterPreconditions();
-
- clientAuthenticationLookupStrategy = strategy;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (httpClient == null) {
- throw new ComponentInitializationException("Httpclient cannot be null");
- }
- if (objectMapper == null) {
- throw new ComponentInitializationException("Object mapper cannot be null");
- }
- if (criteriaToRequestDataStrategy == null) {
- throw new ComponentInitializationException("Criteria to request data strategy cannot be null");
- }
- if (criteriaToValidContainerLifetimeStrategy == null) {
- throw new ComponentInitializationException("Criteria to valid container lifetime strategy cannot be null");
- }
- if (criteriaToInvalidContainerLifetimeStrategy == null) {
- throw new ComponentInitializationException(
- "Criteria to invalid container lifetime strategy cannot be null");
- }
- if (criteriaToExceptionContainerLifetimeStrategy == null) {
- throw new ComponentInitializationException(
- "Criteria to exception container lifetime strategy cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public C apply(@Nullable final CriteriaSet criteria) {
- checkComponentActive();
- if (criteria == null) {
- log.error("No criteria set provided");
- return null;
- }
- final R requestData = criteriaToRequestDataStrategy.apply(criteria);
- if (requestData == null) {
- log.debug("Could not resolve request data from criteria {}", criteria);
- return null;
- }
- final Duration validLifetime = criteriaToValidContainerLifetimeStrategy.apply(criteria);
- if (validLifetime == null) {
- log.warn("Could not fetch expiration time for valid container");
- return null;
- }
- final Instant validExpiration = Instant.now().plus(validLifetime);
- final Duration invalidLifetime = criteriaToInvalidContainerLifetimeStrategy.apply(criteria);
- if (invalidLifetime == null) {
- log.warn("Could not fetch expiration time for invalid container");
- return null;
- }
- final Instant invalidExpiration = Instant.now().plus(invalidLifetime);
- final Duration exceptionLifetime = criteriaToExceptionContainerLifetimeStrategy.apply(criteria);
- if (exceptionLifetime == null) {
- log.warn("Could not fetch expiration time for exception container");
- return null;
- }
- final Instant exceptionExpiration = Instant.now().plus(exceptionLifetime);
- final ClassicHttpRequest httpRequest = initializeHttpRequest(criteria, requestData);
- if (httpRequest == null) {
- log.debug("Could not initialize HTTP request for {}", requestData);
- return null;
- }
- final HttpClientContext httpContext = buildHttpContext(httpRequest);
- try (final ClassicHttpResponse response = httpClient.executeOpen(null, httpRequest, httpContext)) {
- final String scheme = httpRequest.getUri().getScheme();
- if (scheme == null) {
- throw new URISyntaxException(httpRequest.getUri().toString(), "Could not parse scheme");
- }
- HttpClientSecuritySupport.checkTLSCredentialEvaluated(httpContext, scheme);
- assert validExpiration != null; assert invalidExpiration != null; assert exceptionExpiration != null;
- return parseHttpResponse(criteria, requestData, response, validExpiration, invalidExpiration,
- exceptionExpiration);
- } catch (final ProtocolException | URISyntaxException | IOException e) {
- log.debug("Unable to fetch resolve entity response via request data: {}", requestData, e);
- assert exceptionExpiration != null;
- return handleException(criteria, requestData, e, exceptionExpiration);
- }
- }
-
- /**
- * Get the client authentication decorator by using the configured lookup strategy.
- *
- * @param criteria the criteria passed to the lookup strategy
- * @return the client authentication decorator, or null if none was resolved
- */
- @Nullable protected BiConsumer<HttpRequest, List<NameValuePair>> getClientAuthentication(
- @Nonnull final CriteriaSet criteria) {
- log.trace("Criteria set passed for client authentication lookup: {}", criteria);
- return Optional.ofNullable(clientAuthenticationLookupStrategy)
- .map(strategy -> strategy.apply(criteria))
- .orElse(null);
- }
-
- /**
- * Build the {@link HttpClientContext} instance to be used with {@link #httpClient}.
- *
- * @param request the HTTP client request
- * @return the client context instance
- */
- @Nonnull
- protected HttpClientContext buildHttpContext(@Nonnull final ClassicHttpRequest request) {
- final HttpClientContext clientContext = HttpClientContext.create();
- assert clientContext != null;
- HttpClientSecuritySupport.marshalSecurityParameters(clientContext, httpClientSecurityParameters, false);
- HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(clientContext, request);
- return clientContext;
- }
-
- /**
- * Initializes the {@link ClassicHttpRequest} to be used with {@link #httpClient}.
- *
- * @param criteria criteria set
- * @param requestData request data
- * @return the request to be used with {@link #httpClient}
- */
- @Nullable protected abstract ClassicHttpRequest initializeHttpRequest(@Nonnull final CriteriaSet criteria,
- @Nonnull final R requestData);
-
- /**
- * Parses the response message container to be stored in the metadata cache.
- *
- * @param criteria criteria set
- * @param requestData the request data
- * @param response the HTTP response obtained from {@link #httpClient}
- * @param validExpiration expiration instant for containers with valid content
- * @param invalidExpiration expiration instant for container with invalid content
- * @param exceptionExpiration expiration instant for container whose contents could not be fetched
- * @return the response message container
- * @throws ProtocolException if HTTP protocol violation occurs
- * @throws IOException if generic I/O exception occurs
- */
- @Nullable protected abstract C parseHttpResponse(@Nonnull final CriteriaSet criteria,
- @Nonnull final R requestData, @Nullable final ClassicHttpResponse response,
- @Nonnull final Instant validExpiration, @Nonnull final Instant invalidExpiration,
- @Nonnull final Instant exceptionExpiration) throws ProtocolException, IOException;
-
- /**
- * Handles the exception catched while communicating with the remote API.
- *
- * @param criteria criteria set
- * @param requestData the request data
- * @param throwable exception catched while communicating with the remote API
- * @param expiration exoiration instant for container whose contents could not be fetched
- * @return the container to be stored in the metadata cache
- */
- @Nullable protected abstract C handleException(@Nonnull final CriteriaSet criteria,
- @Nonnull final R requestData, @Nonnull final Throwable throwable, @Nonnull final Instant expiration);
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractTrustEngineSignatureValidationComponent.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractTrustEngineSignatureValidationComponent.java
deleted file mode 100644
index 0d68cbc..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/AbstractTrustEngineSignatureValidationComponent.java
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.text.ParseException;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.SecurityException;
-import org.opensaml.security.trust.TrustEngine;
-import org.slf4j.Logger;
-
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Abstract component performing signature validation via {@link TrustEngine}.
- */
-public class AbstractTrustEngineSignatureValidationComponent extends AbstractIdentifiableInitializableComponent {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AbstractTrustEngineSignatureValidationComponent.class);
-
- /** Trust engine used to validate a signature. */
- @NonnullAfterInit private TrustEngine<SignedJWT> trustEngine;
-
- /** Set of externally specified default criteria for input to the trust engine. */
- @Nullable private CriteriaSet defaultCriteria;
-
- /**
- * Set trust engine used to validate a signature.
- *
- * @param engine trust engine
- */
- public void setTrustEngine(@Nonnull final TrustEngine<SignedJWT> engine) {
- checkSetterPreconditions();
- trustEngine = Constraint.isNotNull(engine, "Trust Engine cannot be null");
- }
-
- /**
- * Set the optional set of default criteria used as input to the trust engine.
- *
- * @param criteria criteria set to use
- */
- public void setDefaultCriteria(@Nullable final CriteriaSet criteria) {
- checkSetterPreconditions();
- defaultCriteria = criteria;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (trustEngine == null) {
- throw new ComponentInitializationException("Trust Engine cannot be null");
- }
- }
-
- /**
- * Validates the given JWT via trust engine and the given criteria.
- *
- * @param jwt the JWT to be validated
- * @param criteria the criteria (expanded with the optional default criteria)
- * @param entityId the entity ID used for logging
- * @return true if validation was successful, false otherwise
- */
- protected boolean validateJwt(@Nonnull final SignedJWT jwt, @Nonnull final CriteriaSet criteria,
- @Nullable final String entityId) {
- if (defaultCriteria != null && !defaultCriteria.isEmpty()) {
- criteria.addAll(defaultCriteria);
- }
- try {
- if (trustEngine.validate(jwt, criteria)) {
- log.debug("Successfully validated entity statement for {}", entityId);
- return true;
- }
- log.warn("Trust Engine validation failed for {}, issued by {}", entityId,
- jwt.getJWTClaimsSet().getIssuer());
- } catch (final SecurityException | ParseException e) {
- log.warn("Could not validate entity statement for {}", entityId, e);
- }
- return false;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableMetadataContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableMetadataContainer.java
deleted file mode 100644
index cf156a2..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableMetadataContainer.java
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A base container class for metadata caches carrying expiration instant.
- */
-public abstract class BaseExpirableMetadataContainer implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 656269369356865370L;
-
- /** Expiration instant for this container. */
- @Nonnull private final Instant expiration;
-
- /**
- * Constructor.
- *
- * @param expirationInstant expiration instant, must not be null
- */
- public BaseExpirableMetadataContainer(@Nonnull final Instant expirationInstant) {
- expiration = Constraint.isNotNull(expirationInstant, "Expiration instant cannot be null");
- }
-
- /**
- * Get expiration instant.
- *
- * @return expiration instant
- */
- @Nonnull public Instant getExpirationInstant() {
- return expiration;
- }
-
- /**
- * Get the entity ID of the requested entity.
- *
- * @return requested entity ID
- */
- @Nonnull @NotEmpty public abstract String getEntityId();
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableStatementContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableStatementContainer.java
deleted file mode 100644
index d975cfa..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/BaseExpirableStatementContainer.java
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BaseJWTWrapper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BasePayload;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A base container class for metadata caches carrying expiration instant and statement.
- *
- * @param <T> wrapped statement
- */
-public abstract class BaseExpirableStatementContainer<T extends BaseJWTWrapper<? extends BasePayload>>
- extends BaseExpirableMetadataContainer
- implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 656269369356432370L;
-
- /** Entity statement for this container. */
- @Nullable private final T statement;
-
- /** Flag to indicate if {@link #statement} is valid. */
- private boolean validStatement;
-
- /** Expiration instant for this container when invalid statement is contained. */
- @Nonnull private final Instant invalidStatementExpiration;
-
- /**
- * Constructor.
- *
- * @param validExpirationInstant expiration instant for valid statement, must not be null
- * @param entityStatement entity statement
- * @param invalidExpirationInstant expiration instant for invalid statement, must not be null
- */
- public BaseExpirableStatementContainer(@Nonnull final Instant validExpirationInstant,
- @Nullable final T entityStatement, @Nonnull final Instant invalidExpirationInstant) {
- super(validExpirationInstant);
- statement = entityStatement;
- validStatement = entityStatement != null;
- invalidStatementExpiration = Constraint.isNotNull(invalidExpirationInstant,
- "Expiration instant for invalid statements cannot be null");
- }
-
- /**
- * Get the statement. If the statement has been invalidated, a null is returned.
- *
- * @return entity statement
- */
- @Nullable public T getStatement() {
- return getStatement(false);
- }
-
- /**
- * Get the statement.
- *
- * @param includeInvalidStatement a flag to return invalidated entity statement
- * @return entity statement
- */
- @Nullable public T getStatement(final boolean includeInvalidStatement) {
- return includeInvalidStatement ? statement : validStatement ? statement : null;
- }
-
- /** {@inheritDoc} */
- @Nonnull public Instant getExpirationInstant() {
- return getStatement() != null ? super.getExpirationInstant() : invalidStatementExpiration;
- }
-
- /**
- * Invalidates the entity statement.
- *
- * @return this container
- */
- public BaseExpirableStatementContainer<T> invalidateStatement() {
- validStatement = false;
- return this;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultAuthenticationSecurityConfigurationLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultAuthenticationSecurityConfigurationLookupFunction.java
deleted file mode 100644
index 09fb56f..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultAuthenticationSecurityConfigurationLookupFunction.java
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationEntityConfigurationProfileConfiguration;
-import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-import net.shibboleth.shared.service.ReloadableService;
-import net.shibboleth.shared.service.ServiceableComponent;
-
-/**
- * Default lookup function for resolving the security configuration via {@link RelyingPartyConfigurationResolver} and
- * a configurable unverified profile configuration. The {@link OIDFederationEntityConfigurationProfileConfiguration}
- * profile is used by default.
- */
-public class DefaultAuthenticationSecurityConfigurationLookupFunction extends AbstractIdentifiableInitializableComponent
- implements Function<CriteriaSet, JSONSecurityConfiguration> {
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(DefaultAuthenticationSecurityConfigurationLookupFunction.class);
-
- /** Resolver used to look up relying party configurations. */
- @NonnullAfterInit private ReloadableService<RelyingPartyConfigurationResolver> rpConfigResolver;
-
- /** Profile configuration identifier, must be unverified relying party. */
- @Nonnull @NotEmpty private String profileId;
-
- /**
- * Constructor.
- */
- public DefaultAuthenticationSecurityConfigurationLookupFunction() {
- profileId = OIDFederationEntityConfigurationProfileConfiguration.PROFILE_ID;
- }
-
- /**
- * Set the relying party config resolver to use.
- *
- * @param resolver the resolver to use
- */
- public void setRelyingPartyConfigurationResolver(
- @Nonnull final ReloadableService<RelyingPartyConfigurationResolver> resolver) {
- checkSetterPreconditions();
- rpConfigResolver = Constraint.isNotNull(resolver, "Relying party configuration resolver cannot be null");
- }
-
- /**
- * Set the unverified profile configuration identifier.
- *
- * @param id the identifier to use
- */
- public void setUnverifiedProfileConfigurationId(@Nonnull @NotEmpty final String id) {
- checkSetterPreconditions();
- profileId = Constraint.isNotEmpty(id, "Unverified profile configuration ID cannot be empty");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (rpConfigResolver == null) {
- throw new ComponentInitializationException("RelyingPartyConfigurationResolver cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public JSONSecurityConfiguration apply(@Nullable final CriteriaSet criteria) {
- checkComponentActive();
- try (final ServiceableComponent<RelyingPartyConfigurationResolver> resolver =
- rpConfigResolver.getServiceableComponent()) {
- final RelyingPartyConfiguration config = resolver.getComponent().resolveSingle(criteria);
- if (config != null) {
- final ProfileConfiguration profileConfig = config.getProfileConfiguration(null, profileId);
- if (profileConfig != null && profileConfig.getSecurityConfiguration(null)
- instanceof JSONSecurityConfiguration jsonSecurityConfig) {
- return jsonSecurityConfig;
- }
- log.error("Could not resolve JSON security configuration via profile configuration {}", profileId);
- }
- log.error("Could not resolve relying party configuration");
- } catch (final ResolverException e) {
- log.error("Error trying to resolve relying party configuration", e);
- }
- return null;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultClientAuthenticationLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultClientAuthenticationLookupFunction.java
deleted file mode 100644
index 71b487a..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultClientAuthenticationLookupFunction.java
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.List;
-import java.util.function.BiConsumer;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.apache.hc.core5.http.HttpRequest;
-import org.apache.hc.core5.http.NameValuePair;
-import org.slf4j.Logger;
-
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default client authentication lookup strategy implementation that exploits a static list of supported authentication
- * functions.
- */
-public class DefaultClientAuthenticationLookupFunction extends AbstractIdentifiableInitializableComponent
- implements Function<CriteriaSet,BiConsumer<HttpRequest,List<NameValuePair>>> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultClientAuthenticationLookupFunction.class);
-
- /** Lookup strategy for supported authentication methods. */
- @NonnullAfterInit private Function<CriteriaSet,List<String>> supportedAuthenticationMethodsLookupStrategy;
-
- /** Lookup strategy for the list of supported client authentication decorators. */
- @NonnullAfterInit
- private List<BiFunction<CriteriaSet,List<String>,BiConsumer<HttpRequest,List<NameValuePair>>>>
- clientAuthenticationDecoratorsLookupStrategy;
-
- /**
- * Set the lookup strategy for supported authentication methods.
- *
- * @param strategy lookup strategy
- */
- public void setSupportedAuthenticationMethodsLookupStrategy(
- @Nonnull final Function<CriteriaSet,List<String>> strategy) {
- checkSetterPreconditions();
- supportedAuthenticationMethodsLookupStrategy =
- Constraint.isNotNull(strategy, "Supported authentication methods lookup strategy cannot be null");
- }
-
- /**
- * Set the lookup strategy for the list of supported client authentication decorators.
- *
- * @param strategy lookup strategy
- */
- public void setClientAuthenticationDecoratorsLookupStrategy(@Nonnull final
- List<BiFunction<CriteriaSet,List<String>,BiConsumer<HttpRequest,List<NameValuePair>>>> strategy) {
- checkSetterPreconditions();
- clientAuthenticationDecoratorsLookupStrategy =
- Constraint.isNotNull(strategy, "Client authentication decorators lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (supportedAuthenticationMethodsLookupStrategy == null) {
- throw new ComponentInitializationException(
- "Supported authentication methods lookup strategy cannot be null");
- }
- if (clientAuthenticationDecoratorsLookupStrategy == null) {
- throw new ComponentInitializationException(
- "Client authentication decorators lookup strategy cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Nullable public BiConsumer<HttpRequest,List<NameValuePair>> apply(@Nullable final CriteriaSet criteria) {
- final List<String> supportedMethods = supportedAuthenticationMethodsLookupStrategy.apply(criteria);
- if (supportedMethods == null) {
- log.debug("Could not resolve list of supported methods, no client authentication used");
- return null;
- }
- if (supportedMethods.isEmpty()) {
- log.warn("Unexpected value for the list of supported methods: empty array");
- return null;
- }
- for (final BiFunction<CriteriaSet,List<String>,BiConsumer<HttpRequest,List<NameValuePair>>> function :
- clientAuthenticationDecoratorsLookupStrategy) {
- final BiConsumer<HttpRequest,List<NameValuePair>> consumer = function.apply(criteria, supportedMethods);
- if (consumer != null) {
- log.debug("Returning client authentication decorator {}", consumer);
- return consumer;
- }
- }
- log.debug("None of the supported methods returned any client authentication details");
- return null;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementContentValidationCondition.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementContentValidationCondition.java
deleted file mode 100644
index 8d9a03a..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementContentValidationCondition.java
+++ /dev/null
@@ -1,181 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.text.ParseException;
-import java.util.Optional;
-import java.util.function.BiPredicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-
-import jakarta.servlet.http.HttpServletRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BaseJWTWrapper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BasePayload;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.JWTValidationException;
-import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.primitive.NonnullSupplier;
-
-/**
- * Default content validating filter for entity statement. Verifies that the
- * {@link BaseExpirableStatementContainer#getEntityId()} matches with the subject of the entity statement and
- * validates the claims via configurable claims validator. The {@link ProfileRequestContext} that is fed to the claims
- * validator is fetched from the {@link HttpServletRequest} attributes. An empty context is fed if the attribute was
- * null.
- */
- at ThreadSafeAfterInit
-public class DefaultEntityStatementContentValidationCondition
- extends AbstractIdentifiableInitializableComponent
- implements BiPredicate<BaseExpirableStatementContainer<?>, MetadataFilterContext> {
-
- /** Class logger. */
- @Nonnull private Logger log =
- LoggerFactory.getLogger(DefaultEntityStatementContentValidationCondition.class);
-
- /** The claims validator to use for validating the entity statement claims. */
- @NonnullAfterInit private ClaimsValidator claimsValidator;
-
- /** The header validator to use for validating the entity statement header. */
- @NonnullAfterInit private BiPredicate<SignedJWT, ProfileRequestContext> headerValidator;
-
- /** Supplier for the Current HTTP request, if available. */
- @NonnullAfterInit private NonnullSupplier<HttpServletRequest> httpServletRequestSupplier;
-
- @NonnullAfterInit
- private BiPredicate<BaseExpirableStatementContainer<?>, BaseJWTWrapper<? extends BasePayload>>
- containerIdValidationStrategy;
-
- /**
- * Set the claims validator to use for validating the entity statement claims.
- *
- * @param validator claims validator
- */
- public void setClaimsValidator(@Nonnull final ClaimsValidator validator) {
- checkSetterPreconditions();
- claimsValidator = Constraint.isNotNull(validator, "Claims validator cannot be null");
- }
-
- /**
- * Set the header validator to use for validating the entity statement header.
- *
- * @param validator header validator
- */
- public void setHeaderValidator(@Nonnull final BiPredicate<SignedJWT, ProfileRequestContext> validator) {
- checkSetterPreconditions();
- headerValidator = Constraint.isNotNull(validator, "Header validator cannot be null");
- }
-
- /**
- * Set the current HTTP request Supplier.
- *
- * @param requestSupplier Supplier for the current HTTP request
- */
- public void setHttpServletRequestSupplier(@Nonnull final NonnullSupplier<HttpServletRequest> requestSupplier) {
- checkSetterPreconditions();
- httpServletRequestSupplier = Constraint.isNotNull(requestSupplier,
- "Http servlet request supplier cannot be null");
- }
-
- /**
- * Set the validation strategy for the container identifier.
- *
- * @param strategy validation strategy
- */
- public void setContainerIdValidationStrategy(@Nonnull final
- BiPredicate<BaseExpirableStatementContainer<?>, BaseJWTWrapper<? extends BasePayload>> strategy) {
- checkSetterPreconditions();
- containerIdValidationStrategy = Constraint.isNotNull(strategy,
- "Container ID validation strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (claimsValidator == null) {
- throw new ComponentInitializationException("Claims validator cannot be null");
- }
- if (headerValidator == null) {
- throw new ComponentInitializationException("Header validator cannot be null");
- }
- if (httpServletRequestSupplier == null) {
- throw new ComponentInitializationException("Http servlet request supplier cannot be null");
- }
- if (containerIdValidationStrategy == null) {
- throw new ComponentInitializationException("Container ID validation strategy cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean test(@Nullable final BaseExpirableStatementContainer<?> responseContainer,
- @Nullable final MetadataFilterContext filterContext) {
- checkComponentActive();
-
- if (responseContainer == null || responseContainer.getStatement() == null) {
- return false;
- }
-
- final var wrapper = responseContainer.getStatement();
- assert wrapper != null;
- if (!containerIdValidationStrategy.test(responseContainer, wrapper)) {
- log.warn("Container ID validation failed with the requested ID {}", responseContainer.getEntityId());
- return false;
- }
- final ProfileRequestContext profileRequestContext =
- Optional.ofNullable(httpServletRequestSupplier.get().getAttribute(ProfileRequestContext.BINDING_KEY))
- .filter(ProfileRequestContext.class::isInstance)
- .map(ProfileRequestContext.class::cast)
- .orElse(null);
- final ProfileRequestContext nonNullProfileRequestContext;
- if (profileRequestContext == null) {
- log.warn("Could not resolve profile request context, supplying an empty one to claims validators");
- nonNullProfileRequestContext = new ProfileRequestContext();
- } else {
- nonNullProfileRequestContext = profileRequestContext;
- }
-
- //TODO: make validator interface to commons?
- if (!headerValidator.test(wrapper.getJwt(), nonNullProfileRequestContext)) {
- log.warn("Header validation failed for entity statement {}", responseContainer.getEntityId());
- return false;
- }
-
- try {
- final JWTClaimsSet claimsSet = wrapper.getJwt().getJWTClaimsSet();
- assert claimsSet != null;
- claimsValidator.validate(claimsSet,
- profileRequestContext != null ? profileRequestContext : new ProfileRequestContext());
- } catch (final JWTValidationException | ParseException e) {
- log.warn("Claims validation failed for entity statement {}", responseContainer.getEntityId(), e);
- return false;
- }
- log.trace("Entity statement claims successfully validated for {}", responseContainer.getEntityId());
- return true;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementMetadataFilterStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementMetadataFilterStrategy.java
deleted file mode 100644
index d975c95..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementMetadataFilterStrategy.java
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.List;
-import java.util.function.BiFunction;
-import java.util.function.BiPredicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default metadata validation filter for entity statement containers.
- */
-public class DefaultEntityStatementMetadataFilterStrategy
- extends AbstractIdentifiableInitializableComponent implements
- BiFunction<BaseExpirableStatementContainer<?>, MetadataFilterContext, BaseExpirableStatementContainer<?>> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultEntityStatementMetadataFilterStrategy.class);
-
- /** List of validation conditions. */
- @NonnullAfterInit
- private List<BiPredicate<BaseExpirableStatementContainer<?>, MetadataFilterContext>> validationConditions;
-
- /** List of custom metadata filter strategies. */
- @Nonnull private List<BiFunction<BaseExpirableStatementContainer<?>,
- MetadataFilterContext, BaseExpirableStatementContainer<?>>> customFilterStrategies;
-
- /**
- * Constructor.
- */
- public DefaultEntityStatementMetadataFilterStrategy() {
- customFilterStrategies = CollectionSupport.emptyList();
- }
-
- /**
- * Set the list of validation conditions.
- *
- * @param predicates validation conditions
- */
- public void setValidationConditions(
- @Nonnull final List<BiPredicate<BaseExpirableStatementContainer<?>, MetadataFilterContext>> predicates) {
- checkSetterPreconditions();
- validationConditions = Constraint.isNotNull(predicates, "List of validation conditions cannot be null");
- }
-
- /**
- * Set the list of custom metadata filter strategies.
- *
- * @param strategies metadata filter strategies
- */
- public void setCustomFilterStrategies(@Nullable final List<BiFunction<BaseExpirableStatementContainer<?>,
- MetadataFilterContext, BaseExpirableStatementContainer<?>>> strategies) {
- checkSetterPreconditions();
- customFilterStrategies = strategies == null ? CollectionSupport.emptyList() : strategies;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (validationConditions == null) {
- throw new ComponentInitializationException("List of validation conditions cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public BaseExpirableStatementContainer<?> apply(@Nullable final BaseExpirableStatementContainer<?> container,
- @Nullable final MetadataFilterContext filterContext) {
- checkComponentActive();
- if (container == null) {
- return null;
- }
- for (final BiPredicate<BaseExpirableStatementContainer<?>, MetadataFilterContext> condition :
- validationConditions) {
- if (!condition.test(container, filterContext)) {
- log.debug("Condition {} failed, invalidating container for {}", condition, container.getEntityId());
- return container.invalidateStatement();
- }
- }
- log.debug("Metadata container successfully validated by all predicates for {}", container.getEntityId());
-
- BaseExpirableStatementContainer<?> result = container;
- for (final BiFunction<BaseExpirableStatementContainer<?>, MetadataFilterContext,
- BaseExpirableStatementContainer<?>> customFilterStrategy : customFilterStrategies) {
- log.trace("Applying custom filter strategy {}", customFilterStrategy);
- result = customFilterStrategy.apply(result, filterContext);
- if (result == null) {
- log.debug("Custom filter strategy {} returned null", customFilterStrategy);
- return null;
- }
- }
- return result;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementSignatureValidationCondition.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementSignatureValidationCondition.java
deleted file mode 100644
index 70b77f5..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementSignatureValidationCondition.java
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.function.BiPredicate;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.trust.TrustEngine;
-import org.slf4j.Logger;
-
-import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default signature validating filter for entity statement. The signature validation is performed via configurable
- * {@link TrustEngine}. The {@link CriteriaSet} passed to trust engine is fetched via configurable strategy.
- */
- at ThreadSafeAfterInit
-public class DefaultEntityStatementSignatureValidationCondition
- extends AbstractTrustEngineSignatureValidationComponent
- implements BiPredicate<BaseExpirableStatementContainer<?>, MetadataFilterContext> {
-
- /** Class logger. */
- @Nonnull private Logger log =
- LoggerFactory.getLogger(DefaultEntityStatementSignatureValidationCondition.class);
-
- /** Lookup strategy for criteria set passed to the trust engine. */
- @NonnullAfterInit private Function<BaseExpirableStatementContainer<?>, CriteriaSet> criteriaSetLookupStrategy;
-
- /**
- * Set the lookup strategy for criteria set passed to the trust engine.
- *
- * @param strategy lookup strategy
- */
- public void setCriteriaSetLookupStrategy(
- @Nonnull final Function<BaseExpirableStatementContainer<?>, CriteriaSet> strategy) {
- checkSetterPreconditions();
- criteriaSetLookupStrategy = Constraint.isNotNull(strategy, "CriteriaSet lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (criteriaSetLookupStrategy == null) {
- throw new ComponentInitializationException("CriteriaSet lookup strategy cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean test(@Nullable final BaseExpirableStatementContainer<?> responseContainer,
- @Nullable final MetadataFilterContext filterContext) {
- checkComponentActive();
- if (responseContainer == null) {
- return false;
- }
-
- final var statement = responseContainer.getStatement();
- final String entityId = responseContainer.getEntityId();
- if (statement != null ) {
- log.trace("Starting signature validation of statement for {}", entityId);
- final CriteriaSet criteria = criteriaSetLookupStrategy.apply(responseContainer);
- if (criteria == null) {
- log.error("Could not resolve criteria set for {}", entityId);
- return false;
- }
- if (!validateJwt(statement.getJwt(), criteria, entityId)) {
- return false;
- }
- } else {
- log.debug("Ignoring signature check for the error response for {}", entityId);
- }
- return true;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementValidationCriteriaSetLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementValidationCriteriaSetLookupFunction.java
deleted file mode 100644
index 3dd595b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultEntityStatementValidationCriteriaSetLookupFunction.java
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BaseJWTWrapper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default criteria set lookup strategy for {@link BaseExpirableStatementContainer}.
- */
- at ThreadSafeAfterInit
-public class DefaultEntityStatementValidationCriteriaSetLookupFunction
- extends AbstractIdentifiableInitializableComponent
- implements Function<BaseExpirableStatementContainer<?>, CriteriaSet> {
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(DefaultEntityStatementValidationCriteriaSetLookupFunction.class);
-
- /** Metadata cache used for fetching issuer entity configuration. */
- @NonnullAfterInit private MetadataCache<EntityConfigurationContainer> entityConfigurationCache;
-
- /**
- * Set the metadata cache used for fetching issuer entity configuration.
- *
- * @param cache entity configuration cache
- */
- public void setEntityConfigurationCache(@Nonnull final MetadataCache<EntityConfigurationContainer> cache) {
- checkSetterPreconditions();
- entityConfigurationCache = Constraint.isNotNull(cache, "Entity configuration cache cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (entityConfigurationCache == null) {
- throw new ComponentInitializationException("Trust Engine cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public CriteriaSet apply(@Nullable final BaseExpirableStatementContainer<?> metadataContainer) {
- if (metadataContainer != null && metadataContainer.getStatement() != null) {
- final BaseJWTWrapper<?> statement = metadataContainer.getStatement();
- assert statement != null;
- final SubjectStatementCriterion subjectCriterion = new SubjectStatementCriterion(statement);
- final IssuerEntityStatementCriterion issuerCriterion = getIssuerCriterion(statement);
- if (issuerCriterion == null) {
- log.debug("Issuer statement could not be fetched, returning null");
- return null;
- }
- return new CriteriaSet(subjectCriterion, issuerCriterion);
- }
-
- log.debug("Entity statement is not found from the container {}, returning null", metadataContainer);
- return null;
-
- }
-
- /**
- * Fetch the issuer entity configuration from the metadata cache and initialize the criterion.
- *
- * @param statement the entity statement whose issuer is fetched
- * @return the issuer entity configuration, or null if could not be fetched
- */
- @Nullable protected IssuerEntityStatementCriterion getIssuerCriterion(
- @Nonnull final BaseJWTWrapper<?> statement) {
- final String issuer = statement.getIssuer();
- final CriteriaSet criteria = new CriteriaSet(new SubjectEntityIDCriterion(issuer));
- try {
- final List<EntityConfigurationContainer> result = entityConfigurationCache.get(criteria);
- if (!result.isEmpty()) {
- final EntityConfiguration issuerStatement = result.get(0).getStatement();
- if (issuerStatement != null) {
- return new IssuerEntityStatementCriterion(issuerStatement);
- }
- }
- } catch (final MetadataCacheException e) {
- log.debug("Error while fetching issuer entity configuration for {}", issuer, e);
- }
- log.warn("Could not fetch entity configuration for {}", issuer);
- return null;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultPrivateKeyJwtClientAuthenticationFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultPrivateKeyJwtClientAuthenticationFunction.java
deleted file mode 100644
index 0919c87..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultPrivateKeyJwtClientAuthenticationFunction.java
+++ /dev/null
@@ -1,315 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.text.ParseException;
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Date;
-import java.util.List;
-import java.util.function.BiConsumer;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.apache.hc.core5.http.HttpRequest;
-import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.message.BasicNameValuePair;
-import org.opensaml.messaging.encoder.AbstractMessageEncoder;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.encoding.impl.ResponseUtil;
-import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
-import net.shibboleth.oidc.security.impl.JWSTokenSigner;
-import net.shibboleth.oidc.security.jose.SignatureException;
-import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
-import net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver;
-import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.primitive.StringSupport;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-import net.shibboleth.shared.security.IdentifierGenerationStrategy;
-import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
-
-/**
- * Default implementation for function providing private_key_jwt authentication.
- */
-public class DefaultPrivateKeyJwtClientAuthenticationFunction extends AbstractIdentifiableInitializableComponent
- implements BiFunction<CriteriaSet,List<String>,BiConsumer<HttpRequest,List<NameValuePair>>> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultPrivateKeyJwtClientAuthenticationFunction.class);
-
- /** Used to log protocol messages. */
- @Nonnull private Logger protocolMessageLog =
- LoggerFactory.getLogger(AbstractMessageEncoder.BASE_PROTOCOL_MESSAGE_LOGGER_CATEGORY + ".OAUTH2");
-
- /** Strategy used to lookup the security configuration used for signing the JWT used in authentication */
- @NonnullAfterInit private Function<CriteriaSet,JSONSecurityConfiguration> securityConfigurationLookupStrategy;
-
- /** Strategy used to lookup the type header value for the JWT. */
- @NonnullAfterInit private Function<CriteriaSet,String> typeHeaderLookupStrategy;
-
- /** Strategy to find the audience value from the criteria set.*/
- @NonnullAfterInit private Function<CriteriaSet,String> audienceLookupStrategy;
-
- /** Strategy to find the issuer/subject value from the criteria set.*/
- @NonnullAfterInit private Function<CriteriaSet,String> issuerLookupStrategy;
-
- /** Strategy used to locate the {@link IdentifierGenerationStrategy} to use. */
- @Nonnull private Function<CriteriaSet,IdentifierGenerationStrategy> idGeneratorLookupStrategy;
-
- /** Resolver for signing parameters. */
- @NonnullAfterInit private SignatureSigningParametersResolver resolver;
-
- /** The offset to add to the 'exp' claim time for JWT client authentication methods. Default is 30 seconds.*/
- @Nonnull private Duration jwtBearerExpiryOffset;
-
- /** Object mapper used for pretty-printing JWT contents. */
- @NonnullAfterInit private ObjectMapper objectMapper;
-
- public DefaultPrivateKeyJwtClientAuthenticationFunction() {
- idGeneratorLookupStrategy = FunctionSupport.constant(new SecureRandomIdentifierGenerationStrategy());
- final Duration thirtySecs = Duration.ofSeconds(30);
- assert thirtySecs != null;
- jwtBearerExpiryOffset = thirtySecs;
- }
-
- public void setSecurityConfigurationLookupStrategy(
- @Nonnull final Function<CriteriaSet,JSONSecurityConfiguration> strategy) {
- checkSetterPreconditions();
- securityConfigurationLookupStrategy =
- Constraint.isNotNull(strategy, "The security configuration lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to lookup the type header value for the JWT.
- *
- * @param strategy What to set.
- */
- public void setTypeHeaderLookupStrategy(@Nonnull final Function<CriteriaSet,String> strategy) {
- checkSetterPreconditions();
- typeHeaderLookupStrategy = Constraint.isNotNull(strategy, "The type header lookup strategy cannot be null");
- }
-
- /**
- * Set the audience lookup strategy.
- *
- * @param strategy the strategy.
- */
- public void setAudienceLookupStrategy(
- @Nonnull final Function<CriteriaSet, String> strategy) {
- checkSetterPreconditions();
- audienceLookupStrategy = Constraint.isNotNull(strategy, "Audience lookup strategy can not be null");
- }
-
- /**
- * Set the issuer/subject lookup strategy.
- *
- * @param strategy the strategy.
- */
- public void setIssuerLookupStrategy(
- @Nonnull final Function<CriteriaSet, String> strategy) {
- checkSetterPreconditions();
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy can not be null");
- }
-
- /**
- * Set the object mapper used for pretty-printing JWT contents.
- *
- * @param mapper What to set.
- */
- public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- checkSetterPreconditions();
- objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
- }
-
- /**
- * Set the strategy used to locate the {@link IdentifierGenerationStrategy} to use.
- *
- * @param strategy lookup strategy
- */
- public void setIdentifierGeneratorLookupStrategy(
- @Nonnull final Function<CriteriaSet,IdentifierGenerationStrategy> strategy) {
- checkSetterPreconditions();
-
- idGeneratorLookupStrategy =
- Constraint.isNotNull(strategy, "Identifier generation strategy cannot be null");
- }
-
- /**
- * Set the resolver to use for the signing parameters.
- *
- * @param newResolver resolver to use
- */
- public void setSignatureSigningParametersResolver(
- @Nonnull final SignatureSigningParametersResolver newResolver) {
- checkSetterPreconditions();
-
- resolver = Constraint.isNotNull(newResolver, "SignatureSigningParametersResolver cannot be null");
- }
-
- /**
- * Set the JWT expiry time offset for client authentications.
- *
- * @param expiry the JWT 'exp' claim offset
- */
- public void setJwtBearerExpiryOffset(@Nonnull final Duration expiry) {
- checkSetterPreconditions();
-
- jwtBearerExpiryOffset = Constraint.isNotNull(expiry, "jwtBearerExpiryOffset can not be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (securityConfigurationLookupStrategy == null) {
- throw new ComponentInitializationException("The security configuration lookup strategy cannot be null");
- }
- if (typeHeaderLookupStrategy == null) {
- throw new ComponentInitializationException("The type header lookup strategy cannot be null");
- }
- if (audienceLookupStrategy == null) {
- throw new ComponentInitializationException("The audience lookup strategy cannot be null)");
- }
- if (issuerLookupStrategy == null) {
- throw new ComponentInitializationException("The issuer lookup strategy cannot be null)");
- }
- if (objectMapper == null) {
- throw new ComponentInitializationException("Object mapper cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public BiConsumer<HttpRequest,List<NameValuePair>> apply(@Nullable final CriteriaSet criteria,
- @Nullable final List<String> methods) {
- checkComponentActive();
- if (methods == null || !methods.contains("private_key_jwt")) {
- log.debug("No supported client authentication methods in {}, nothing to do", methods);
- return null;
- }
- final JSONSecurityConfiguration securityConfiguration = securityConfigurationLookupStrategy.apply(criteria);
- if (securityConfiguration == null || securityConfiguration.getJwtSignatureSigningConfiguration() == null) {
- log.error("Could not resolve signature signing configuration");
- return null;
- }
-
- final SignatureSigningParameters signingParameters;
- try {
- final CriteriaSet resolverCriteria = criteria == null ? new CriteriaSet() : criteria;
- resolverCriteria.add(new SignatureSigningConfigurationCriterion(
- securityConfiguration.getJwtSignatureSigningConfiguration()));
- signingParameters = resolver.resolveSingle(resolverCriteria);
- if (signingParameters == null) {
- log.error("Failed to resolve signature signing parameters");
- return null;
- }
- log.debug("Signature signing parameters successfully resolved");
- } catch (final ResolverException e) {
- log.error("Error resolving signature signing parameters", e);
- return null;
- }
-
- final String typeHeader = typeHeaderLookupStrategy.apply(criteria);
- final String audience = audienceLookupStrategy.apply(criteria);
- if (StringSupport.trimOrNull(audience) == null) {
- log.warn("Could not resolve audience for the JWT");
- return null;
- }
- final String issuer = issuerLookupStrategy.apply(criteria);
- if (StringSupport.trimOrNull(issuer) == null) {
- log.warn("Could not resolve issuer/subject for the JWT");
- return null;
- }
- final IdentifierGenerationStrategy idGenerator = idGeneratorLookupStrategy.apply(criteria);
- if (idGenerator == null) {
- log.error("Could not resolve identifier generator for JWT");
- return null;
- }
- assert issuer != null; assert audience != null;
- final SignedJWT jwt = constructJWT(idGenerator.generateIdentifier(), issuer, audience, signingParameters,
- typeHeader);
- if (jwt == null) {
- return null;
- }
- return new BiConsumer<HttpRequest,List<NameValuePair>>() {
-
- /** {@inheritDoc} */
- @Override
- public void accept(@Nullable final HttpRequest httpRequest,
- @Nullable final List<NameValuePair> parameters) {
- if (httpRequest == null || parameters == null) {
- return;
- }
- parameters.add(new BasicNameValuePair(
- "client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"));
- parameters.add(new BasicNameValuePair("client_assertion", jwt.serialize()));
- }
-
- };
- }
-
- /**
- * Construct a {@link SignedJWT} with the given input claims and signing parameters.
- * @param issuer The issuer for the JWT
- * @param audience The audience for the JWT
- * @param signingParameters The signing parameters
- * @param typeHeader The type header value for the JWT
- * @return A signed JWT, or null
- */
- @Nullable protected SignedJWT constructJWT(@Nonnull @NotEmpty final String jti,
- @Nonnull @NotEmpty final String issuer, @Nonnull @NotEmpty final String audience,
- @Nonnull final SignatureSigningParameters signingParameters, @Nullable final String typeHeader) {
- final JWTClaimsSet jwtClaims = new JWTClaimsSet.Builder()
- .subject(issuer)
- .issuer(issuer)
- .audience(audience)
- .issueTime(Date.from(Instant.now()))
- .expirationTime(Date.from(Instant.now().plus(jwtBearerExpiryOffset)))
- .jwtID(jti)
- .build();
- assert jwtClaims != null;
- final JWSTokenSigner signer = new JWSTokenSigner(signingParameters);
- try {
- assert objectMapper != null;
- protocolMessageLog.trace("JWT client authentication payload contents:\n{}",
- ResponseUtil.getJwtProtocolMessage(jwtClaims, objectMapper));
- } catch (final ParseException e) {
- log.error("Could not construct the protocol message of the JWT contents", e);
- }
- try {
- return signer.sign(jwtClaims, typeHeader);
- } catch (final SignatureException e) {
- log.error("Could not sign the JWT", e);
- }
- return null;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultResponseContainerExpirationTimeStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultResponseContainerExpirationTimeStrategy.java
deleted file mode 100644
index 8451dcf..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultResponseContainerExpirationTimeStrategy.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.time.Instant;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.oidc.metadata.cache.ExpirationTimeContext;
-
-/**
- * Default strategy for fetching expiration time for the response containers extending {@link
- * BaseExpirableMetadataContainer}. The expiration instant is fetched from which is before: the instant returned by
- * {@link BaseExpirableMetadataContainer#getExpirationInstant()} or {@link ExpirationTimeContext#getMaxCacheDuration()}.
- */
- at ThreadSafe
-public class DefaultResponseContainerExpirationTimeStrategy
- implements Function<ExpirationTimeContext<BaseExpirableMetadataContainer>, Instant> {
-
- /** {@inheritDoc} */
- @Nullable public Instant apply(@Nullable final ExpirationTimeContext<BaseExpirableMetadataContainer> context) {
- if (context == null) {
- return null;
- }
- final Instant contextExpiration = context.getNow().plus(context.getMaxCacheDuration());
- final BaseExpirableMetadataContainer container = context.getMetadata();
- if (container == null) {
- return contextExpiration;
- }
- final Instant containerExpiration = container.getExpirationInstant();
- return containerExpiration.isBefore(contextExpiration) ? containerExpiration : contextExpiration;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainHeaderValidationCondition.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainHeaderValidationCondition.java
deleted file mode 100644
index 32cdee3..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/DefaultTrustChainHeaderValidationCondition.java
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.text.ParseException;
-import java.util.List;
-import java.util.Set;
-import java.util.function.BiPredicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jose.JWSHeader;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default validator that validates the syntax of trust_chain and peer_trust_chain headers if they're allowed to be
- * used with the given entity statement {@link SignedJWT}.
- */
-public class DefaultTrustChainHeaderValidationCondition extends AbstractIdentifiableInitializableComponent
- implements BiPredicate<SignedJWT, ProfileRequestContext> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultTrustChainHeaderValidationCondition.class);
-
- /** JSON object mapper used for decoding entity statement payload. */
- @NonnullAfterInit private ObjectMapper objectMapper;
-
- /** The flag to indicate allowing the use of trust_chain header. */
- private boolean allowTrustChainHeader = false;
-
- /** The flag to indicate allowing the use of peer_trust_chain header. */
- private boolean allowPeerTrustChainHeader = false;
-
- /** The flag to indicate requiring the same trust anchor if both headers are present. */
- private boolean requireCommonTrustAnchor = true;
-
- /**
- * Set the JSON {@link ObjectMapper} used for decoding entity statement payload.
- *
- * @param mapper object mapper
- */
- public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- checkSetterPreconditions();
- objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
- }
-
- /**
- * Set the flag to indicate allowing the use of trust_chain header.
- *
- * @param flag value
- */
- public void setAllowTrustChainHeader(final boolean flag) {
- checkSetterPreconditions();
- allowTrustChainHeader = flag;
- }
-
- /**
- * Set the flag to indicate allowing the use of peer_trust_chain header.
- *
- * @param flag value
- */
- public void setAllowPeerTrustChainHeader(final boolean flag) {
- checkSetterPreconditions();
- allowPeerTrustChainHeader = flag;
- }
-
- /**
- * Set the flag to indicate requiring the same trust anchor if both headers are present.
- *
- * @param flag value
- */
- public void setRequireCommonTrustAnchor(final boolean flag) {
- checkSetterPreconditions();
- requireCommonTrustAnchor = flag;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (objectMapper == null) {
- throw new ComponentInitializationException("ObjectMapper cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean test(@Nullable final SignedJWT signedJwt,
- @Nullable final ProfileRequestContext profileRequestContext) {
- checkComponentActive();
- if (signedJwt == null || signedJwt.getHeader() == null || profileRequestContext == null) {
- log.error("Invalid input: signed JWT nor profile request context cannot be null");
- return false;
- }
- final JWTClaimsSet claimsSet;
- try {
- claimsSet = signedJwt.getJWTClaimsSet();
- } catch (final ParseException e) {
- log.warn("Could not parse entity statement claims set", e);
- return false;
- }
- final JWSHeader header = signedJwt.getHeader();
- assert header != null;
- final Set<String> params = header.getIncludedParams();
- final List<EntityStatement<?>> trustChain;
- if (params.contains("trust_chain")) {
- if (!allowTrustChainHeader) {
- log.warn("The use of trust_chain header is not allowed for {}", claimsSet.getSubject());
- return false;
- }
- trustChain = parseToList(header.getCustomParam("trust_chain"), profileRequestContext);
- if (trustChain == null) {
- log.warn("Could not parse trust_chain contents into a trust chain");
- return false;
- }
- } else {
- trustChain = null;
- }
-
- final List<EntityStatement<?>> peerTrustChain;
- if (params.contains("peer_trust_chain")) {
- if (!allowPeerTrustChainHeader) {
- log.warn("The use of peer_trust_chain header is not allowed for {}", claimsSet.getSubject());
- return false;
- }
- peerTrustChain = parseToList(header.getCustomParam("peer_trust_chain"), profileRequestContext);
- if (peerTrustChain == null) {
- log.warn("Could not parse peer_trust_chain contents into a trust chain");
- return false;
- }
- } else {
- peerTrustChain = null;
- }
-
- if (trustChain != null && peerTrustChain != null) {
- if (requireCommonTrustAnchor) {
- log.debug("Both trust_chain and peer_trust_chain exists, verifying the trust anchors match");
- final String trustChainAnchor = trustChain.get(trustChain.size() - 1).getSubject();
- final String peerTrustChainAnchor = peerTrustChain.get(peerTrustChain.size() - 1).getSubject();
- if (!trustChainAnchor.equals(peerTrustChainAnchor)) {
- log.warn("The trust_chain anchor {} does not match with the peer_trust_chain anchor {}",
- trustChainAnchor, peerTrustChainAnchor);
- return false;
- }
- }
- }
- return true;
- }
-
- /**
- * Parse the raw object to trust chain.
- *
- * @param input raw object
- * @param profileRequestContext profile request context
- * @return trust chain if the input could be parsed, null otherwise
- */
- @Nullable protected List<EntityStatement<?>> parseToList(@Nullable final Object input,
- @Nonnull final ProfileRequestContext profileRequestContext) {
- if (input instanceof List<?> list) {
- final List<String> strings = list.stream()
- .filter(String.class::isInstance)
- .map(String.class::cast)
- .toList();
- assert strings != null; assert objectMapper != null;
- return EntityStatementHelper.deserializeTrustChain(strings, objectMapper);
- }
- return null;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/FederationEndpointEntityStatementCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/FederationEndpointEntityStatementCriterion.java
deleted file mode 100644
index 848fb9a..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/FederationEndpointEntityStatementCriterion.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing an entity statement of an entity offering federation API endpoints.
- */
-public class FederationEndpointEntityStatementCriterion implements Criterion {
-
- /** The entity statement value. */
- @Nonnull final EntityStatement<?> value;
-
- /**
- * Constructor.
- *
- * @param statement the entity statement value, must not be null
- */
- public FederationEndpointEntityStatementCriterion(@Nonnull final EntityStatement<?> statement) {
- value = Constraint.isNotNull(statement, "Entity statement cannot be null");
- }
-
- /**
- * Get the entity statement value.
- *
- * @return the entity statement value
- */
- @Nonnull public EntityStatement<?> getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "FederationEndpointEntityStatementCriterion [value=" + value.getJwt().serialize() + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final FederationEndpointEntityStatementCriterion other = (FederationEndpointEntityStatementCriterion) obj;
- return value.getJwt().serialize().equals(other.value.getJwt().serialize());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityIDCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityIDCriterion.java
deleted file mode 100644
index dfbdc85..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityIDCriterion.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing an issuer entity ID in entity statement.
- */
-public class IssuerEntityIDCriterion implements Criterion {
-
- /** The entity ID value. */
- @Nonnull @NotEmpty final String value;
-
- /**
- * Constructor.
- *
- * @param entityId the entity ID value, must not be null
- */
- public IssuerEntityIDCriterion(@Nonnull @NotEmpty final String entityId) {
- value = Constraint.isNotEmpty(entityId, "Entity ID cannot be null");
- }
-
- /**
- * Get the entity ID value.
- *
- * @return the entity ID value
- */
- @Nonnull @NotEmpty public String getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "IssuerEntityIDCriterion [value=" + value + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final IssuerEntityIDCriterion other = (IssuerEntityIDCriterion) obj;
- return value.equals(other.value);
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityStatementCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityStatementCriterion.java
deleted file mode 100644
index 05d3616..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/IssuerEntityStatementCriterion.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing a subject entity statement.
- */
-public class IssuerEntityStatementCriterion implements Criterion {
-
- /** The entity statement value. */
- @Nonnull final EntityStatement<?> value;
-
- /**
- * Constructor.
- *
- * @param statement the entity statement value, must not be null
- */
- public IssuerEntityStatementCriterion(@Nonnull final EntityStatement<?> statement) {
- value = Constraint.isNotNull(statement, "Entity statement cannot be null");
- }
-
- /**
- * Get the entity statement value.
- *
- * @return the entity statement value
- */
- @Nonnull public EntityStatement<?> getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "IssuerEntityStatementCriterion [value=" + value.getJwt().serialize() + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final IssuerEntityStatementCriterion other = (IssuerEntityStatementCriterion) obj;
- return value.getJwt().serialize().equals(other.value.getJwt().serialize());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/PreSelectedTrustChainCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/PreSelectedTrustChainCriterion.java
deleted file mode 100644
index 65431fd..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/PreSelectedTrustChainCriterion.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.List;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing entity IDs for a pre-selected trust chain.
- */
-public class PreSelectedTrustChainCriterion implements Criterion {
-
- /** The entity ID values. */
- @Nonnull @NotEmpty private final List<String> value;
-
- /**
- * Constructor.
- *
- * @param entityIds the entity ID values, must not be null
- */
- public PreSelectedTrustChainCriterion(@Nonnull final List<String> entityIds) {
- value = Constraint.isNotNull(entityIds, "Entity ID cannot be null");
- }
-
- /**
- * Get the entity ID values.
- *
- * @return the entity ID values
- */
- @Nonnull public List<String> getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "PreSelectedTrustChainCriterion [value=" + value + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final PreSelectedTrustChainCriterion other = (PreSelectedTrustChainCriterion) obj;
- return value.containsAll(other.value) && other.value.containsAll(value);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/ResponseContainerExpirationCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/ResponseContainerExpirationCriterion.java
deleted file mode 100644
index 3c65d86..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/ResponseContainerExpirationCriterion.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.time.Instant;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing expiration instant for a response message container.
- */
-public class ResponseContainerExpirationCriterion implements Criterion {
-
- /** The expiration instant. */
- @Nonnull private final Instant instant;
-
- /**
- * Constructor.
- *
- * @param expirationInstant expiration instant, must not be null
- */
- public ResponseContainerExpirationCriterion(@Nonnull final Instant expirationInstant) {
- instant = Constraint.isNotNull(expirationInstant, "Expiration instant cannot be null");
- }
-
- /**
- * Get the expiration instant.
- *
- * @return the expiration instant
- */
- @Nonnull public Instant getExpirationInstant() {
- return instant;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "ResolveEntityContainerExpirationCriterion [instant=" + instant.toEpochMilli() + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(instant);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final ResponseContainerExpirationCriterion other = (ResponseContainerExpirationCriterion) obj;
- return instant.equals(other.instant);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SignatureValidationKeyContainerJwtCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SignatureValidationKeyContainerJwtCriterion.java
deleted file mode 100644
index 9f1397f..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SignatureValidationKeyContainerJwtCriterion.java
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Objects;
-
-import javax.annotation.Nullable;
-
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * An implementation of {@link Criterion} which specifies criteria based on the contents of a {@link SignedJWT} element
- * containing signature validation keys.
- */
-public final class SignatureValidationKeyContainerJwtCriterion implements Criterion {
-
- /** The JWT which serves as the source for credential criteria. */
- @Nullable private SignedJWT jwt;
-
- /**
- * Constructor.
- *
- * @param keyContainer the key container criteria to use
- */
- public SignatureValidationKeyContainerJwtCriterion(@Nullable final SignedJWT keyContainer) {
- setJwt(keyContainer);
- }
-
- /**
- * Gets the JWT which is the source of credential criteria.
- *
- * @return the JWT credential criteria
- */
- @Nullable public SignedJWT getJwt() {
- return jwt;
- }
-
- /**
- * Sets the JWT which is the source of credential criteria.
- *
- * @param keyContainer the key container criteria to use
- *
- */
- public void setJwt(@Nullable final SignedJWT keyContainer) {
- // Note: we allow JOSEObject to be null to handle case where application context,
- // other accompanying criteria, etc should be used to resolve credentials.
- jwt = keyContainer;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- final StringBuilder builder = new StringBuilder();
- builder.append("SignatureValidationKeyContainerJwtCriterion [jwt=");
- builder.append("<contents not displayable>");
- builder.append("]");
- return builder.toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- if (jwt != null) {
- return jwt.hashCode();
- }
- return super.hashCode();
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
-
- if (obj == null) {
- return false;
- }
-
- if (obj instanceof SignatureValidationKeyContainerJwtCriterion other) {
- return Objects.equals(jwt, other.jwt);
- }
-
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityIDCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityIDCriterion.java
deleted file mode 100644
index 9f77f2b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityIDCriterion.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing a subject entity ID in entity statement.
- */
-public class SubjectEntityIDCriterion implements Criterion {
-
- /** The entity ID value. */
- @Nonnull @NotEmpty private final String value;
-
- /**
- * Constructor.
- *
- * @param entityId the entity ID value, must not be null
- */
- public SubjectEntityIDCriterion(@Nonnull @NotEmpty final String entityId) {
- value = Constraint.isNotEmpty(entityId, "Entity ID cannot be null");
- }
-
- /**
- * Get the entity ID value.
- *
- * @return the entity ID value
- */
- @Nonnull @NotEmpty public String getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "SubjectEntityIDCriterion [value=" + value + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final SubjectEntityIDCriterion other = (SubjectEntityIDCriterion) obj;
- return value.equals(other.value);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityStatementCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityStatementCriterion.java
deleted file mode 100644
index 11accbd..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectEntityStatementCriterion.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing a subject entity statement.
- */
-public class SubjectEntityStatementCriterion implements Criterion {
-
- /** The entity statement value. */
- @Nonnull final EntityStatement<?> value;
-
- /**
- * Constructor.
- *
- * @param statement the entity statement value, must not be null
- */
- public SubjectEntityStatementCriterion(@Nonnull final EntityStatement<?> statement) {
- value = Constraint.isNotNull(statement, "Entity statement cannot be null");
- }
-
- /**
- * Get the entity statement value.
- *
- * @return the entity statement value
- */
- @Nonnull public EntityStatement<?> getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "SubjectEntityStatementCriterion [value=" + value.getJwt().serialize() + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final SubjectEntityStatementCriterion other = (SubjectEntityStatementCriterion) obj;
- return value.getJwt().serialize().equals(other.value.getJwt().serialize());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectLocallyTrustedKeysCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectLocallyTrustedKeysCriterion.java
deleted file mode 100644
index 86b0e73..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectLocallyTrustedKeysCriterion.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing locally trusted keys for a subject.
- */
-public class SubjectLocallyTrustedKeysCriterion implements Criterion {
-
- /** The locally trusted keys. */
- @Nonnull final JWKSet value;
-
- /**
- * Constructor.
- *
- * @param jwkSet the locally trusted key set, must not be null
- */
- public SubjectLocallyTrustedKeysCriterion(@Nonnull final JWKSet jwkSet) {
- value = Constraint.isNotNull(jwkSet, "JWKSet cannot be null");
- }
-
- /**
- * Get the locally trusted keys.
- *
- * @return the locally rusted keys
- */
- @Nonnull public JWKSet getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "SubjectLocallyTrustedKeysCriterion [value=" + value.toString() + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final SubjectLocallyTrustedKeysCriterion other = (SubjectLocallyTrustedKeysCriterion) obj;
- return value.toString().equals(other.value.toString());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectStatementCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectStatementCriterion.java
deleted file mode 100644
index 30e9b2c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/SubjectStatementCriterion.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BaseJWTWrapper;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing a subject statement.
- */
-public class SubjectStatementCriterion implements Criterion {
-
- /** The statement value. */
- @Nonnull final BaseJWTWrapper<?> value;
-
- /**
- * Constructor.
- *
- * @param statement the statement value, must not be null
- */
- public SubjectStatementCriterion(
- @Nonnull final BaseJWTWrapper<?> statement) {
- value = Constraint.isNotNull(statement, "Entity statement cannot be null");
- }
-
- /**
- * Get the statement value.
- *
- * @return the statement value
- */
- @Nonnull public BaseJWTWrapper<?> getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "SubjectStatementCriterion [value=" + value.getJwt().serialize() + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final SubjectStatementCriterion other = (SubjectStatementCriterion) obj;
- return value.getJwt().serialize().equals(other.value.getJwt().serialize());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustAnchorEntityIDsCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustAnchorEntityIDsCriterion.java
deleted file mode 100644
index 4884e17..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustAnchorEntityIDsCriterion.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.List;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing trust anchor entity IDs in resolve entity request.
- */
-public class TrustAnchorEntityIDsCriterion implements Criterion {
-
- /** The entity ID values. */
- @Nonnull final List<String> values;
-
- /**
- * Constructor.
- *
- * @param entityIds the entity ID values, must not be null nor empty
- */
- public TrustAnchorEntityIDsCriterion(@Nonnull @NotEmpty final List<String> entityIds) {
- Constraint.isNotEmpty(entityIds, "Entity IDs cannot be null nor empty");
- values = entityIds;
- }
-
- /**
- * Get the entity ID values.
- *
- * @return the entity ID values
- */
- @Nonnull @NotEmpty public List<String> getValues() {
- return values;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "TrustAnchorEntityIDsCriterion [values=" + values + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(values);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final TrustAnchorEntityIDsCriterion other = (TrustAnchorEntityIDsCriterion) obj;
- return values.containsAll(other.values) && other.values.containsAll(values);
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkCriterion.java
deleted file mode 100644
index beb25c3..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkCriterion.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing a trust mark.
- */
-public class TrustMarkCriterion implements Criterion {
-
- /** The trust mark value. */
- @Nonnull final SignedJWT value;
-
- /**
- * Constructor.
- *
- * @param jwt the trust mark value, must not be null
- */
- public TrustMarkCriterion(@Nonnull final SignedJWT jwt) {
- value = Constraint.isNotNull(jwt, "Trust Mark cannot be null");
- }
-
- /**
- * Get the trust mark value.
- *
- * @return the trust mar value
- */
- @Nonnull public SignedJWT getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "TrustMarkCriterion [value=" + value.serialize() + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final TrustMarkCriterion other = (TrustMarkCriterion) obj;
- return value.serialize().equals(other.value.serialize());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkOwnersCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkOwnersCriterion.java
deleted file mode 100644
index b63fe28..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/TrustMarkOwnersCriterion.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache;
-
-import java.util.Map;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.TrustMarkOwner;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing trust mark owners.
- */
-public class TrustMarkOwnersCriterion implements Criterion {
-
- /** The trust mark owners. */
- @Nonnull private final Map<String, TrustMarkOwner> owners;
-
- /**
- * Constructor.
- *
- * @param trustMarkOwners the truts mark owners, must not be null
- */
- public TrustMarkOwnersCriterion(@Nonnull final Map<String, TrustMarkOwner> trustMarkOwners) {
- owners = Constraint.isNotNull(trustMarkOwners, "Trust Mark owners cannot be null");
- }
-
- /**
- * Get the trust mark owners value.
- *
- * @return the trust mark owners value
- */
- @Nonnull
- public Map<String, TrustMarkOwner> getValue() {
- return owners;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "TrustMarkOwnersCriterion [owners=" + owners + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(owners);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final TrustMarkOwnersCriterion other = (TrustMarkOwnersCriterion) obj;
- return owners.equals(other.owners);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/DefaultEntityConfigurationCriteriaSetLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/DefaultEntityConfigurationCriteriaSetLookupFunction.java
deleted file mode 100644
index 0002890..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/DefaultEntityConfigurationCriteriaSetLookupFunction.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration;
-
-import java.util.Optional;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default criteria set lookup strategy for entity configurations.
- */
- at ThreadSafe
-public class DefaultEntityConfigurationCriteriaSetLookupFunction
- implements Function<BaseExpirableStatementContainer<?>, CriteriaSet> {
-
- /** {@inheritDoc} */
- @Override @Nullable
- public CriteriaSet apply(@Nullable final BaseExpirableStatementContainer<?> metadataContainer) {
- return Optional.ofNullable(metadataContainer)
- .map(container -> container.getStatement())
- .filter(EntityConfiguration.class::isInstance)
- .map(EntityConfiguration.class::cast)
- .map(statement -> statement != null ?
- new CriteriaSet(new SubjectEntityStatementCriterion(statement)) : null)
- .orElse(null);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/DefaultEntityConfigurationFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/DefaultEntityConfigurationFetchingStrategy.java
deleted file mode 100644
index dabaa7d..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/DefaultEntityConfigurationFetchingStrategy.java
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration;
-
-import java.io.IOException;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.apache.hc.client5.http.classic.methods.HttpGet;
-import org.apache.hc.core5.http.ClassicHttpRequest;
-import org.apache.hc.core5.http.ClassicHttpResponse;
-import org.apache.hc.core5.http.ProtocolException;
-import org.apache.hc.core5.http.io.entity.EntityUtils;
-import org.apache.hc.core5.net.URIBuilder;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.EntityConfigurationImpl;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching entity configuration for the request specified in the criteria set. The parsed
- * response details are stored inside a {@link EntityConfigurationContainer}.
- */
- at ThreadSafeAfterInit
-public class DefaultEntityConfigurationFetchingStrategy
- extends AbstractFederationEndpointResponseFetchingStrategy<String, EntityConfigurationContainer> {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("entity-statement+jwt");
-
- /** The HTTP response content type. */
- @Nonnull public static final String HTTP_RESPONSE_CONTENT_TYPE = "application/" + JWT_TYPE_HEADER.toString();
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultEntityConfigurationFetchingStrategy.class);
-
- /**
- * Constructor.
- */
- public DefaultEntityConfigurationFetchingStrategy() {
- setCriteriaToRequestDataStrategy(criteria -> {
- final SubjectEntityIDCriterion criterion = criteria.get(SubjectEntityIDCriterion.class);
- if (criterion == null) {
- log.debug("No SubjectEntityIDCriterion, returning null");
- return null;
- }
- return criterion.getValue();
- });
- }
-
- /** {@inheritDoc} */
- @Nullable protected ClassicHttpRequest initializeHttpRequest(@Nonnull final CriteriaSet criteria,
- @Nonnull final String entityId) {
- final HttpGet httpRequest = new HttpGet(entityId);
- try {
- final String path = httpRequest.getPath();
- final URI uri =
- new URIBuilder(httpRequest.getUri()).setPath(
- (path.endsWith("/") ? path : path.concat("/"))
- .concat(".well-known/openid-federation")).build();
- httpRequest.setUri(uri);
- } catch (final URISyntaxException e) {
- log.error("Could not create URI with the given parameters {}", entityId, e);
- }
- return httpRequest;
- }
-
- /** {@inheritDoc} */
- @Nullable protected EntityConfigurationContainer parseHttpResponse(@Nonnull final CriteriaSet criteria,
- @Nonnull final String entityId, @Nullable final ClassicHttpResponse response,
- @Nonnull final Instant validExpiration, @Nonnull final Instant invalidExpiration,
- @Nonnull final Instant nullExpiration) throws ProtocolException, IOException {
- if (response != null) {
- if (!HTTP_RESPONSE_CONTENT_TYPE.equals(response.getEntity().getContentType())) {
- log.warn("Unexpected content type: {}", response.getEntity().getContentType());
- return new EntityConfigurationContainer(entityId, null, validExpiration, invalidExpiration);
- }
-
- try {
- final String content = EntityUtils.toString(response.getEntity());
- log.trace("Attempting to parse signed JWT from content: {}", content);
- final SignedJWT jwt = SignedJWT.parse(content);
- if (!JWT_TYPE_HEADER.equals(jwt.getHeader().getType())) {
- log.warn("Unexpected JWT type header {}", jwt.getHeader().getType());
- return new EntityConfigurationContainer(entityId, null, validExpiration, invalidExpiration);
- }
- assert objectMapper != null;
- final EntityConfiguration entityConfiguration = EntityConfigurationImpl.parse(jwt, objectMapper);
- return new EntityConfigurationContainer(
- entityId, entityConfiguration, validExpiration, invalidExpiration);
- } catch (final JsonProcessingException e) {
- log.warn("Could not deserialize entity statement payload from the response", e);
- } catch (final ConstraintViolationException e) {
- log.warn("Parsed entity configuration claims did not pass syntax validation", e);
- } catch (java.text.ParseException e) {
- log.warn("Could not parse JWT from the response", e);
- }
- return new EntityConfigurationContainer(entityId, null, validExpiration, invalidExpiration);
- } else {
- log.debug("Unable to fetch entity configuration for: {} (null response)", entityId);
- return new EntityConfigurationContainer(entityId, null, validExpiration, nullExpiration);
- }
- }
-
- /** {@inheritDoc} */
- @Nullable protected EntityConfigurationContainer handleException(@Nonnull final CriteriaSet criteria,
- @Nonnull final String entityId, @Nonnull final Throwable throwable, @Nonnull final Instant expiration) {
- return new EntityConfigurationContainer(entityId, null, expiration, expiration);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/EntityConfigurationContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/EntityConfigurationContainer.java
deleted file mode 100644
index 848bd46..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/EntityConfigurationContainer.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableStatementContainer;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A container class for metadata caches carrying entity ID and statement details related to Entity Configuration.
- */
-public class EntityConfigurationContainer extends BaseExpirableStatementContainer<EntityConfiguration>
- implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 756269369356865370L;
-
- /** Requested entity ID. */
- @Nonnull @NotEmpty private final String entityId;
-
- /**
- * Constructor.
- *
- * @param entity entity ID, must not be null
- * @param configuration entity configuration parsed from the response
- * @param validExpirationInstant expiration instant for valid statement, must not be null
- * @param invalidExpirationInstant expiration instant for invalid statement, must not be null
- */
- public EntityConfigurationContainer(@Nonnull @NotEmpty final String entity,
- @Nullable final EntityConfiguration configuration, @Nonnull final Instant validExpirationInstant,
- @Nonnull final Instant invalidExpirationInstant) {
- super(validExpirationInstant, configuration, invalidExpirationInstant);
- entityId = Constraint.isNotNull(entity, "Entity ID cannot be empty");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getEntityId() {
- return entityId;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/ProvidedEntityConfigurationContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/ProvidedEntityConfigurationContainer.java
deleted file mode 100644
index 46be49f..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/ProvidedEntityConfigurationContainer.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration;
-
-import java.time.Instant;
-import java.util.Optional;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-
-/**
- * Metadata cache container for provided entity configuration.
- */
-public class ProvidedEntityConfigurationContainer extends EntityConfigurationContainer {
-
- /** Serial version UID. */
- private static final long serialVersionUID = -6322735237721678470L;
-
- /**
- * Constructor.
- *
- * @param configuration provided entity configuration
- */
- public ProvidedEntityConfigurationContainer(@Nonnull final EntityConfiguration configuration) {
- super(configuration.getSubject(), configuration, parseExpirationInstant(configuration),
- parseExpirationInstant(configuration));
- }
-
- /**
- * Parse expiration instant from entity configuration.
- *
- * @param configuration entity configuration
- * @return expiration set in configuration, or 5 minutes from now if it was not set
- */
- @Nonnull private static Instant parseExpirationInstant(@Nonnull final EntityConfiguration configuration) {
- final Instant expiration = Optional.ofNullable(configuration.getParsedPayload().getExpiration())
- .orElse(Instant.now().plusSeconds(300));
- assert expiration != null;
- return expiration;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/ProvidedEntityConfigurationContainerCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/ProvidedEntityConfigurationContainerCriterion.java
deleted file mode 100644
index 4953de1..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/configuration/ProvidedEntityConfigurationContainerCriterion.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing a provided entity configuration container.
- */
-public class ProvidedEntityConfigurationContainerCriterion implements Criterion {
-
- /** The entity configuration container value. */
- @Nonnull final ProvidedEntityConfigurationContainer value;
-
- /**
- * Constructor.
- *
- * @param container the entity configuration container value, must not be null
- */
- public ProvidedEntityConfigurationContainerCriterion(
- @Nonnull final ProvidedEntityConfigurationContainer container) {
- value = Constraint.isNotNull(container, "Entity configuration container cannot be null");
- }
-
- /**
- * Get the entity configuration container value.
- *
- * @return the container value
- */
- @Nonnull public ProvidedEntityConfigurationContainer getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- final var statement = value.getStatement();
- return "ProvidedEntityConfigurationContainerCriterion [value="
- + (statement == null ? "null" : statement.getJwt().serialize())
- + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final ProvidedEntityConfigurationContainerCriterion other = (ProvidedEntityConfigurationContainerCriterion) obj;
- final var statement = value.getStatement();
- final var otherStatement = other.value.getStatement();
- if (statement == null) {
- return otherStatement == null;
- } else {
- return statement.getJwt().serialize().equals(otherStatement == null ?
- null : otherStatement.getJwt().serialize());
- }
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/DefaultSignedKeysetCriteriaSetLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/DefaultSignedKeysetCriteriaSetLookupFunction.java
deleted file mode 100644
index 0d7607c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/DefaultSignedKeysetCriteriaSetLookupFunction.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset;
-
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignedKeyset;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default criteria set lookup strategy for signed keyset.
- */
- at ThreadSafe
-public class DefaultSignedKeysetCriteriaSetLookupFunction
- implements Function<BaseExpirableStatementContainer<?>, CriteriaSet> {
-
- /** {@inheritDoc} */
- @Override @Nullable
- public CriteriaSet apply(@Nullable final BaseExpirableStatementContainer<?> metadataContainer) {
- if (metadataContainer instanceof SignedKeysetContainer keysetContainer) {
- final CriteriaSet result = new CriteriaSet(
- new SubjectEntityStatementCriterion(keysetContainer.getIdentifier().getEntityConfiguration()));
- final SignedKeyset keyset = keysetContainer.getStatement();
- if (keyset != null) {
- result.add(new SubjectSignedKeysetCriterion(keyset));
- }
- return result;
- }
- return null;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/DefaultSignedKeysetFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/DefaultSignedKeysetFetchingStrategy.java
deleted file mode 100644
index 115bc3b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/DefaultSignedKeysetFetchingStrategy.java
+++ /dev/null
@@ -1,145 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset;
-
-import java.io.IOException;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.apache.hc.client5.http.classic.methods.HttpGet;
-import org.apache.hc.core5.http.ClassicHttpRequest;
-import org.apache.hc.core5.http.ClassicHttpResponse;
-import org.apache.hc.core5.http.ProtocolException;
-import org.apache.hc.core5.http.io.entity.EntityUtils;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignedKeyset;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.SignedKeysetImpl;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching signed keyset for the request specified in the criteria set. The parsed response
- * details are stored inside a {@link SignedKeysetContainer}.
- */
- at ThreadSafeAfterInit
-public class DefaultSignedKeysetFetchingStrategy
- extends AbstractFederationEndpointResponseFetchingStrategy<SignedKeysetCacheIdentifier, SignedKeysetContainer> {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("jwk-set+jwt");
-
- /** The HTTP response content type. */
- @Nonnull public static final String HTTP_RESPONSE_CONTENT_TYPE = "application/" + JWT_TYPE_HEADER.toString();
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultSignedKeysetFetchingStrategy.class);
-
- /**
- * Constructor.
- */
- public DefaultSignedKeysetFetchingStrategy() {
- setCriteriaToRequestDataStrategy(criteria -> {
- final SubjectEntityStatementCriterion subjectCriterion =
- criteria.get(SubjectEntityStatementCriterion.class);
- if (subjectCriterion == null) {
- log.debug("No SubjectEntityStatementCriterion, returning null");
- return null;
- }
- final SubjectSignedKeysetUriCriterion uriCriterion = criteria.get(SubjectSignedKeysetUriCriterion.class);
- if (uriCriterion == null) {
- log.debug("No SubjectSignedKeysetUriCriterion, returning null");
- return null;
- }
- if (subjectCriterion.getValue() instanceof EntityConfiguration entityConfiguration) {
- return new SignedKeysetCacheIdentifier(entityConfiguration, uriCriterion.getValue());
- }
- log.debug("SubjectEntityStatementCriterion did not contain entity configuration, returning null");
- return null;
- });
- }
-
- /** {@inheritDoc} */
- @Nullable protected ClassicHttpRequest initializeHttpRequest(@Nonnull final CriteriaSet criteria,
- @Nonnull final SignedKeysetCacheIdentifier identifier) {
- try {
- return new HttpGet(new URI(identifier.getUri()));
- } catch (final URISyntaxException e) {
- log.error("Could not create URI for {} with the given parameters {}",
- identifier.getEntityConfiguration().getSubject(), identifier.getUri(), e);
- }
- return null;
- }
-
- /** {@inheritDoc} */
- @Nullable protected SignedKeysetContainer parseHttpResponse(@Nonnull final CriteriaSet criteria,
- @Nonnull final SignedKeysetCacheIdentifier identifier, @Nullable final ClassicHttpResponse response,
- @Nonnull final Instant validExpiration, @Nonnull final Instant invalidExpiration,
- @Nonnull final Instant nullExpiration) throws ProtocolException, IOException {
- if (response != null) {
- if (!HTTP_RESPONSE_CONTENT_TYPE.equals(response.getEntity().getContentType())) {
- log.warn("Unexpected content type: {}", response.getEntity().getContentType());
- return new SignedKeysetContainer(identifier, null, validExpiration, invalidExpiration);
- }
-
- try {
- final String content = EntityUtils.toString(response.getEntity());
- log.trace("Attempting to parse signed JWT from content: {}", content);
- final SignedJWT jwt = SignedJWT.parse(content);
- if (!JWT_TYPE_HEADER.equals(jwt.getHeader().getType())) {
- log.warn("Unexpected JWT type header {}", jwt.getHeader().getType());
- return new SignedKeysetContainer(identifier, null, validExpiration, invalidExpiration);
- }
- assert objectMapper != null;
- final SignedKeyset signedKeyset = SignedKeysetImpl.parse(jwt, objectMapper);
- return new SignedKeysetContainer(
- identifier, signedKeyset, validExpiration, invalidExpiration);
- } catch (final JsonProcessingException e) {
- log.warn("Could not deserialize signed keyset payload from the response", e);
- } catch (final ConstraintViolationException e) {
- log.warn("Parsed signed keyset claims did not pass syntax validation", e);
- } catch (java.text.ParseException e) {
- log.warn("Could not parse JWT from the response", e);
- }
- return new SignedKeysetContainer(identifier, null, validExpiration, invalidExpiration);
- } else {
- log.debug("Unable to fetch signed keyset for: {}, from {} (null response)",
- identifier.getEntityConfiguration().getSubject(), identifier.getUri());
- return new SignedKeysetContainer(identifier, null, validExpiration, nullExpiration);
- }
- }
-
- /** {@inheritDoc} */
- @Nullable protected SignedKeysetContainer handleException(@Nonnull final CriteriaSet criteria,
- @Nonnull final SignedKeysetCacheIdentifier identifier, @Nonnull final Throwable throwable,
- @Nonnull final Instant expiration) {
- return new SignedKeysetContainer(identifier, null, expiration, expiration);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SignedKeysetCacheIdentifier.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SignedKeysetCacheIdentifier.java
deleted file mode 100644
index 7b7b50e..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SignedKeysetCacheIdentifier.java
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset;
-
-import java.io.Serializable;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Default identifier for signed keyset within {@link SignedKeysetContainer}.
- */
-public class SignedKeysetCacheIdentifier implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = -4169816153785776493L;
-
- /** Entity configuration related to the signed keyset. */
- @Nonnull private final EntityConfiguration entityConfiguration;
-
- /** URI of the signed keyset. */
- @Nonnull @NotEmpty private final String uri;
-
- /**
- * Constructor.
- *
- * @param configuration entity configuration
- * @param keysetUri keyset URI
- */
- public SignedKeysetCacheIdentifier(@Nonnull final EntityConfiguration configuration,
- @Nonnull @NotEmpty final String keysetUri) {
- entityConfiguration = Constraint.isNotNull(configuration, "Subject entity configuration cannot be empty");
- uri = Constraint.isNotEmpty(keysetUri, "Keyset URI cannot be empty");
- }
-
- /**
- * Get the URI of the signed keyset.
- *
- * @return uri
- */
- @Nonnull @NotEmpty public String getUri() {
- return uri;
- }
-
- /**
- * Get the subject entity configuration
- *
- * @return entity configuration
- */
- @Nonnull public EntityConfiguration getEntityConfiguration() {
- return entityConfiguration;
- }
-
- /** {@inheritDoc} */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("entityConfiguration", getEntityConfiguration().getJwt().serialize())
- .add("uri", getUri())
- .toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(uri, entityConfiguration);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
-
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final SignedKeysetCacheIdentifier other = (SignedKeysetCacheIdentifier) obj;
- return uri.equals(other.uri) && entityConfiguration.getJwt().serialize().equals(
- other.entityConfiguration.getJwt().serialize());
-
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SignedKeysetContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SignedKeysetContainer.java
deleted file mode 100644
index b766e71..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SignedKeysetContainer.java
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignedKeyset;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableStatementContainer;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A container class for metadata caches carrying entity ID and keyset URI details related to signed keyset.
- */
-public class SignedKeysetContainer extends BaseExpirableStatementContainer<SignedKeyset>
- implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 756269369356865370L;
-
- /** Signed keyset identifier. */
- @Nonnull private final SignedKeysetCacheIdentifier identifier;
-
- /**
- * Constructor.
- *
- * @param id signed keyset identifier, must not be null
- * @param keyset signed keyset parsed from the response
- * @param validExpirationInstant expiration instant for valid statement, must not be null
- * @param invalidExpirationInstant expiration instant for invalid statement, must not be null
- */
- public SignedKeysetContainer(@Nonnull final SignedKeysetCacheIdentifier id,
- @Nullable final SignedKeyset keyset, @Nonnull final Instant validExpirationInstant,
- @Nonnull final Instant invalidExpirationInstant) {
- super(validExpirationInstant, keyset, invalidExpirationInstant);
- identifier = Constraint.isNotNull(id, "Signed keyset identifier cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getEntityId() {
- return identifier.getEntityConfiguration().getSubject();
- }
-
- /**
- * Get the signed keyset cache identifier.
- *
- * @return keyset cache identifier
- */
- @Nonnull public SignedKeysetCacheIdentifier getIdentifier() {
- return identifier;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SubjectSignedKeysetCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SubjectSignedKeysetCriterion.java
deleted file mode 100644
index d32a486..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SubjectSignedKeysetCriterion.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignedKeyset;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing a subject signed keyset.
- */
-public class SubjectSignedKeysetCriterion implements Criterion {
-
- /** The signed keyset value. */
- @Nonnull final SignedKeyset value;
-
- /**
- * Constructor.
- *
- * @param keyset signed keyset value, must not be null
- */
- public SubjectSignedKeysetCriterion(@Nonnull final SignedKeyset keyset) {
- value = Constraint.isNotNull(keyset, "Signed keyset cannot be null");
- }
-
- /**
- * Get the signed keyset value.
- *
- * @return the signed keyset value
- */
- @Nonnull public SignedKeyset getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "SubjectSignedKeysetCriterion [value=" + value.getJwt().serialize() + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final SubjectSignedKeysetCriterion other = (SubjectSignedKeysetCriterion) obj;
- return value.getJwt().serialize().equals(other.value.getJwt().serialize());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SubjectSignedKeysetUriCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SubjectSignedKeysetUriCriterion.java
deleted file mode 100644
index e0ab097..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/keyset/SubjectSignedKeysetUriCriterion.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing a signed_jwks_uri value for an entity.
- */
-public class SubjectSignedKeysetUriCriterion implements Criterion {
-
- /** The signed keyset URI value. */
- @Nonnull @NotEmpty private final String value;
-
- /**
- * Constructor.
- *
- * @param uri the signed keyset URI value, must not be null
- */
- public SubjectSignedKeysetUriCriterion(@Nonnull @NotEmpty final String uri) {
- value = Constraint.isNotEmpty(uri, "Signed keyset URI cannot be null");
- }
-
- /**
- * Get the signed keyset URI value.
- *
- * @return the signed keyset URI value
- */
- @Nonnull @NotEmpty public String getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "SubjectSignedKeysetUriCriterion [value=" + value + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final SubjectSignedKeysetUriCriterion other = (SubjectSignedKeysetUriCriterion) obj;
- return value.equals(other.value);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationMetadataSkeletonLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationMetadataSkeletonLookupStrategy.java
deleted file mode 100644
index c221e5d..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationMetadataSkeletonLookupStrategy.java
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.util.Map;
-import java.util.Optional;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching skeleton for entity configuration metadata via criteria.
- */
- at ThreadSafeAfterInit
-public class DefaultEntityConfigurationMetadataSkeletonLookupStrategy extends AbstractIdentifiableInitializableComponent
- implements Function<CriteriaSet, Map<String,Map<String,Object>>> {
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(DefaultEntityConfigurationMetadataSkeletonLookupStrategy.class);
-
- /** Metadata cache providing metadata skeleton. */
- @NonnullAfterInit private MetadataCache<Map<String,Map<String,Object>>> metadataSkeletonCache;
-
- /**
- * Set the cache providing metadata skeleton.
- *
- * @param cache cache providing metadata skeleton
- */
- public void setMetadataSkeletonCache(@Nonnull final MetadataCache<Map<String,Map<String,Object>>> cache) {
- checkSetterPreconditions();
- metadataSkeletonCache = Constraint.isNotNull(cache, "Metadata skeleton cache cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (metadataSkeletonCache == null) {
- throw new ComponentInitializationException("Metadata skeleton cache cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public Map<String,Map<String,Object>> apply(@Nullable final CriteriaSet criteria) {
- checkComponentActive();
- if (criteria != null) {
- try {
- return Optional.of(metadataSkeletonCache.get(criteria))
- .filter(result -> result.size() == 1)
- .map(result -> result.get(0))
- .orElse(CollectionSupport.emptyMap());
- } catch (final MetadataCacheException e) {
- log.error("Could not fetch metadata skeleton via metadata cache", e);
- }
- }
- return CollectionSupport.emptyMap();
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationResponseFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationResponseFetchingStrategy.java
deleted file mode 100644
index 90898c7..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityConfigurationResponseFetchingStrategy.java
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching entity configuration response container via criteria.
- */
- at ThreadSafeAfterInit
-public class DefaultEntityConfigurationResponseFetchingStrategy extends AbstractIdentifiableInitializableComponent
- implements Function<CriteriaSet, NimbusResponseContainer> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultEntityConfigurationResponseFetchingStrategy.class);
-
- /** {@inheritDoc} */
- @Override @Nullable
- public NimbusResponseContainer apply(@Nullable final CriteriaSet criteria) {
- checkComponentActive();
- if (criteria == null) {
- return null;
- }
- final NimbusResponseCriterion responseCriterion = criteria.get(NimbusResponseCriterion.class);
- if (responseCriterion == null) {
- log.debug("No response criterion given, returning null");
- return null;
- }
- final ResponseContainerExpirationCriterion expirationCriterion =
- criteria.get(ResponseContainerExpirationCriterion.class);
- if (expirationCriterion == null) {
- log.debug("No expiration criterion given, returning null");
- return null;
- }
- return new NimbusResponseContainer(responseCriterion.getResponse(), expirationCriterion.getExpirationInstant());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityStatementSignatureValidationFilterStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityStatementSignatureValidationFilterStrategy.java
deleted file mode 100644
index 4400056..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultEntityStatementSignatureValidationFilterStrategy.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.util.function.BiFunction;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.trust.TrustEngine;
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractTrustEngineSignatureValidationComponent;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default signature validating filter for entity statement. The signature validation is performed via configurable
- * {@link TrustEngine}.
- */
- at ThreadSafeAfterInit
-public class DefaultEntityStatementSignatureValidationFilterStrategy
- extends AbstractTrustEngineSignatureValidationComponent
- implements BiFunction<EntityStatement<?>, MetadataFilterContext, EntityStatement<?>> {
-
- /** Class logger. */
- @Nonnull private Logger log =
- LoggerFactory.getLogger(DefaultEntityStatementSignatureValidationFilterStrategy.class);
-
- /** {@inheritDoc} */
- @Override @Nullable
- public EntityStatement<?> apply(@Nullable final EntityStatement<?> entityStatement,
- @Nullable final MetadataFilterContext filterContext) {
- checkComponentActive();
- if (entityStatement == null) {
- return null;
- }
-
- final String entityId = entityStatement.getSubject();
- log.trace("Starting signature validation of entity statement for {}", entityId);
- final CriteriaSet criteria = new CriteriaSet(new SubjectEntityStatementCriterion(entityStatement));
- if (validateJwt(entityStatement.getJwt(), criteria, entityId)) {
- return entityStatement;
- }
- return null;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultLocalTrustAnchorsValidator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultLocalTrustAnchorsValidator.java
deleted file mode 100644
index 31192c8..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultLocalTrustAnchorsValidator.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.util.Map;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import org.slf4j.Logger;
-
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default validator for local trust anchor keyset. It verifies that the keyset only contains public keys. Otherwise
- * the keyset is considered as invalid.
- */
- at ThreadSafe
-public class DefaultLocalTrustAnchorsValidator implements Predicate<Map<String, LocalKeyContainer>> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultLocalTrustAnchorsValidator.class);
-
- /** {@inheritDoc} */
- @Override
- public boolean test(@Nullable final Map<String, LocalKeyContainer> keyContainers) {
- if (keyContainers == null) {
- return false;
- }
- for (final String anchor : keyContainers.keySet()) {
- final LocalKeyContainer container = keyContainers.get(anchor);
- if (container != null) {
- final JWKSet jwkSet = container.getJWKSet();
- if (jwkSet != null && jwkSet.containsNonPublicKeys()) {
- log.warn("Not accepting keyset for {} as it contains non-public keys", anchor);
- return false;
- }
- }
- }
- return true;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java
deleted file mode 100644
index 93ae01c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultNimbusResponseContainerExpirationTimeStrategy.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import java.util.Optional;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import com.nimbusds.openid.connect.sdk.federation.config.FederationEntityConfigurationSuccessResponse;
-
-import net.shibboleth.oidc.metadata.cache.ExpirationTimeContext;
-
-/**
- * Default strategy for fetching expiration time for the Nimbus response container. The expiration instant
- * is fetched from which is before: the success response message's JWT expiration time or the instant returned by
- * {@link NimbusResponseContainer#getExpirationInstant()} or {@link ExpirationTimeContext#getMaxCacheDuration()}.
- */
- at ThreadSafe
-public class DefaultNimbusResponseContainerExpirationTimeStrategy
- implements Function<ExpirationTimeContext<NimbusResponseContainer>, Instant> {
-
- /** {@inheritDoc} */
- @Nullable public Instant apply(@Nullable final ExpirationTimeContext<NimbusResponseContainer> context) {
- if (context == null) {
- return null;
- }
- final Instant contextExpiration = context.getNow().plus(context.getMaxCacheDuration());
- final NimbusResponseContainer container = context.getMetadata();
- if (container == null) {
- return contextExpiration;
- }
- final List<Instant> expirations = new ArrayList<>(List.of(contextExpiration, container.getExpirationInstant()));
- if (container.getResponse() instanceof FederationEntityConfigurationSuccessResponse successResponse) {
- Optional.ofNullable(successResponse.getEntityStatement().getClaimsSet().getExpirationTime())
- .map(date -> date.toInstant())
- .ifPresent(instant -> expirations.add(instant));
- }
- return Collections.min(expirations);
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityResponseFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityResponseFetchingStrategy.java
deleted file mode 100644
index f8a51e9..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/DefaultResolveEntityResponseFetchingStrategy.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching resolve entity response container via criteria. If no {@link NimbusResponseCriterion}
- * is included in the given criteria, a container with a null response expiring now is returned.
- */
- at ThreadSafeAfterInit
-public class DefaultResolveEntityResponseFetchingStrategy extends AbstractIdentifiableInitializableComponent
- implements Function<CriteriaSet, ResolveEntityResponseContainer> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultResolveEntityResponseFetchingStrategy.class);
-
- /** {@inheritDoc} */
- @Override @Nullable
- public ResolveEntityResponseContainer apply(@Nullable final CriteriaSet criteria) {
- checkComponentActive();
- if (criteria == null) {
- return null;
- }
- final ResolveEntityRequestCriterion requestCriterion = criteria.get(ResolveEntityRequestCriterion.class);
- if (requestCriterion == null) {
- log.debug("No request criterion given, returning null");
- return null;
- }
- final NimbusResponseCriterion responseCriterion = criteria.get(NimbusResponseCriterion.class);
- if (responseCriterion == null) {
- log.debug("No response criterion given, returning null");
- return null;
- }
- final ResponseContainerExpirationCriterion expirationCriterion =
- criteria.get(ResponseContainerExpirationCriterion.class);
- if (expirationCriterion == null) {
- log.debug("No expiration criterion given, returning null");
- return null;
- }
- return new ResolveEntityResponseContainer(responseCriterion.getResponse(), requestCriterion.getRequest(),
- expirationCriterion.getExpirationInstant());
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/LocalKeyContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/LocalKeyContainer.java
deleted file mode 100644
index e18fd84..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/LocalKeyContainer.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import javax.annotation.Nullable;
-
-import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.LocalKeyContainerDeserializer;
-
-/**
- * Key set container class wrapping {@link JWKSet}.
- */
- at JsonDeserialize(using = LocalKeyContainerDeserializer.class)
-public class LocalKeyContainer {
-
- /** The key set. */
- @Nullable private JWKSet jwkSet;
-
- /**
- * Constructor.
- */
- public LocalKeyContainer() {
- }
-
- /**
- * Get the key set.
- *
- * @return the key set
- */
- @Nullable public JWKSet getJWKSet() {
- return jwkSet;
- }
-
- /**
- * Set the key set.
- * @param set key set
- */
- public void setJWKSet(@Nullable final JWKSet set) {
- jwkSet = set;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseContainer.java
deleted file mode 100644
index 01a94cc..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseContainer.java
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.nimbusds.oauth2.sdk.Response;
-
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A container class for metadata caches carrying Nimbus response message.
- */
-public class NimbusResponseContainer implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 656269369356865370L;
-
- /** Response message. */
- @Nullable private final Response response;
-
- /** Expiration instant for this container. */
- @Nonnull private final Instant expiration;
-
- /**
- * Constructor.
- *
- * @param responseMessage response message
- * @param expirationInstant expiration instant
- */
- public NimbusResponseContainer(@Nullable final Response responseMessage,
- @Nonnull final Instant expirationInstant) {
- response = responseMessage;
- expiration = Constraint.isNotNull(expirationInstant, "Expiration instant cannot be null");
- }
-
- /**
- * Get response message.
- *
- * @return response message
- */
- @Nullable public Response getResponse() {
- return response;
- }
-
- /**
- * Get expiration instant.
- *
- * @return expiration instant
- */
- @Nonnull public Instant getExpirationInstant() {
- return expiration;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseCriterion.java
deleted file mode 100644
index ebaf7ac..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/NimbusResponseCriterion.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.oauth2.sdk.Response;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} carrying Nimbus response message.
- */
-public class NimbusResponseCriterion implements Criterion {
-
- /** The response message. */
- @Nonnull private final Response response;
-
- /**
- * Constructor.
- *
- * @param responseMessage response message, must not be null
- */
- public NimbusResponseCriterion(@Nonnull final Response responseMessage) {
- response = Constraint.isNotNull(responseMessage, "Response cannot be null");
- }
-
- /**
- * Get the response message.
- *
- * @return the response message
- */
- @Nonnull public Response getResponse() {
- return response;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "NimbusResponseCriterion [response=" + response + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(response);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final NimbusResponseCriterion other = (NimbusResponseCriterion) obj;
- return response.equals(other.response);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java
deleted file mode 100644
index d797b50..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityRequestCriterion.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing request message to a resolve entity API.
- */
-public class ResolveEntityRequestCriterion implements Criterion {
-
- /** The request message. */
- @Nonnull private final ResolveEntityRequest request;
-
- /**
- * Constructor.
- *
- * @param requestMessage request message, must not be null
- */
- public ResolveEntityRequestCriterion(@Nonnull final ResolveEntityRequest requestMessage) {
- request = Constraint.isNotNull(requestMessage, "Request cannot be null");
- }
-
- /**
- * Get the request message.
- *
- * @return the request message
- */
- @Nonnull public ResolveEntityRequest getRequest() {
- return request;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "ResolveEntityRequestCriterion [request=" + request + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(request);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final ResolveEntityRequestCriterion other = (ResolveEntityRequestCriterion) obj;
- //TODO: proper equals-check
- return request.equals(other.request);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityResponseContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityResponseContainer.java
deleted file mode 100644
index f1e5e19..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/local/ResolveEntityResponseContainer.java
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.nimbusds.oauth2.sdk.Response;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A container class for metadata caches carrying request and response message details related to Resolve Entity API.
- */
-public class ResolveEntityResponseContainer extends NimbusResponseContainer implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 756269369356865370L;
-
- /** Request message. */
- @Nonnull private final ResolveEntityRequest request;
-
- /**
- * Constructor.
- *
- * @param responseMessage response message
- * @param requestMessage request message
- * @param expirationInstant expiration instant
- */
- public ResolveEntityResponseContainer(@Nullable final Response responseMessage,
- @Nonnull final ResolveEntityRequest requestMessage, @Nonnull final Instant expirationInstant) {
- super(responseMessage, expirationInstant);
- request = Constraint.isNotNull(requestMessage, "Request message cannot be null");
- }
-
- /**
- * Get request message.
- *
- * @return request message
- */
- public ResolveEntityRequest getRequest() {
- return request;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java
deleted file mode 100644
index cbd106b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/DefaultResolveEntityTrustChainFetchingStrategy.java
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver;
-
-import java.io.IOException;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.nio.charset.StandardCharsets;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.function.BiConsumer;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.apache.hc.client5.http.classic.methods.HttpGet;
-import org.apache.hc.client5.http.classic.methods.HttpPost;
-import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
-import org.apache.hc.core5.http.ClassicHttpRequest;
-import org.apache.hc.core5.http.ClassicHttpResponse;
-import org.apache.hc.core5.http.ContentType;
-import org.apache.hc.core5.http.HttpHeaders;
-import org.apache.hc.core5.http.HttpRequest;
-import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.ProtocolException;
-import org.apache.hc.core5.http.io.entity.EntityUtils;
-import org.apache.hc.core5.http.message.BasicNameValuePair;
-import org.apache.hc.core5.net.URIBuilder;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.ResolveEntityResponseImpl;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching trust chain data via resolve entity API for a request specified in the criteria set.
- */
- at ThreadSafeAfterInit
-public class DefaultResolveEntityTrustChainFetchingStrategy
- extends AbstractFederationEndpointResponseFetchingStrategy
- <ResolveEntityCacheContainerIdentifier, ResolveEntityResponseContainer> {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("resolve-response+jwt");
-
- /** The HTTP response content type. */
- @Nonnull public static final String HTTP_RESPONSE_CONTENT_TYPE = "application/" + JWT_TYPE_HEADER.toString();
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultResolveEntityTrustChainFetchingStrategy.class);
-
- /**
- * Constructor.
- */
- public DefaultResolveEntityTrustChainFetchingStrategy() {
- setCriteriaToRequestDataStrategy(criteria -> {
- final ResolveEntityCacheIdentifierCriterion identifierCriterion =
- criteria.get(ResolveEntityCacheIdentifierCriterion.class);
- if (identifierCriterion == null) {
- log.debug("No identifier criterion given, returning null");
- return null;
- }
- return identifierCriterion.getIdentifier();
- });
- }
-
- /** {@inheritDoc} */
- @Nullable protected ClassicHttpRequest initializeHttpRequest(@Nonnull final CriteriaSet criteria,
- @Nonnull ResolveEntityCacheContainerIdentifier identifier) {
-
- final List<NameValuePair> nvps = new ArrayList<>();
- nvps.add(new BasicNameValuePair("sub", identifier.getSubject()));
- identifier.getTrustAnchors().forEach(anchor -> nvps.add(new BasicNameValuePair("trust_anchor", anchor)));
- identifier.getEntityTypes().forEach(type -> nvps.add(new BasicNameValuePair("entity_type", type)));
-
- final BiConsumer<HttpRequest,List<NameValuePair>> clientAuthentication = getClientAuthentication(criteria);
- if (clientAuthentication == null) {
- final HttpGet httpRequest = new HttpGet(identifier.getEndpoint());
- try {
- final URI uri = new URIBuilder(httpRequest.getUri()).addParameters(nvps).build();
- httpRequest.setUri(uri);
- } catch (final URISyntaxException e) {
- log.error("Could not create URI with the given parameters {}", identifier, e);
- }
- return httpRequest;
- } else {
- final HttpPost httpRequest = new HttpPost(identifier.getEndpoint());
- clientAuthentication.accept(httpRequest, nvps);
- final UrlEncodedFormEntity urlEncodedFormEntity = new UrlEncodedFormEntity(nvps, StandardCharsets.UTF_8);
- httpRequest.setEntity(urlEncodedFormEntity);
- httpRequest.setHeader(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_FORM_URLENCODED);
- return httpRequest;
- }
- }
-
- /** {@inheritDoc} */
- @Nullable protected ResolveEntityResponseContainer parseHttpResponse(@Nonnull final CriteriaSet criteria,
- @Nonnull final ResolveEntityCacheContainerIdentifier identifier,
- @Nullable final ClassicHttpResponse response, @Nonnull final Instant validExpiration,
- @Nonnull final Instant invalidExpiration, @Nonnull final Instant nullExpiration)
- throws ProtocolException, IOException {
- if (response != null) {
- if (!HTTP_RESPONSE_CONTENT_TYPE.equals(response.getEntity().getContentType())) {
- log.warn("Unexpected content type: {}", response.getEntity().getContentType());
- return new ResolveEntityResponseContainer(identifier, null, validExpiration, invalidExpiration);
- }
-
- try {
- final SignedJWT jwt = SignedJWT.parse(EntityUtils.toString(response.getEntity()));
- if (!JWT_TYPE_HEADER.equals(jwt.getHeader().getType())) {
- log.warn("Unexpected JWT type header {}", jwt.getHeader().getType());
- return new ResolveEntityResponseContainer(identifier, null, validExpiration,
- invalidExpiration);
- }
- assert objectMapper != null;
- final ResolveEntityResponse resolveEntity = ResolveEntityResponseImpl.parse(jwt, objectMapper);
- return new ResolveEntityResponseContainer(
- identifier, resolveEntity, validExpiration, invalidExpiration);
- } catch (final JsonProcessingException e) {
- log.warn("Could not deserialize entity statement payload from the response", e);
- } catch (final ConstraintViolationException e) {
- log.warn("Parsed entity configuration claims did not pass syntax validation", e);
- } catch (java.text.ParseException e) {
- log.warn("Could not parse JWT from the response", e);
- }
- return new ResolveEntityResponseContainer(identifier, null, validExpiration, invalidExpiration);
- } else {
- log.debug("Unable to fetch resolve entity response: {} (null response)", identifier.getEndpoint());
- return new ResolveEntityResponseContainer(identifier, null, validExpiration, nullExpiration);
- }
- }
-
- /** {@inheritDoc} */
- @Nullable protected ResolveEntityResponseContainer handleException(@Nonnull final CriteriaSet criteria,
- @Nonnull final ResolveEntityCacheContainerIdentifier identifier, @Nonnull final Throwable exception,
- @Nonnull final Instant expiration) {
- return new ResolveEntityResponseContainer(identifier, null, expiration, expiration);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/ResolveEntityCacheContainerIdentifier.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/ResolveEntityCacheContainerIdentifier.java
deleted file mode 100644
index d4ebb71..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/ResolveEntityCacheContainerIdentifier.java
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver;
-
-import java.io.Serializable;
-import java.util.List;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Default identifier for trust mark within {@link ResolveEntityResponseContainer}.
- */
-public class ResolveEntityCacheContainerIdentifier implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = -4143516153785776493L;
-
- /** The endpoint URI of the request. */
- @Nonnull @NotEmpty private final String endpoint;
-
- /** The requested subject. */
- @Nonnull @NotEmpty private final String subject;
-
- /** The requested trust anchors. */
- @Nonnull @NotEmpty private final List<String> trustAnchors;
-
- /** The requested entity types to resolve. */
- @Nonnull private final List<String> entityTypes;
-
- /**
- *
- * Constructor.
- *
- * @param uri endpoint URI
- * @param sub subject
- * @param anchors trust anchors
- * @param types optional entity types
- */
- public ResolveEntityCacheContainerIdentifier(@Nonnull final String uri,
- @Nonnull @NotEmpty final String sub,
- @Nonnull @NotEmpty final List<String> anchors,
- @Nullable final List<String> types) {
- endpoint = Constraint.isNotEmpty(uri, "Endpoint URI cannot be null");
- subject = Constraint.isNotNull(sub, "Subject cannot be empty");
- Constraint.isNotEmpty(anchors, "Trust anchors cannot be empty");
- trustAnchors = anchors;
- entityTypes = types == null ? CollectionSupport.emptyList() : CollectionSupport.copyToList(types);
- }
-
- /**
- * Returns the requested subject.
- *
- * @return The subject.
- */
- @Nonnull @NotEmpty public String getSubject() {
- return subject;
- }
-
- /**
- * Returns the requested trust anchor.
- *
- * @return The trust anchor.
- */
- @Nonnull @NotEmpty public List<String> getTrustAnchors() {
- return trustAnchors;
- }
-
- /**
- * Returns the requested entity type to resolve.
- *
- * @return The entity type to resolve.
- */
- @Nonnull public List<String> getEntityTypes() {
- return entityTypes;
- }
-
- /**
- * Get the endpoint for the request.
- *
- * @return endpoint
- */
- @Nonnull @NotEmpty public String getEndpoint() {
- return endpoint;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("subject", getSubject())
- .add("trustAnchors", getTrustAnchors())
- .add("entityTypes", getEntityTypes())
- .add("endpoint", getEndpoint())
- .toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(endpoint, subject, trustAnchors, entityTypes);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
-
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final ResolveEntityCacheContainerIdentifier other = (ResolveEntityCacheContainerIdentifier) obj;
- return endpoint.equals(other.endpoint) && subject.equals(other.subject)
- && trustAnchors.containsAll(other.trustAnchors) && other.trustAnchors.containsAll(trustAnchors)
- && entityTypes.containsAll(other.entityTypes) && other.entityTypes.containsAll(entityTypes);
-
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/ResolveEntityCacheIdentifierCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/ResolveEntityCacheIdentifierCriterion.java
deleted file mode 100644
index 7bbca27..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/ResolveEntityCacheIdentifierCriterion.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing request message details to Resolve Entity API.
- */
-public class ResolveEntityCacheIdentifierCriterion implements Criterion {
-
- /** The trust mark identifier. */
- @Nonnull private final ResolveEntityCacheContainerIdentifier identifier;
-
- /**
- * Constructor.
- *
- * @param id identifier, must not be null
- */
- public ResolveEntityCacheIdentifierCriterion(@Nonnull final ResolveEntityCacheContainerIdentifier id) {
- identifier = Constraint.isNotNull(id, "Identifier cannot be null");
- }
-
- /**
- * Get the trust mark identifier.
- *
- * @return the identifier
- */
- @Nonnull public ResolveEntityCacheContainerIdentifier getIdentifier() {
- return identifier;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "RemoteEntityCacheIdentifierCriterion [identifier=" + identifier + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(identifier);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final ResolveEntityCacheIdentifierCriterion other = (ResolveEntityCacheIdentifierCriterion) obj;
- return identifier.equals(other.identifier);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/ResolveEntityResponseContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/ResolveEntityResponseContainer.java
deleted file mode 100644
index fb4f757..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/resolver/ResolveEntityResponseContainer.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableStatementContainer;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A container class for metadata caches carrying ID and statement details related to Resolve Entity.
- */
-public class ResolveEntityResponseContainer extends BaseExpirableStatementContainer<ResolveEntityResponse>
- implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 756269564456865370L;
-
- /** Requested entity ID. */
- @Nonnull private final ResolveEntityCacheContainerIdentifier identifier;
-
- /**
- * Constructor.
- *
- * @param id identifier, must not be null
- * @param resolveEntity resolve entity response parsed from the response
- * @param validExpirationInstant expiration instant for valid statement, must not be null
- * @param invalidExpirationInstant expiration instant for invalid statement, must not be null
- */
- public ResolveEntityResponseContainer(@Nonnull final ResolveEntityCacheContainerIdentifier id,
- @Nullable final ResolveEntityResponse resolveEntity, @Nonnull final Instant validExpirationInstant,
- @Nonnull final Instant invalidExpirationInstant) {
- super(validExpirationInstant, resolveEntity, invalidExpirationInstant);
- identifier = Constraint.isNotNull(id, "Identifier cannot be null");
- }
-
- /**
- * Get entity ID.
- *
- * @return entity ID
- */
- @Nonnull @NotEmpty public ResolveEntityCacheContainerIdentifier getIdentifier() {
- return identifier;
- }
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getEntityId() {
- return identifier.getSubject();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementCriteriaToIdentifierStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementCriteriaToIdentifierStrategy.java
deleted file mode 100644
index 7292d1b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementCriteriaToIdentifierStrategy.java
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default identifier strategy for subordinate statement. The criteria set is transformed into a
- * {@link SubordinateStatementCacheIdentifier} that consists of subject and issuer entity IDs.
- */
- at ThreadSafeAfterInit
-public class DefaultSubordinateStatementCriteriaToIdentifierStrategy
- extends AbstractIdentifiableInitializableComponent
- implements Function<CriteriaSet, SubordinateStatementCacheIdentifier> {
-
- /** Strategy to fetch subject entity ID from criteria set. */
- @NonnullAfterInit private Function<CriteriaSet, String> criteriaToSubjectEntityIdStrategy;
-
- /** Strategy to fetch issuer entity ID from criteria set. */
- @NonnullAfterInit private Function<CriteriaSet, String> criteriaToIssuerEntityIdStrategy;
-
- /**
- * Set the strategy to fetch subject entity ID from criteria set.
- *
- * @param strategy lookup strategy
- */
- public void setCriteriaToSubjectEntityIdStrategy(@Nonnull final Function<CriteriaSet, String> strategy) {
- checkSetterPreconditions();
- criteriaToSubjectEntityIdStrategy = Constraint.isNotNull(strategy,
- "Criteria to subject entity ID strategy cannot be null");
- }
-
- /**
- * Set the strategy to fetch issuer entity ID from criteria set.
- *
- * @param strategy lookup strategy
- */
- public void setCriteriaToIssuerEntityIdStrategy(@Nonnull final Function<CriteriaSet, String> strategy) {
- checkSetterPreconditions();
- criteriaToIssuerEntityIdStrategy = Constraint.isNotNull(strategy,
- "Criteria to issuer entity ID strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (criteriaToSubjectEntityIdStrategy == null) {
- throw new ComponentInitializationException("Criteria to subject entity ID strategy cannot be null");
- }
- if (criteriaToIssuerEntityIdStrategy == null) {
- throw new ComponentInitializationException("Criteria to issuer entity ID strategy cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public SubordinateStatementCacheIdentifier apply(@Nullable final CriteriaSet criteria) {
- checkComponentActive();
- final String subjectEntityId = criteriaToSubjectEntityIdStrategy.apply(criteria);
- if (subjectEntityId == null) {
- return null;
- }
- final String issuerEntityId = criteriaToIssuerEntityIdStrategy.apply(criteria);
- if (issuerEntityId == null) {
- return null;
- }
- return new SubordinateStatementCacheIdentifier(issuerEntityId, subjectEntityId);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementFetchingStrategy.java
deleted file mode 100644
index 1c413e7..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/DefaultSubordinateStatementFetchingStrategy.java
+++ /dev/null
@@ -1,236 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate;
-
-import java.io.IOException;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.nio.charset.StandardCharsets;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.function.BiConsumer;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.apache.hc.client5.http.classic.methods.HttpGet;
-import org.apache.hc.client5.http.classic.methods.HttpPost;
-import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
-import org.apache.hc.core5.http.ClassicHttpRequest;
-import org.apache.hc.core5.http.ClassicHttpResponse;
-import org.apache.hc.core5.http.ContentType;
-import org.apache.hc.core5.http.HttpHeaders;
-import org.apache.hc.core5.http.HttpRequest;
-import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.ProtocolException;
-import org.apache.hc.core5.http.io.entity.EntityUtils;
-import org.apache.hc.core5.http.message.BasicNameValuePair;
-import org.apache.hc.core5.net.URIBuilder;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.SubordinateStatementImpl;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching entity configuration for the request specified in the criteria set. The parsed
- * response details are stored inside a {@link EntityConfigurationContainer}.
- */
- at ThreadSafeAfterInit
-public class DefaultSubordinateStatementFetchingStrategy
- extends AbstractFederationEndpointResponseFetchingStrategy
- <SubordinateStatementCacheIdentifier, SubordinateStatementContainer> {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("entity-statement+jwt");
-
- /** The HTTP response content type. */
- @Nonnull public static final String HTTP_RESPONSE_CONTENT_TYPE = "application/" + JWT_TYPE_HEADER.toString();
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultSubordinateStatementFetchingStrategy.class);
-
- /** The entity configuration cache used for fetching issuer statement. */
- @NonnullAfterInit private MetadataCache<EntityConfigurationContainer> entityConfigurationCache;
-
- /**
- * Constructor.
- */
- public DefaultSubordinateStatementFetchingStrategy() {
- setCriteriaToRequestDataStrategy(criteria -> {
- final SubjectEntityIDCriterion subjectCriterion = criteria.get(SubjectEntityIDCriterion.class);
- if (subjectCriterion == null) {
- log.debug("No SubjectEntityIDCriterion, returning null");
- return null;
- }
- final IssuerEntityIDCriterion issuerCriterion = criteria.get(IssuerEntityIDCriterion.class);
- if (issuerCriterion == null) {
- log.debug("No IssuerEntityIDCriterion, returning null");
- return null;
- }
- return new SubordinateStatementCacheIdentifier(issuerCriterion.getValue(), subjectCriterion.getValue());
- });
- }
-
- /**
- * Set the entity configuration cache used for fetching issuer statement.
- *
- * @param cache entity configuration cache
- */
- public void setEntityConfigurationCache(@Nonnull final MetadataCache<EntityConfigurationContainer> cache) {
- checkSetterPreconditions();
- entityConfigurationCache = Constraint.isNotNull(cache, "Entity configuration cache cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (entityConfigurationCache == null) {
- throw new ComponentInitializationException("Entity configuration cache cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Nullable protected ClassicHttpRequest initializeHttpRequest(@Nonnull final CriteriaSet criteria,
- @Nonnull final SubordinateStatementCacheIdentifier id) {
- final String issuerEntityId = id.getIssuer();
- final List<EntityConfigurationContainer> issuerStatements;
- try {
- issuerStatements =
- entityConfigurationCache.get(new CriteriaSet(new SubjectEntityIDCriterion(issuerEntityId)));
- } catch (final MetadataCacheException e) {
- log.error("Could not resolve entity configuration for issuer {}", issuerEntityId, e);
- return null;
- }
- if (issuerStatements.isEmpty()) {
- log.error("Could not resolve entity configuration for issuer {}", issuerEntityId);
- return null;
- }
- final EntityStatement<?> issuerStatement =
- Optional.ofNullable(issuerStatements.get(0).getStatement())
- .filter(statement -> statement instanceof EntityStatement<?>)
- .map(statement -> (EntityStatement<?>) statement)
- .orElse(null);
- if (issuerStatement == null) {
- log.warn("Could not resolve entity configuration for issuer {}", issuerEntityId);
- return null;
- }
- final Map<String, Object> federationEntity =
- Optional.of(issuerStatement)
- .map(statement -> statement.getParsedPayload().getMetadata())
- .map(metadata -> metadata.getFederationEntityMetadata())
- .orElse(null);
- if (federationEntity == null) {
- log.warn("Could not resolve federation entity metadata for issuer {}", issuerEntityId);
- return null;
- }
- if (federationEntity.get("federation_fetch_endpoint") instanceof String endpoint) {
- final BiConsumer<HttpRequest, List<NameValuePair>> clientAuthentication =
- getClientAuthentication(new CriteriaSet(
- new FederationEndpointEntityStatementCriterion(issuerStatement)));
- if (clientAuthentication == null) {
- final HttpGet httpRequest = new HttpGet(endpoint);
- try {
- final URI uri =
- new URIBuilder(httpRequest.getUri()).addParameter("sub", id.getSubject()).build();
- httpRequest.setUri(uri);
- } catch (final URISyntaxException e) {
- log.error("Could not create URI with the given parameters {}", issuerEntityId, e);
- }
- return httpRequest;
- } else {
- final HttpPost httpRequest = new HttpPost(endpoint);
- final List<NameValuePair> parameters = new ArrayList<>(
- List.of(new BasicNameValuePair("sub", id.getSubject())));
- clientAuthentication.accept(httpRequest, parameters);
- final UrlEncodedFormEntity urlEncodedFormEntity = new UrlEncodedFormEntity(parameters,
- StandardCharsets.UTF_8);
- httpRequest.setEntity(urlEncodedFormEntity);
- httpRequest.setHeader(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_FORM_URLENCODED);
- return httpRequest;
- }
- } else {
- log.warn("Could not parse federation_fetch_endpoint for {}", issuerEntityId);
- }
- return null;
- }
-
- /** {@inheritDoc} */
- @Nullable protected SubordinateStatementContainer parseHttpResponse(@Nonnull final CriteriaSet criteria,
- @Nonnull final SubordinateStatementCacheIdentifier id, @Nullable final ClassicHttpResponse response,
- @Nonnull final Instant validExpiration, @Nonnull final Instant invalidExpiration,
- @Nonnull final Instant nullExpiration) throws ProtocolException, IOException {
- if (response != null) {
- if (!HTTP_RESPONSE_CONTENT_TYPE.equals(response.getEntity().getContentType())) {
- log.warn("Unexpected content type: {}", response.getEntity().getContentType());
- return new SubordinateStatementContainer(id, null, validExpiration, invalidExpiration);
- }
-
- try {
- final String content = EntityUtils.toString(response.getEntity());
- log.trace("Attempting to parse signed JWT from content: {}", content);
- final SignedJWT jwt = SignedJWT.parse(content);
- if (!JWT_TYPE_HEADER.equals(jwt.getHeader().getType())) {
- log.warn("Unexpected JWT type header {}", jwt.getHeader().getType());
- return new SubordinateStatementContainer(id, null, validExpiration, invalidExpiration);
- }
- assert objectMapper != null;
- final SubordinateStatement statement = SubordinateStatementImpl.parse(jwt, objectMapper);
- log.trace("Subordinate statement successfully parsed and stored into the container");
- return new SubordinateStatementContainer(id, statement, validExpiration, invalidExpiration);
- } catch (final JsonProcessingException e) {
- log.warn("Could not deserialize entity statement payload from the response", e);
- } catch (final ConstraintViolationException e) {
- log.warn("Parsed entity configuration claims did not pass syntax validation", e);
- } catch (java.text.ParseException e) {
- log.warn("Could not parse JWT from the response", e);
- }
- return new SubordinateStatementContainer(id, null, validExpiration, invalidExpiration);
- } else {
- log.debug("Unable to fetch entity configuration for: {} (null response)", id);
- return new SubordinateStatementContainer(id, null, validExpiration, nullExpiration);
- }
- }
-
- /** {@inheritDoc} */
- @Nullable protected SubordinateStatementContainer handleException(@Nonnull final CriteriaSet criteria,
- @Nonnull final SubordinateStatementCacheIdentifier id, @Nonnull final Throwable exception,
- @Nonnull final Instant expiration) {
- return new SubordinateStatementContainer(id, null, expiration, expiration);
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/SubordinateStatementCacheIdentifier.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/SubordinateStatementCacheIdentifier.java
deleted file mode 100644
index 9c51af0..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/SubordinateStatementCacheIdentifier.java
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate;
-
-import java.io.Serializable;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Default identifier for subordinate statement within {@link SubordinateStatementContainer}.
- */
-public class SubordinateStatementCacheIdentifier implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = -4169816153785776493L;
-
- /** Issuer of the subordinate statement. */
- @Nonnull @NotEmpty private final String issuer;
-
- /** Subject of the subordinate statement. */
- @Nonnull @NotEmpty private final String subject;
-
- /**
- * Constructor.
- *
- * @param iss issuer
- * @param sub subject
- */
- public SubordinateStatementCacheIdentifier(@Nonnull @NotEmpty final String iss,
- @Nonnull @NotEmpty final String sub) {
- issuer = Constraint.isNotEmpty(iss, "Issuer cannot be empty");
- subject = Constraint.isNotEmpty(sub, "Subject cannot be empty");
- }
-
- /**
- * Get the issuer of the subordinate statement.
- *
- * @return issuer
- */
- @Nonnull @NotEmpty public String getIssuer() {
- return issuer;
- }
-
- /**
- * Get the subject of the subordinate statement.
- *
- * @return subject
- */
- @Nonnull @NotEmpty public String getSubject() {
- return subject;
- }
-
- /** {@inheritDoc} */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("issuer", getIssuer())
- .add("subject", getSubject())
- .toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(issuer, subject);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
-
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final SubordinateStatementCacheIdentifier other = (SubordinateStatementCacheIdentifier) obj;
- return issuer.equals(other.issuer) && subject.equals(other.subject);
-
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/SubordinateStatementContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/SubordinateStatementContainer.java
deleted file mode 100644
index 6a890a4..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/subordinate/SubordinateStatementContainer.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableStatementContainer;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A container class for metadata caches carrying ID and statement details related to Subordinate Statement.
- */
-public class SubordinateStatementContainer extends BaseExpirableStatementContainer<SubordinateStatement>
- implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 756269369356865370L;
-
- /** Requested entity ID. */
- @Nonnull private final SubordinateStatementCacheIdentifier identifier;
-
- /**
- * Constructor.
- *
- * @param id identifier, must not be null
- * @param statement subordinate statement parsed from the response
- * @param validExpirationInstant expiration instant for valid statement, must not be null
- * @param invalidExpirationInstant expiration instant for invalid statement, must not be null
- */
- public SubordinateStatementContainer(@Nonnull final SubordinateStatementCacheIdentifier id,
- @Nullable final SubordinateStatement statement, @Nonnull final Instant validExpirationInstant,
- @Nonnull final Instant invalidExpirationInstant) {
- super(validExpirationInstant, statement, invalidExpirationInstant);
- identifier = Constraint.isNotNull(id, "Identifier cannot be null");
- }
-
- /**
- * Get entity ID.
- *
- * @return entity ID
- */
- @Nonnull @NotEmpty public SubordinateStatementCacheIdentifier getIdentifier() {
- return identifier;
- }
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getEntityId() {
- return identifier.getSubject();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainFetchingStrategy.java
deleted file mode 100644
index b1f59ce..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainFetchingStrategy.java
+++ /dev/null
@@ -1,463 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.PreSelectedTrustChainCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate.SubordinateStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.collection.Pair;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching trust chains for an entity specified in the criteria set. Caches for entity
- * configurations and subordinate statements are exploited for actual fetching of the entity statements. The
- * entity configuration may also be delivered via {@link SubjectEntityStatementCriterion} in the criteria set.
- */
- at ThreadSafeAfterInit
-public class DefaultTrustChainFetchingStrategy extends AbstractIdentifiableInitializableComponent
- implements Function<CriteriaSet, TrustChainsContainer> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultTrustChainFetchingStrategy.class);
-
- /** Strategy for fetching entity ID from the criteria set. */
- @NonnullAfterInit private Function<CriteriaSet, String> criteriaToSubjectEntityIdStrategy;
-
- /** Cache for entity configurations. */
- @NonnullAfterInit private MetadataCache<EntityConfigurationContainer> entityConfigurationCache;
-
- /** Cache for subordinate entity statements. */
- @NonnullAfterInit private MetadataCache<SubordinateStatementContainer> subordinateStatementCache;
-
- /** Cache containing local copies of trusted trust anchor keys. */
- @NonnullAfterInit private MetadataCache<Map<String, LocalKeyContainer>> localTrustAnchorsCache;
-
- /** Strategy to fetch lifetime for container with valid contents. */
- @NonnullAfterInit private Function<CriteriaSet, Duration> criteriaToValidContainerLifetimeStrategy;
-
- /** Strategy to fetch lifetime for container with invalid contents. */
- @NonnullAfterInit private Function<CriteriaSet, Duration> criteriaToInvalidContainerLifetimeStrategy;
-
- /**
- * Set the strategy for fetching entity ID from the criteria set.
- *
- * @param strategy fetching strategy
- */
- public void setCriteriaToSubjectEntityIdStrategy(@Nonnull final Function<CriteriaSet, String> strategy) {
- checkSetterPreconditions();
- criteriaToSubjectEntityIdStrategy = Constraint.isNotNull(strategy,
- "Criteria to subject entity ID strategy cannot be null");
- }
-
- /**
- * Set the cache for entity configurations.
- *
- * @param cache entity configurations cache
- */
- public void setEntityConfigurationCache(@Nonnull final MetadataCache<EntityConfigurationContainer> cache) {
- checkSetterPreconditions();
- entityConfigurationCache = Constraint.isNotNull(cache, "Entity Configuration cache cannot be null");
- }
-
- /**
- * Set the cache for subordinate statement.
- *
- * @param cache subordinate statements cache.
- */
- public void setSubordinateStatementCache(@Nonnull final MetadataCache<SubordinateStatementContainer> cache) {
- checkSetterPreconditions();
- subordinateStatementCache = Constraint.isNotNull(cache, "Subordinate statement cache cannot be null");
- }
-
- /**
- * Set the cache containing local copies of trusted trust anchor keys.
- *
- * @param cache cache containing local copies of trusted trust anchor keys.
- */
- public void setLocalTrustAnchorsCache(@Nonnull final MetadataCache<Map<String, LocalKeyContainer>> cache) {
- checkSetterPreconditions();
- localTrustAnchorsCache = Constraint.isNotNull(cache, "Local Trust Anchor cache cannot be null");
- }
-
- /**
- * Set the strategy to fetch lifetime for container with valid contents.
- *
- * @param strategy lifetime strategy
- */
- public void setCriteriaToValidContainerLifetimeStrategy(@Nonnull final Function<CriteriaSet, Duration> strategy) {
- checkSetterPreconditions();
-
- criteriaToValidContainerLifetimeStrategy =
- Constraint.isNotNull(strategy, "Criteria to valid container lifetime strategy cannot be null");
- }
-
- /**
- * Set the strategy to fetch lifetime for container with invalid contents.
- *
- * @param strategy lifetime strategy
- */
- public void setCriteriaToInvalidContainerLifetimeStrategy(
- @Nonnull final Function<CriteriaSet, Duration> strategy) {
- checkSetterPreconditions();
-
- criteriaToInvalidContainerLifetimeStrategy =
- Constraint.isNotNull(strategy, "Criteria to invalid container lifetime strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (criteriaToSubjectEntityIdStrategy == null) {
- throw new ComponentInitializationException("Criteria to subject entity ID strategy cannot be null");
- }
- if (entityConfigurationCache == null) {
- throw new ComponentInitializationException("Entity configuration cache cannot be null");
- }
- if (subordinateStatementCache == null) {
- throw new ComponentInitializationException("Subordinate statement cache cannot be null");
- }
- if (localTrustAnchorsCache == null) {
- throw new ComponentInitializationException("Local Trust Anchor cache cannot be null");
- }
- if (criteriaToValidContainerLifetimeStrategy == null) {
- throw new ComponentInitializationException("Criteria to valid container lifetime strategy cannot be null");
- }
- if (criteriaToInvalidContainerLifetimeStrategy == null) {
- throw new ComponentInitializationException(
- "Criteria to invalid container lifetime strategy cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public TrustChainsContainer apply(@Nullable final CriteriaSet criteria) {
- checkComponentActive();
- if (criteria == null) {
- return null;
- }
- final Duration validLifetime = criteriaToValidContainerLifetimeStrategy.apply(criteria);
- if (validLifetime == null) {
- log.warn("Could not fetch expiration time for valid container");
- return null;
- }
- final Instant validExpiration = Instant.now().plus(validLifetime);
- final Duration invalidLifetime = criteriaToInvalidContainerLifetimeStrategy.apply(criteria);
- if (invalidLifetime == null) {
- log.warn("Could not fetch expiration time for invalid container");
- return null;
- }
- final Instant invalidExpiration = Instant.now().plus(invalidLifetime);
- final PreSelectedTrustChainCriterion preSelectedCriterion = criteria.get(PreSelectedTrustChainCriterion.class);
- final List<String> preSelectedChain =
- preSelectedCriterion == null ? CollectionSupport.emptyList() : preSelectedCriterion.getValue();
- final EntityConfiguration entityConfiguration;
- final SubjectEntityStatementCriterion subjectStatementCriterion =
- criteria.get(SubjectEntityStatementCriterion.class);
- if (subjectStatementCriterion == null) {
- try {
- final List<EntityConfigurationContainer> containers = entityConfigurationCache.get(criteria);
- if (containers.isEmpty()) {
- return null;
- }
- entityConfiguration = containers.get(0).getStatement();
- } catch (final MetadataCacheException e) {
- log.error("Could not fetch entity configuration for the trust chain", e);
- return null;
- }
- } else {
- entityConfiguration = subjectStatementCriterion.getValue() instanceof EntityConfiguration ec ? ec : null;
- }
-
- log.trace("Entity configuration found to build the trust chains on: {}", entityConfiguration != null);
- if (entityConfiguration == null) {
- return null;
- }
-
- final TrustChainWrapper initialWrapper =
- new TrustChainWrapper(CollectionSupport.listOf(entityConfiguration));
- if (initialWrapper.isComplete()) {
- log.warn("Entity configuration for {} does not contain authority hints, cannot resolve trust chains",
- entityConfiguration.getSubject());
- return null;
- }
- final List<TrustChainWrapper> populatedWrappers = populateChain(
- CollectionSupport.listOf(initialWrapper), preSelectedChain);
- final List<List<EntityStatement<?>>> result = populatedWrappers.stream()
- .filter(wrapper -> wrapper.isComplete())
- .map(wrapper -> wrapper.getTrustChain())
- .toList();
- assert result != null; assert invalidExpiration != null; assert validExpiration != null;
- return new TrustChainsContainer(result.isEmpty() ? invalidExpiration : validExpiration,
- entityConfiguration.getSubject(), result);
- }
-
- /**
- * Checks whether the given entity is locally trusted via local trust anchors cache.
- *
- * @param statement the entity to be verified
- * @return true if the entity is locally trusted, false otherwise
- */
- private boolean isLocallyTrusted(@Nonnull final EntityStatement<?> statement) {
- final CriteriaSet criteria = new CriteriaSet(new SubjectEntityStatementCriterion(statement));
- final String entityId = statement.getSubject();
- assert entityId != null;
- final List<Map<String, LocalKeyContainer>> keyContainers;
- try {
- keyContainers = localTrustAnchorsCache.get(criteria);
- } catch (final MetadataCacheException e) {
- log.debug("Could not resolve local trust anchor keys from the cache for {}", entityId, e);
- return false;
- }
- if (keyContainers.isEmpty() || !keyContainers.get(0).containsKey(entityId)) {
- log.trace("No locally trusted keys found for {}", entityId);
- return false;
- }
- log.trace("Locally trusted keys configured for {}", entityId);
- return true;
- }
-
- /**
- * Recursively populates the given list of trust chains until the last entity statement in each chain doesn't
- * contain any authority hints.
- *
- * @param entities the list of trust chains being populated.
- * @param preSelectedChain the pre-selected trust chain (containing entity IDs as String).
- * @return the list of trust chains being populated
- */
- @Nonnull @NonnullElements private List<TrustChainWrapper> populateChain(
- @Nonnull @NonnullElements final List<TrustChainWrapper> entities,
- @Nonnull final List<String> preSelectedChain) {
- final List<TrustChainWrapper> result = new ArrayList<>();
- boolean hints = false;
- for (final TrustChainWrapper chainWrapper : entities) {
- if (chainWrapper.isComplete()) {
- result.add(chainWrapper);
- continue;
- }
- final List<EntityStatement<?>> chain = chainWrapper.getTrustChain();
- final EntityStatement<?> entityStatement = chain.get(chain.size() - 1);
- assert entityStatement != null;
- if (chain.size() > 2 && isLocallyTrusted(entityStatement)
- && matchesPreSelectedIfSet(chain, preSelectedChain)) {
- result.add(chainWrapper.complete());
- }
- final List<String> authorityHints = entityStatement instanceof EntityConfiguration configuration ?
- configuration.getParsedPayload().getAuthorityHints() : null;
- if (authorityHints != null && !authorityHints.isEmpty()) {
- final List<Pair<EntityConfiguration, SubordinateStatement>> authorities = authorityHints.stream()
- .filter(id -> verifyNoLoop(chain, id))
- .filter(id -> verifyPreSelected(chain, id, preSelectedChain))
- .filter(id -> !EntityStatementHelper.subjectAlreadyExists(id, chain))
- .map(id -> fetchAuthority(entityStatement, id))
- .filter(pair -> pair != null && pair.getFirst() != null && pair.getSecond() != null)
- .toList();
- hints = !authorities.isEmpty();
- authorities.forEach(authority -> {
- final ArrayList<EntityStatement<?>> newChain = new ArrayList<>(chain.size() > 2 ?
- chain.subList(0, chain.size() - 1) : chain);
- newChain.add(authority.getSecond());
- newChain.add(authority.getFirst());
- result.add(new TrustChainWrapper(newChain));
- });
- }
- }
- if (hints) {
- return populateChain(result, preSelectedChain);
- }
- return result;
- }
-
- /**
- * Verifies that the given authority is not already included in the given trust chain.
- *
- * @param chain trust chain
- * @param authority entity ID for authority
- * @return true if not included, false otherwise
- */
- protected boolean verifyNoLoop(@Nonnull final List<EntityStatement<?>> chain, @Nullable final String authority) {
- final List<String> entityIds = EntityStatementHelper.getEntityIds(chain);
- if (entityIds.contains(authority)) {
- log.warn("Loop detected: authority hint {} already in the trust chain {} resolved so far", authority,
- entityIds);
- return false;
- }
- return true;
- }
-
- /**
- * Verifies that the given authority is compliant with the pre-defined trust chain.
- *
- * @param chain trust chain
- * @param authority entity ID for authority
- * @param preSelectedChain pre-defined trust chain
- * @return true if authority is compliant, false otherwise
- */
- protected boolean verifyPreSelected(@Nonnull final List<EntityStatement<?>> chain, @Nullable final String authority,
- @Nonnull final List<String> preSelectedChain) {
- if (preSelectedChain.isEmpty()) {
- return true;
- }
- if (preSelectedChain.size() <= chain.size() || !preSelectedChain.get(chain.size()).equals(authority)) {
- log.debug("Ignoring authority {} as it doesn't match with the preselected chain {}", authority,
- preSelectedChain);
- return false;
- }
- return true;
- }
-
- /**
- * Checks if the given trust chain matches with the pre-selected trust chain if if it has been set.
- *
- * @param chain trust chain
- * @param preSelectedChain pre-selected trust chain entity IDs
- * @return true if pre-selected trust chain is empty or is matching the given trust chain
- */
- protected boolean matchesPreSelectedIfSet(@Nonnull final List<EntityStatement<?>> chain,
- @Nonnull final List<String> preSelectedChain) {
- if (preSelectedChain.isEmpty()) {
- return true;
- }
- return preSelectedChain.equals(EntityStatementHelper.getEntityIds(chain));
- }
-
- /**
- * Fetch authority's entity configuration and subordinate statement for the given entity statement and
- * authority hint.
- *
- * @param entity the entity statement whose authority and subordinate statement are to be fetched
- * @param authorityHint the authority entity ID
- * @return pair consisting of authority's entity configuration and subordinate statement, or null if they could not
- * be fetched.
- */
- @Nullable protected Pair<EntityConfiguration, SubordinateStatement> fetchAuthority(
- @Nonnull final EntityStatement<?> entity, @Nullable final String authorityHint) {
- final String entityId = entity.getSubject();
- if (authorityHint == null) {
- log.error("Entity ID ({}) or authority hint ({}) may not be null", entityId, authorityHint);
- return null;
- }
-
- try {
- final List<EntityConfigurationContainer> authorityConfigurations =
- entityConfigurationCache.get(new CriteriaSet(new SubjectEntityIDCriterion(authorityHint)));
- log.trace("Fetched comfigurations {} for authority {}", authorityConfigurations, authorityHint);
- final List<SubordinateStatementContainer> subordinateStatements =
- subordinateStatementCache.get(new CriteriaSet(new SubjectEntityIDCriterion(entityId),
- new IssuerEntityIDCriterion(authorityHint)));
- log.trace("Fetched subordinate statements {} for authority {}", subordinateStatements, authorityHint);
- return new Pair<>(authorityConfigurations.isEmpty() ? null : authorityConfigurations.get(0).getStatement(),
- subordinateStatements.isEmpty() ? null : subordinateStatements.get(0).getStatement());
- } catch (final MetadataCacheException e) {
- log.error("Could not resolve authority hint {} for {}", authorityHint, entityId);
- return null;
- }
- }
-
- /**
- * Wrapper class containing trust chain (potentially under construction) and a flag for indicating whether it's
- * complete.
- */
- private class TrustChainWrapper {
-
- /** Trust chain (potentially incomplete). */
- private List<EntityStatement<?>> trustChain;
-
- /** Flag indicating whether the trust chain is complete. */
- private boolean complete;
-
- /**
- * Constructor.
- *
- * @param chain trust chain (potentially incomplete) - if the trust anchor (last item at the chain) does not
- * contain authority hints, the chain is considered as complete
- * @throws ConstraintViolationException if the last item is not an {@link EntityConfiguration}
- */
- protected TrustChainWrapper(@Nonnull final List<EntityStatement<?>> chain)
- throws ConstraintViolationException {
- trustChain = chain;
- if (chain.get(chain.size() - 1) instanceof EntityConfiguration entityConfiguration) {
- final List<String> authorityHints = entityConfiguration.getParsedPayload().getAuthorityHints();
- if (authorityHints == null || authorityHints.isEmpty()) {
- complete = true;
- } else {
- complete = false;
- }
- } else {
- throw new ConstraintViolationException("Unexpected entity statement type as last item: "
- + chain.get(chain.size() - 1));
- }
- }
-
- /**
- * Get the trust chain.
- *
- * @return trust chain
- */
- protected List<EntityStatement<?>> getTrustChain() {
- return trustChain;
- }
-
- /**
- * Set this wrapper as complete.
- *
- * @return this wrapper
- */
- protected TrustChainWrapper complete() {
- complete = true;
- return this;
- }
-
- /**
- * Get whether this wrapper is complete.
- *
- * @return true if complete, false otherwise
- */
- protected boolean isComplete() {
- return complete;
- }
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainSignatureValidationFilterStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainSignatureValidationFilterStrategy.java
deleted file mode 100644
index be7b674..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainSignatureValidationFilterStrategy.java
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain;
-
-import java.util.List;
-import java.util.function.BiFunction;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.trust.TrustEngine;
-import org.slf4j.Logger;
-
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractTrustEngineSignatureValidationComponent;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SignatureValidationKeyContainerJwtCriterion;
-import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default signature validating filter for trust chains. The signature for each entity statement within trust chain is
- * verified by using the contents of the jwks-claim of the payload of the next entity statement in the chain until the
- * final subordinate statement of the chain. The configurable {@link TrustEngine} is used for validating the signature.
- * The trust engine is fed with the JWT to be verified and the {@link SignatureValidationKeyContainerJwtCriterion}
- * containing the JWT with the keyset used for validation.
- *
- * The trust anchor signature validation is performed by passing the trust anchor entity statement of each trust chain
- * to the configurable validation filter strategy.
- *
- * All the chains that don't pass the full validation are filtered out from the result.
- */
- at ThreadSafeAfterInit
-public class DefaultTrustChainSignatureValidationFilterStrategy
- extends AbstractTrustEngineSignatureValidationComponent
- implements BiFunction<TrustChainsContainer, MetadataFilterContext, TrustChainsContainer> {
-
- /** Class logger. */
- @Nonnull private Logger log =
- LoggerFactory.getLogger(DefaultTrustChainSignatureValidationFilterStrategy.class);
-
- /** Signature validation filter strategy for trust anchor entity statements. */
- @NonnullAfterInit private BiFunction<EntityStatement<?>, MetadataFilterContext, EntityStatement<?>>
- entityStatementSignatureValidationFilterStrategy;
-
- /** List of custom metadata filter strategies. */
- @Nonnull private List<BiFunction<TrustChainsContainer,
- MetadataFilterContext, TrustChainsContainer>> customFilterStrategies;
-
- /**
- * Constructor.
- */
- public DefaultTrustChainSignatureValidationFilterStrategy() {
- customFilterStrategies = CollectionSupport.emptyList();
- }
-
- /**
- * Set the signature validation filter strategy for trust anchor entity statements.
- *
- * @param strategy signature validation filter strategy
- */
- public void setEntityStatementSignatureValidationFilterStrategy(@Nonnull final
- BiFunction<EntityStatement<?>, MetadataFilterContext, EntityStatement<?>> strategy) {
- checkSetterPreconditions();
- entityStatementSignatureValidationFilterStrategy = Constraint.isNotNull(strategy,
- "EntityStatementSignatureValidationFilterStrategy cannot be null");
- }
-
- /**
- * Set the list of custom metadata filter strategies.
- *
- * @param strategies metadata filter strategies
- */
- public void setCustomFilterStrategies(@Nullable final List<BiFunction<TrustChainsContainer,
- MetadataFilterContext, TrustChainsContainer>> strategies) {
- checkSetterPreconditions();
- customFilterStrategies = strategies == null ? CollectionSupport.emptyList() : strategies;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (entityStatementSignatureValidationFilterStrategy == null) {
- throw new ComponentInitializationException(
- "EntityStatementSignatureValidationFilterStrategy cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public TrustChainsContainer apply(@Nullable final TrustChainsContainer container,
- @Nullable final MetadataFilterContext filterContext) {
- checkComponentActive();
- if (container == null) {
- return null;
- }
-
- trustChainLoop: for (final List<EntityStatement<?>> trustChain : container.getTrustChains()) {
- for (int i = 0; i < trustChain.size() - 2; i++) {
- final EntityStatement<?> trustChainEntry = trustChain.get(i);
- final SignedJWT keyContainer = trustChain.get(i + 1).getJwt();
- final CriteriaSet criteria =
- new CriteriaSet(new SignatureValidationKeyContainerJwtCriterion(keyContainer));
- if (!validateJwt(trustChainEntry.getJwt(), criteria,
- trustChain.get(i).getSubject())) {
- log.warn("The signature check for {} failed, ignoring trust chain anchored by {}",
- i == 0 ? "leaf entity configuration" : "subordinate statement",
- trustChain.get(trustChain.size() - 1).getSubject());
- log.trace("Key container {} could not validate the trust chain entry {}", keyContainer.serialize(),
- trustChainEntry.getJwt().serialize());
- container.removeTrustChain(trustChain);
- continue trustChainLoop;
- }
- }
-
- final EntityStatement<?> trustAnchorSubordinateStatement = trustChain.get(trustChain.size() - 2);
- final String subjectId = trustAnchorSubordinateStatement.getSubject();
- final String trustAnchorId = trustAnchorSubordinateStatement.getIssuer();
- final EntityStatement<?> filteredSubordinateStatement =
- entityStatementSignatureValidationFilterStrategy.apply(trustAnchorSubordinateStatement,
- filterContext);
- if (filteredSubordinateStatement != null) {
- log.debug("Successfully validated subordinate statement for {}, issued by trust anchor {}",
- subjectId, trustAnchorId);
- } else {
- log.warn("Signature validation failed for subordinate statement for {}, issued by trust anchor {}",
- subjectId, trustAnchorId);
- container.removeTrustChain(trustChain);
- continue trustChainLoop;
- }
-
- final EntityStatement<?> trustAnchorStatement = trustChain.get(trustChain.size() - 1);
- final EntityStatement<?> filteredStatement =
- entityStatementSignatureValidationFilterStrategy.apply(trustAnchorStatement, filterContext);
- if (filteredStatement != null) {
- log.debug("Successfully validated entity statement for trust anchor {}", trustAnchorId);
- } else {
- log.warn("Signature validation failed for trust anchor {}", trustAnchorId);
- container.removeTrustChain(trustChain);
- }
- }
-
- TrustChainsContainer result = container;
- for (final BiFunction<TrustChainsContainer, MetadataFilterContext,
- TrustChainsContainer> customFilterStrategy : customFilterStrategies) {
- log.trace("Applying custom filter strategy {}", customFilterStrategy);
- result = customFilterStrategy.apply(result, filterContext);
- if (result == null) {
- log.debug("Custom filter strategy {} returned null", customFilterStrategy);
- return null;
- }
- }
- return result;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainSubjectIdentifierExtractionStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainSubjectIdentifierExtractionStrategy.java
deleted file mode 100644
index a43184c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainSubjectIdentifierExtractionStrategy.java
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain;
-
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-
-/**
- * Default identifier strategy for the list of trust chains: the entity ID of the leaf entity is always used.
- */
- at ThreadSafe
-public class DefaultTrustChainSubjectIdentifierExtractionStrategy
- implements Function<List<List<EntityStatement<?>>>, String> {
-
- /** {@inheritDoc} */
- @Override @Nullable
- public String apply(@Nullable final List<List<EntityStatement<?>>> trustChains) {
- if (trustChains == null || trustChains.isEmpty()) {
- return null;
- }
- final List<EntityStatement<?>> firstChain = trustChains.get(0);
- if (firstChain == null || firstChain.isEmpty() || firstChain.get(0) == null) {
- return null;
- }
- return firstChain.get(0).getSubject();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/ProvidedTrustChainContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/ProvidedTrustChainContainer.java
deleted file mode 100644
index a9b22bb..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/ProvidedTrustChainContainer.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain;
-
-import java.time.Instant;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Metadata cache container for provided trust chain. The expiration is hardcoded to five minutes as it's assumed
- * that the container is solely used with fetch-through caches and the expiration validation is done during the
- * filtering phase.
- */
-public class ProvidedTrustChainContainer extends TrustChainsContainer {
-
- /** Serial version UID. */
- private static final long serialVersionUID = -6322735111721678470L;
-
- /**
- * Constructor.
- *
- * @param trustChain trust chain
- * @param entity entity ID for the trust chain subject
- */
- public ProvidedTrustChainContainer(@Nonnull final List<EntityStatement<?>> trustChain,
- @Nonnull @NotEmpty final String entity) {
- super(Constraint.isNotNull(Instant.now().plusSeconds(300), "Expiration instant cannot be null"),
- entity, CollectionSupport.listOf(trustChain));
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/ProvidedTrustChainContainerCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/ProvidedTrustChainContainerCriterion.java
deleted file mode 100644
index 07c91df..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/ProvidedTrustChainContainerCriterion.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing a provided trust chain container.
- */
-public class ProvidedTrustChainContainerCriterion implements Criterion {
-
- /** The trust chain container value. */
- @Nonnull final ProvidedTrustChainContainer value;
-
- /**
- * Constructor.
- *
- * @param container the trust chain container value, must not be null
- */
- public ProvidedTrustChainContainerCriterion(
- @Nonnull final ProvidedTrustChainContainer container) {
- value = Constraint.isNotNull(container, "Trust chain container cannot be null");
- }
-
- /**
- * Get the trust chain container value.
- *
- * @return the container value
- */
- @Nonnull public ProvidedTrustChainContainer getValue() {
- return value;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "ProvidedTrustChainContainerCriterion [value=" + value + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(value);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final ProvidedTrustChainContainerCriterion other = (ProvidedTrustChainContainerCriterion) obj;
- final var chains = value.getTrustChains();
- final var otherChains = other.value.getTrustChains();
- return value.getEntityId().equals(other.value.getEntityId()) && chains.containsAll(otherChains)
- && otherChains.containsAll(chains);
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/TrustChainsContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/TrustChainsContainer.java
deleted file mode 100644
index fa5c1b3..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/TrustChainsContainer.java
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain;
-
-import java.io.Serializable;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableMetadataContainer;
-import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A container class for metadata caches carrying ID and trust chains details related to Trust Chains of the entity.
- */
-public class TrustChainsContainer extends BaseExpirableMetadataContainer implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 656434369356432370L;
-
- /** Requested entity ID. */
- @Nonnull @NotEmpty private final String entityId;
-
- /** Trust chains for this container. */
- @Nonnull @NonnullElements @Live private final List<List<EntityStatement<?>>> trustChains;
-
- /**
- * Constructor.
- *
- * @param expirationInstant expiration instant, must not be null
- * @param entity entity ID, must not be null
- */
- public TrustChainsContainer(@Nonnull final Instant expirationInstant,
- @Nonnull @NotEmpty final String entity) {
- this(expirationInstant, entity, CollectionSupport.emptyList());
- }
-
- /**
- *
- * Constructor.
- *
- * @param expirationInstant expiration instant, must not be null
- * @param entity entity ID, must not be null
- * @param chains initial trust chains value
- */
- public TrustChainsContainer(@Nonnull final Instant expirationInstant, @Nonnull @NotEmpty final String entity,
- @Nonnull @NonnullElements final List<List<EntityStatement<?>>> chains) {
- super(expirationInstant);
- entityId = Constraint.isNotNull(entity, "Entity ID cannot be empty");
- trustChains = new ArrayList<>(Constraint.isNotNull(chains, "Trust chains cannot be null"));
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull @NotEmpty
- public String getEntityId() {
- return entityId;
- }
-
- /**
- * Get the list of trust chains.
- *
- * @return list of trust chains
- */
- @Nonnull @NonnullElements public List<List<EntityStatement<?>>> getTrustChains() {
- return CollectionSupport.copyToList(trustChains);
- }
-
- /**
- * Remove the given trust chain from the list of trust chains.
- *
- * @param trustChain trust chain to be removed
- * @return this object
- */
- @Nonnull public TrustChainsContainer removeTrustChain(
- @Nonnull @NonnullElements final List<EntityStatement<?>> trustChain) {
- trustChains.remove(trustChain);
- return this;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkFetchingStrategy.java
deleted file mode 100644
index 0797763..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkFetchingStrategy.java
+++ /dev/null
@@ -1,158 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
-
-import java.io.IOException;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.nio.charset.StandardCharsets;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.function.BiConsumer;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.apache.hc.client5.http.classic.methods.HttpGet;
-import org.apache.hc.client5.http.classic.methods.HttpPost;
-import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
-import org.apache.hc.core5.http.ClassicHttpRequest;
-import org.apache.hc.core5.http.ClassicHttpResponse;
-import org.apache.hc.core5.http.ContentType;
-import org.apache.hc.core5.http.HttpHeaders;
-import org.apache.hc.core5.http.HttpRequest;
-import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.ProtocolException;
-import org.apache.hc.core5.http.io.entity.EntityUtils;
-import org.apache.hc.core5.http.message.BasicNameValuePair;
-import org.apache.hc.core5.net.URIBuilder;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMark;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.TrustMarkImpl;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching trust mark via Trust Mark API for the request specified in the criteria set. The
- * response is stored inside a {@link TrustMarkContainer}.
- */
- at ThreadSafeAfterInit
-public class DefaultTrustMarkFetchingStrategy
- extends AbstractFederationEndpointResponseFetchingStrategy<TrustMarkCacheIdentifier, TrustMarkContainer> {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("trust-mark+jwt");
-
- /** The HTTP response content type. */
- @Nonnull public static final String HTTP_RESPONSE_CONTENT_TYPE = "application/" + JWT_TYPE_HEADER.toString();
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultTrustMarkFetchingStrategy.class);
-
- /**
- * Constructor.
- */
- public DefaultTrustMarkFetchingStrategy() {
- setCriteriaToRequestDataStrategy(criteria -> {
- final TrustMarkIdentifierCriterion identifierCriterion = criteria.get(TrustMarkIdentifierCriterion.class);
- if (identifierCriterion == null) {
- log.debug("No identifier criterion given, returning null");
- return null;
- }
- return identifierCriterion.getIdentifier();
- });
- }
-
- /** {@inheritDoc} */
- @Nullable protected ClassicHttpRequest initializeHttpRequest(@Nonnull final CriteriaSet criteria,
- @Nonnull TrustMarkCacheIdentifier request) {
- final List<NameValuePair> nvps = new ArrayList<>();
- nvps.add(new BasicNameValuePair("trust_mark_type", request.getTrustMarkType()));
- nvps.add(new BasicNameValuePair("sub", request.getSubject()));
- final BiConsumer<HttpRequest,List<NameValuePair>> clientAuthentication = getClientAuthentication(criteria);
- if (clientAuthentication == null) {
- final HttpGet httpRequest = new HttpGet(request.getEndpoint());
- try {
- final URI uri = new URIBuilder(httpRequest.getUri()).addParameters(nvps).build();
- httpRequest.setUri(uri);
- } catch (final URISyntaxException e) {
- log.error("Could not create URI with the given parameters {}", request, e);
- }
- return httpRequest;
- } else {
- final HttpPost httpRequest = new HttpPost(request.getEndpoint());
- httpRequest.setHeader(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_FORM_URLENCODED);
- clientAuthentication.accept(httpRequest, nvps);
- final UrlEncodedFormEntity urlEncodedFormEntity = new UrlEncodedFormEntity(
- nvps, StandardCharsets.UTF_8);
- httpRequest.setEntity(urlEncodedFormEntity);
- return httpRequest;
- }
-
- }
-
- /** {@inheritDoc} */
- @Nullable protected TrustMarkContainer parseHttpResponse(@Nonnull final CriteriaSet criteria,
- @Nonnull final TrustMarkCacheIdentifier request, @Nullable final ClassicHttpResponse response,
- @Nonnull final Instant validExpiration, @Nonnull final Instant invalidExpiration,
- @Nonnull final Instant nullExpiration) throws ProtocolException, IOException {
- if (response != null) {
- if (!HTTP_RESPONSE_CONTENT_TYPE.equals(response.getEntity().getContentType())) {
- log.warn("Unexpected content type: {}", response.getEntity().getContentType());
- return new TrustMarkContainer(request, null, validExpiration, invalidExpiration);
- }
-
- try {
- final SignedJWT jwt = SignedJWT.parse(EntityUtils.toString(response.getEntity()));
- if (!JWT_TYPE_HEADER.equals(jwt.getHeader().getType())) {
- log.warn("Unexpected JWT type header {}", jwt.getHeader().getType());
- return new TrustMarkContainer(request, null, validExpiration, invalidExpiration);
- }
- assert objectMapper != null;
- final TrustMark trustMark = TrustMarkImpl.parse(jwt, objectMapper);
- return new TrustMarkContainer(
- request, trustMark, validExpiration, invalidExpiration);
- } catch (final JsonProcessingException e) {
- log.warn("Could not deserialize entity statement payload from the response", e);
- } catch (final ConstraintViolationException e) {
- log.warn("Parsed entity configuration claims did not pass syntax validation", e);
- } catch (java.text.ParseException e) {
- log.warn("Could not parse JWT from the response", e);
- }
- return new TrustMarkContainer(request, null, validExpiration, invalidExpiration);
- } else {
- log.debug("Unable to fetch trust mark: {} (null response)", request.getTrustMarkType());
- return new TrustMarkContainer(request, null, validExpiration, nullExpiration);
- }
- }
-
- /** {@inheritDoc} */
- @Nullable protected TrustMarkContainer handleException(@Nonnull final CriteriaSet criteria,
- @Nonnull final TrustMarkCacheIdentifier request, @Nonnull final Throwable exception,
- @Nonnull final Instant expiration) {
- return new TrustMarkContainer(request, null, expiration, expiration);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkStatusFetchingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkStatusFetchingStrategy.java
deleted file mode 100644
index 2ab0f98..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkStatusFetchingStrategy.java
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.function.BiConsumer;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.apache.hc.client5.http.classic.methods.HttpPost;
-import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
-import org.apache.hc.core5.http.ClassicHttpRequest;
-import org.apache.hc.core5.http.ClassicHttpResponse;
-import org.apache.hc.core5.http.ContentType;
-import org.apache.hc.core5.http.HttpHeaders;
-import org.apache.hc.core5.http.HttpRequest;
-import org.apache.hc.core5.http.NameValuePair;
-import org.apache.hc.core5.http.ProtocolException;
-import org.apache.hc.core5.http.io.entity.EntityUtils;
-import org.apache.hc.core5.http.message.BasicNameValuePair;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.nimbusds.jose.JOSEObjectType;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMarkStatus;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.AbstractFederationEndpointResponseFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.TrustMarkStatusImpl;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy for fetching trust mark status via Trust Mark Status API for the request specified in the criteria
- * set. The status response is stored inside a {@link TrustMarkStatusContainer}.
- */
- at ThreadSafeAfterInit
-public class DefaultTrustMarkStatusFetchingStrategy
- extends AbstractFederationEndpointResponseFetchingStrategy
- <TrustMarkStatusCacheIdentifier, TrustMarkStatusContainer> {
-
- /** The JWT type header. */
- @Nonnull
- public static final JOSEObjectType JWT_TYPE_HEADER = new JOSEObjectType("trust-mark-status-response+jwt");
-
- /** The HTTP response content type. */
- @Nonnull public static final String HTTP_RESPONSE_CONTENT_TYPE = "application/" + JWT_TYPE_HEADER.toString();
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultTrustMarkStatusFetchingStrategy.class);
-
- /**
- * Constructor.
- */
- public DefaultTrustMarkStatusFetchingStrategy() {
- setCriteriaToRequestDataStrategy(criteria -> {
- final TrustMarkStatusIdentifierCriterion identifierCriterion =
- criteria.get(TrustMarkStatusIdentifierCriterion.class);
- if (identifierCriterion == null) {
- log.debug("No identifier criterion given, returning null");
- return null;
- }
- return identifierCriterion.getIdentifier();
- });
- }
-
- /** {@inheritDoc} */
- @Nullable protected ClassicHttpRequest initializeHttpRequest(@Nonnull final CriteriaSet criteria,
- @Nonnull TrustMarkStatusCacheIdentifier identifier) {
- final HttpPost httpRequest = new HttpPost(identifier.getEndpoint());
- final List<NameValuePair> nvps = new ArrayList<>();
- nvps.add(new BasicNameValuePair("trust_mark", identifier.getTrustMark().serialize()));
- final BiConsumer<HttpRequest,List<NameValuePair>> clientAuthentication = getClientAuthentication(criteria);
- if (clientAuthentication != null) {
- clientAuthentication.accept(httpRequest, nvps);
- }
- final UrlEncodedFormEntity urlEncodedFormEntity = new UrlEncodedFormEntity(nvps, StandardCharsets.UTF_8);
- httpRequest.setEntity(urlEncodedFormEntity);
- httpRequest.setHeader(HttpHeaders.CONTENT_TYPE, ContentType.APPLICATION_FORM_URLENCODED);
- return httpRequest;
- }
-
- /** {@inheritDoc} */
- @Nullable protected TrustMarkStatusContainer parseHttpResponse(@Nonnull final CriteriaSet criteria,
- @Nonnull final TrustMarkStatusCacheIdentifier identifier, @Nullable final ClassicHttpResponse response,
- @Nonnull final Instant validExpiration, @Nonnull final Instant invalidExpiration,
- @Nonnull final Instant nullExpiration) throws ProtocolException, IOException {
- if (response != null) {
- if (!HTTP_RESPONSE_CONTENT_TYPE.equals(response.getEntity().getContentType())) {
- log.warn("Unexpected content type: {}", response.getEntity().getContentType());
- return new TrustMarkStatusContainer(identifier, null, validExpiration, invalidExpiration);
- }
-
- try {
- final SignedJWT jwt = SignedJWT.parse(EntityUtils.toString(response.getEntity()));
- if (!JWT_TYPE_HEADER.equals(jwt.getHeader().getType())) {
- log.warn("Unexpected JWT type header {}", jwt.getHeader().getType());
- return new TrustMarkStatusContainer(identifier, null, validExpiration, invalidExpiration);
- }
- assert objectMapper != null;
- final TrustMarkStatus trustMarkStatus = TrustMarkStatusImpl.parse(jwt, objectMapper);
- return new TrustMarkStatusContainer(
- identifier, trustMarkStatus, validExpiration, invalidExpiration);
- } catch (final JsonProcessingException e) {
- log.warn("Could not deserialize trust mark status payload from the response", e);
- } catch (final ConstraintViolationException e) {
- log.warn("Parsed trust mark status claims did not pass syntax validation", e);
- } catch (java.text.ParseException e) {
- log.warn("Could not parse JWT from the response", e);
- }
- return new TrustMarkStatusContainer(identifier, null, validExpiration, invalidExpiration);
- } else {
- log.debug("Unable to fetch trust mark status: {} (null response)", identifier.getEndpoint());
- return new TrustMarkStatusContainer(identifier, null, validExpiration, nullExpiration);
- }
- }
-
- /** {@inheritDoc} */
- @Nullable protected TrustMarkStatusContainer handleException(@Nonnull final CriteriaSet criteria,
- @Nonnull final TrustMarkStatusCacheIdentifier identifier, @Nonnull final Throwable exception,
- @Nonnull final Instant expiration) {
- return new TrustMarkStatusContainer(identifier, null, expiration, expiration);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkValidationCriteriaSetLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkValidationCriteriaSetLookupFunction.java
deleted file mode 100644
index d33a38f..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/DefaultTrustMarkValidationCriteriaSetLookupFunction.java
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
-
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BaseJWTWrapper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.TrustChainsContainer;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default criteria set lookup strategy for {@link BaseExpirableStatementContainer} that fetches the issuer
- * entity statement via trust chain cache.
- */
- at ThreadSafeAfterInit
-public class DefaultTrustMarkValidationCriteriaSetLookupFunction
- extends AbstractIdentifiableInitializableComponent
- implements Function<BaseExpirableStatementContainer<?>, CriteriaSet> {
-
- /** Class logger. */
- @Nonnull
- private Logger log = LoggerFactory.getLogger(DefaultTrustMarkValidationCriteriaSetLookupFunction.class);
-
- /** Cache used to fetch the issuer entity configuration from. */
- @NonnullAfterInit private MetadataCache<TrustChainsContainer> trustChainCache;
-
- /**
- * Set the cache used to fetch the trust chain for the trust mark issuer from.
- *
- * @param cache cache used to fetch the trust chain for the trust mark issuer from
- */
- public void setTrustChainCache(@Nonnull final MetadataCache<TrustChainsContainer> cache) {
- checkSetterPreconditions();
- trustChainCache = Constraint.isNotNull(cache, "Trust Chain cache cannot be null");
- }
-
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (trustChainCache == null) {
- throw new ComponentInitializationException("Trust Chain cache cannot be null");
- }
-
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public CriteriaSet apply(@Nullable final BaseExpirableStatementContainer<?> metadataContainer) {
- if (metadataContainer != null && metadataContainer.getStatement() != null) {
- final BaseJWTWrapper<?> statement = metadataContainer.getStatement();
- assert statement != null;
- final SubjectStatementCriterion subjectCriterion = new SubjectStatementCriterion(statement);
- final IssuerEntityStatementCriterion issuerCriterion = getIssuerCriterion(statement);
- if (issuerCriterion == null) {
- log.debug("Issuer statement could not be fetched, returning null");
- return null;
- }
- return new CriteriaSet(subjectCriterion, issuerCriterion);
- }
- log.debug("Entity statement is not found from the container, returning null");
- return null;
- }
-
- /**
- * Fetch the issuer entity configuration from the metadata cache and initialize the criterion.
- *
- * @param statement the entity statement whose issuer is fetched
- * @return the issuer entity configuration, or null if could not be fetched
- */
- @Nullable protected IssuerEntityStatementCriterion getIssuerCriterion(
- @Nonnull final BaseJWTWrapper<?> statement) {
- final String issuer = statement.getIssuer();
- final CriteriaSet criteria = new CriteriaSet(new SubjectEntityIDCriterion(issuer));
- try {
- final List<TrustChainsContainer> result = trustChainCache.get(criteria);
- if (!result.isEmpty()) {
- final List<List<EntityStatement<?>>> chains = result.get(0).getTrustChains();
- if (!chains.isEmpty()) {
- final EntityStatement<?> issuerStatement = chains.get(0).get(0);
- assert issuerStatement != null;
- return new IssuerEntityStatementCriterion(issuerStatement);
- }
- }
- } catch (final MetadataCacheException e) {
- log.debug("Error while fetching issuer trust chain for {}", issuer, e);
- }
- log.warn("Could not fetch entity configuration for {}", issuer);
- return null;
-
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkCacheIdentifier.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkCacheIdentifier.java
deleted file mode 100644
index bdb3d14..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkCacheIdentifier.java
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
-
-import java.io.Serializable;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Default identifier for trust mark within {@link TrustMarkContainer}.
- */
-public class TrustMarkCacheIdentifier implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = -4143516153785776493L;
-
- /** The endpoint URI of the request. */
- @Nonnull @NotEmpty private final String endpoint;
-
- /** The identifier for the type of the Trust Mark. */
- @Nonnull @NotEmpty private final String trustMarkType;
-
- /** The entity ID of the Entity to which the Trust Mark is issued. */
- @Nonnull @NotEmpty private final String subject;
-
- /**
- * Constructor.
- *
- * @param uri endpoint URI
- * @param type trust _mark type
- * @param sub subject entity ID
- */
- public TrustMarkCacheIdentifier(@Nonnull @NotEmpty final String uri, @Nonnull @NotEmpty final String type,
- @Nonnull @NotEmpty final String sub) {
- endpoint = Constraint.isNotEmpty(uri, "Endpoint URI cannot be null");
- trustMarkType = Constraint.isNotEmpty(type, "Trust Mark type cannot be null or empty");
- subject = Constraint.isNotEmpty(sub, "Subject cannot be null or empty");
- }
-
- /**
- * Get the endpoint for the request.
- *
- * @return endpoint
- */
- @Nonnull @NotEmpty public String getEndpoint() {
- return endpoint;
- }
-
- /**
- * Get the trust mark type for the request.
- *
- * @return trust mark type
- */
- @Nonnull @NotEmpty public String getTrustMarkType() {
- return trustMarkType;
- }
-
- /**
- * Get the subject for the request.
- *
- * @return subject
- */
- @Nonnull @NotEmpty public String getSubject() {
- return subject;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("subject", getSubject())
- .add("trustMarkType", getTrustMarkType())
- .add("endpoint", getEndpoint())
- .toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(endpoint, subject, trustMarkType);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
-
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final TrustMarkCacheIdentifier other = (TrustMarkCacheIdentifier) obj;
- return endpoint.equals(other.endpoint) && subject.equals(other.subject)
- && trustMarkType.equals(other.trustMarkType);
-
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkContainer.java
deleted file mode 100644
index 3130105..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkContainer.java
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMark;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableStatementContainer;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A container class for metadata caches carrying ID and statement details related to Trust Mark.
- */
-public class TrustMarkContainer extends BaseExpirableStatementContainer<TrustMark> implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 756269369356865370L;
-
- /** Requested entity ID. */
- @Nonnull private final TrustMarkCacheIdentifier identifier;
-
- /**
- * Constructor.
- *
- * @param id identifier, must not be null
- * @param trustMark trust mark parsed from the response
- * @param validExpirationInstant expiration instant for valid statement, must not be null
- * @param invalidExpirationInstant expiration instant for invalid statement, must not be null
- */
- public TrustMarkContainer(@Nonnull final TrustMarkCacheIdentifier id,
- @Nullable final TrustMark trustMark, @Nonnull final Instant validExpirationInstant,
- @Nonnull final Instant invalidExpirationInstant) {
- super(validExpirationInstant, trustMark, invalidExpirationInstant);
- identifier = Constraint.isNotNull(id, "Identifier cannot be null");
- }
-
- /**
- * Get entity ID.
- *
- * @return entity ID
- */
- @Nonnull @NotEmpty public TrustMarkCacheIdentifier getIdentifier() {
- return identifier;
- }
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getEntityId() {
- return identifier.getSubject();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkIdentifierCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkIdentifierCriterion.java
deleted file mode 100644
index 4131812..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkIdentifierCriterion.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing request message details to a Trust Mark API.
- */
-public class TrustMarkIdentifierCriterion implements Criterion {
-
- /** The trust mark identifier. */
- @Nonnull private final TrustMarkCacheIdentifier identifier;
-
- /**
- * Constructor.
- *
- * @param id identifier, must not be null
- */
- public TrustMarkIdentifierCriterion(@Nonnull final TrustMarkCacheIdentifier id) {
- identifier = Constraint.isNotNull(id, "Identifier cannot be null");
- }
-
- /**
- * Get the trust mark identifier.
- *
- * @return the identifier
- */
- @Nonnull public TrustMarkCacheIdentifier getIdentifier() {
- return identifier;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "TrustMarkIdentifierCriterion [identifier=" + identifier + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(identifier);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final TrustMarkIdentifierCriterion other = (TrustMarkIdentifierCriterion) obj;
- return identifier.equals(other.identifier);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkStatusCacheIdentifier.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkStatusCacheIdentifier.java
deleted file mode 100644
index 3fa3378..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkStatusCacheIdentifier.java
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
-
-import java.io.Serializable;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import com.google.common.base.MoreObjects;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Request message to the OpenID federation Trust Mark Status endpoint.
- */
-public class TrustMarkStatusCacheIdentifier implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = -4143643153785776493L;
-
- /** The endpoint URI of the request. */
- @Nonnull private final String endpoint;
-
- /** The trust mark for the request. */
- @Nonnull private final SignedJWT trustMark;
-
- /**
- * Constructor.
- *
- * @param uri endpoint URI
- * @param jwt trust mark
- */
- public TrustMarkStatusCacheIdentifier(@Nonnull @NotEmpty final String uri, @Nonnull final SignedJWT jwt) {
- endpoint = Constraint.isNotEmpty(uri, "Endpoint URI cannot be null");
- trustMark = Constraint.isNotNull(jwt, "Trust Mark JWT cannot be null");
- }
-
- /**
- * Get the endpoint URI of the request.
- *
- * @return endpoint
- */
- @Nonnull @NotEmpty public String getEndpoint() {
- return endpoint;
- }
-
- /**
- * Get the trust mark (serialized JWT) for the request.
- *
- * @return trust mark
- */
- @Nonnull @NotEmpty public SignedJWT getTrustMark() {
- return trustMark;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("trustMark", getTrustMark().serialize())
- .add("endpoint", getEndpoint())
- .toString();
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(endpoint, trustMark.serialize());
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
-
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final TrustMarkStatusCacheIdentifier other = (TrustMarkStatusCacheIdentifier) obj;
- return endpoint.equals(other.endpoint) && trustMark.serialize().equals(other.trustMark.serialize());
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkStatusContainer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkStatusContainer.java
deleted file mode 100644
index 0193772..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkStatusContainer.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
-
-import java.io.Serializable;
-import java.text.ParseException;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMarkStatus;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.BaseExpirableStatementContainer;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * A container class for metadata caches carrying ID and statement details related to Trust Mark status.
- */
-public class TrustMarkStatusContainer extends BaseExpirableStatementContainer<TrustMarkStatus> implements Serializable {
-
- /** Serial version UID. */
- private static final long serialVersionUID = 756269369356884270L;
-
- /** Requested entity ID. */
- @Nonnull private final TrustMarkStatusCacheIdentifier identifier;
-
- /**
- * Constructor.
- *
- * @param id identifier, must not be null
- * @param trustMarkStatus trust mark status parsed from the response
- * @param validExpirationInstant expiration instant for valid statement, must not be null
- * @param invalidExpirationInstant expiration instant for invalid statement, must not be null
- */
- public TrustMarkStatusContainer(@Nonnull final TrustMarkStatusCacheIdentifier id,
- @Nullable final TrustMarkStatus trustMarkStatus, @Nonnull final Instant validExpirationInstant,
- @Nonnull final Instant invalidExpirationInstant) {
- super(validExpirationInstant, trustMarkStatus, invalidExpirationInstant);
- identifier = Constraint.isNotNull(id, "Identifier cannot be null");
- }
-
- /**
- * Get entity ID.
- *
- * @return entity ID
- */
- @Nonnull @NotEmpty public TrustMarkStatusCacheIdentifier getIdentifier() {
- return identifier;
- }
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getEntityId() {
- try {
- final JWTClaimsSet claimsSet = identifier.getTrustMark().getJWTClaimsSet();
- if (claimsSet != null) {
- return Constraint.isNotEmpty(claimsSet.getIssuer(), "Issuer of the trust mark cannot be empty");
- }
- } catch (final ParseException e) {
- // no op
- }
- throw new ConstraintViolationException("Could not resolve issuer of the trust mark");
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkStatusIdentifierCriterion.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkStatusIdentifierCriterion.java
deleted file mode 100644
index 46b737f..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustmark/TrustMarkStatusIdentifierCriterion.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark;
-
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.resolver.Criterion;
-
-/**
- * A {@link Criterion} representing request message details to a Trust Mark Status API.
- */
-public class TrustMarkStatusIdentifierCriterion implements Criterion {
-
- /** The trust mark status identifier. */
- @Nonnull private final TrustMarkStatusCacheIdentifier identifier;
-
- /**
- * Constructor.
- *
- * @param id identifier, must not be null
- */
- public TrustMarkStatusIdentifierCriterion(@Nonnull final TrustMarkStatusCacheIdentifier id) {
- identifier = Constraint.isNotNull(id, "Identifier cannot be null");
- }
-
- /**
- * Get the trust mark status identifier.
- *
- * @return the identifier
- */
- @Nonnull public TrustMarkStatusCacheIdentifier getIdentifier() {
- return identifier;
- }
-
- /** {@inheritDoc} */
- @Override
- public String toString() {
- return "TrustMarkStatusIdentifierCriterion [identifier=" + identifier + "]";
- }
-
- /** {@inheritDoc} */
- @Override
- public int hashCode() {
- return Objects.hash(identifier);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean equals(final Object obj) {
- if (this == obj) {
- return true;
- }
- if (obj == null) {
- return false;
- }
- if (getClass() != obj.getClass()) {
- return false;
- }
- final TrustMarkStatusIdentifierCriterion other = (TrustMarkStatusIdentifierCriterion) obj;
- return identifier.equals(other.identifier);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/FederationPolicyConstraint.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/FederationPolicyConstraint.java
deleted file mode 100644
index f8348ed..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/FederationPolicyConstraint.java
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.shared.annotation.constraint.Live;
-
-/**
- * Interface to be implemented by the federation policy constraints.
- */
-public interface FederationPolicyConstraint {
-
- /**
- * Validate whether the given trust chain meets given federation policy constraint value. The trust chain may be
- * modified by the constraint validators, thus it is required to be modifiable.
- *
- * @param constraint the constraint value
- * @param subordinateStatement subordinate statement that defined the constraint
- * @param trustChain trust chain to be evaluated and optionally updated: it is required to be modifiable
- * @return true if the trust chain is valid for this constraint, false otherwise
- */
- public boolean validate(@Nullable final Object constraint, @Nonnull final SubordinateStatement subordinateStatement,
- @Nonnull @Live final List<EntityStatement<?>> trustChain);
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/FederationPolicyConstraintHelper.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/FederationPolicyConstraintHelper.java
deleted file mode 100644
index 3c9d8e5..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/FederationPolicyConstraintHelper.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints;
-
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Static utility method related to federation policy constraints.
- */
-public class FederationPolicyConstraintHelper {
-
- /** Class logger. */
- @Nonnull private final static Logger log = LoggerFactory.getLogger(FederationPolicyConstraintHelper.class);
-
- /**
- * Parses and verifies federation policy constraints in the given trust chain. Optionally the changed values
- * (for instance with the 'allowed_entity_types' constraint) are enforced to the trust chain.
- *
- * @param trustChain trust chain to be verified and optionally modified: it is required to be modifiable
- * @param federationPolicyConstraints map of the federation policy constraint implementations
- * @return true if trust chain meets the constraints. false otherwise
- */
- public static boolean verifyPolicyConstraints(@Nonnull @Live final List<EntityStatement<?>> trustChain,
- @Nonnull Map<String, FederationPolicyConstraint> federationPolicyConstraints) {
- if (trustChain.size() < 3) {
- return true;
- }
- for (int i = trustChain.size() - 2; i > 0; i--) {
- if (trustChain.get(i) instanceof SubordinateStatement subordinateStatement) {
- final Map<String, Object> constraints = subordinateStatement.getParsedPayload().getConstraints();
- if (constraints == null || constraints.isEmpty()) {
- log.trace("No constraints found for {}: {}", subordinateStatement.getSubject(), constraints);
- continue;
- }
- for (final String constraint : constraints.keySet()) {
- final FederationPolicyConstraint validator = federationPolicyConstraints.get(constraint);
- if (validator != null) {
- log.trace("Validating federation policy constraint {} with {}", constraint, validator);
- if (!validator.validate(constraints.get(constraint), subordinateStatement, trustChain)) {
- log.warn("Subordinate statement issued by {} contained constraint {} that failed",
- subordinateStatement.getIssuer(), constraint);
- return false;
- }
- } else {
- log.debug("Ignoring non-recognized federation policy constraint {}", constraint);
- }
- }
- } else {
- log.error("Unexpected trust chain contents: {} is not a subordinate statement", trustChain.get(i));
- return false;
- }
- }
- return true;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/AbstractFederationPolicyConstraint.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/AbstractFederationPolicyConstraint.java
deleted file mode 100644
index f4a5aea..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/AbstractFederationPolicyConstraint.java
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.FederationPolicyConstraint;
-import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Base implementation for the classes implementing {@link FederationPolicyConstraint}.
- *
- * @param <T> the data type for the constraint
- */
-public abstract class AbstractFederationPolicyConstraint<T extends Object>
- extends AbstractIdentifiableInitializableComponent implements FederationPolicyConstraint {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractFederationPolicyConstraint.class);
-
- /** {@inheritDoc} */
- @Override
- public boolean validate(@Nullable final Object constraint, @Nonnull final SubordinateStatement subordinateStatement,
- @Nonnull @Live final List<EntityStatement<?>> trustChain) {
- checkComponentActive();
- try {
- log.trace("Attempting to parse raw constraint value: {}", constraint);
- final T constraintData = parseConstraint(constraint);
- if (constraintData != null) {
- return doValidate(constraintData, subordinateStatement, trustChain);
- } else {
- return true;
- }
- } catch (final ConstraintViolationException e) {
- return false;
- }
- }
-
- /**
- * Parses the constraint data from the raw claim object value.
- *
- * @param constraint raw object value
- * @return parsed constraint data
- * @throws ConstraintViolationException if the parsing was not successful
- */
- @Nullable protected abstract T parseConstraint(@Nullable final Object constraint)
- throws ConstraintViolationException;
-
- /**
- * Validate whether the given trust chain meets given federation policy constraint value,
- *
- * @param constraintData the non-null constraint value
- * @param subordinateStatement subordinate statement that contains the constraint
- * @param trustChain trust chain to be evaluated and optionally updated: it is required to be modifiable
- * @return true if the trust chain is valid for this constraint, false otherwise.
- */
- protected abstract boolean doValidate(@Nonnull final T constraintData,
- @Nonnull final SubordinateStatement subordinateStatement,
- @Nonnull @Live final List<EntityStatement<?>> trustChain);
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/DefaultAllowedEntityTypesConstraint.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/DefaultAllowedEntityTypesConstraint.java
deleted file mode 100644
index 8ef37f0..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/DefaultAllowedEntityTypesConstraint.java
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl;
-
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.EntityConfigurationImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.SubordinateStatementImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl.MetadataImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.EntityConfigurationPayloadImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.SubordinateStatementPayloadImpl;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default implementation for the 'allowed_entity_types' -constraint.
- */
-public class DefaultAllowedEntityTypesConstraint extends AbstractFederationPolicyConstraint<List<String>> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultAllowedEntityTypesConstraint.class);
-
- /** JSON object mapper used for decoding JSON into Map. */
- @NonnullAfterInit private ObjectMapper objectMapper;
-
- /**
- * Set the JSON {@link ObjectMapper} used for decoding JSON into Map.
- *
- * @param mapper object mapper
- */
- public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- checkSetterPreconditions();
-
- objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (objectMapper == null) {
- throw new ComponentInitializationException("Object mapper cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- protected List<String> parseConstraint(@Nullable final Object constraint)
- throws ConstraintViolationException {
- if (constraint instanceof List<?> list) {
- return list.stream().filter(String.class::isInstance).map(String::valueOf).toList();
- } else if (constraint != null) {
- throw new ConstraintViolationException("Unexpected value type for allowed_entity_types: " + constraint);
- }
- return null;
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doValidate(@Nonnull final List<String> constraintData,
- @Nonnull final SubordinateStatement subordinateStatement,
- @Nonnull final List<EntityStatement<?>> trustChain) {
- if (constraintData.contains("federation_entity")) {
- log.warn("The value 'federation_entity' is not allowed for allowed_entity_types");
- return false;
- }
- final List<String> allowedTypes = new ArrayList<>(constraintData);
- allowedTypes.add("federation_entity");
- log.trace("Allowed entity types: {}", allowedTypes);
- for (int i = 0; i < trustChain.size() - 1; i++) {
- final EntityStatement<?> entityStatement = trustChain.get(i);
- assert entityStatement != null;
- if (subordinateStatement.equals(entityStatement)) {
- break;
- }
- final Metadata metadata =
- Optional.ofNullable(entityStatement.getParsedPayload().getMetadata())
- .orElse(null);
- if (metadata != null) {
- for (final String entityType : metadata.getAllClaims().keySet()) {
- if (!allowedTypes.contains(entityType)) {
- log.warn("The entity type {} is not allowed in entity statement {}", entityType,
- entityStatement.getSubject());
- for (int j = 0; j <= i; j++) {
- final EntityStatement<?> replacement = removeMetadata(entityType, trustChain.get(j));
- if (replacement == null) {
- log.error("Could not remove the entity type {} from metadata for {}", entityType,
- entityStatement.getSubject());
- return false;
- }
- trustChain.set(j, replacement);
- }
- } else {
- log.trace("The entity type {} is allowed for {}", entityType, entityStatement.getSubject());
- }
- }
- }
- }
- return true;
- }
-
- /**
- * Removes the metadata of given entity type from the given entity statement.
- *
- * @param entityType entity type for metadata to be removed
- * @param entityStatement entity statement holding the metadata
- * @return updated entity statement, or null if the operation failed
- */
- @Nullable private EntityStatement<?> removeMetadata(final String entityType,
- final EntityStatement<?> entityStatement) {
- final Map<String, Map<String, Object>> metadataClaims =
- new HashMap<>(entityStatement.getParsedPayload().getMetadata().getAllClaims());
- metadataClaims.remove(entityType);
- log.trace("Removed entity type {}", entityType);
- final MetadataImpl metadata = new MetadataImpl(metadataClaims);
- log.trace("Metadata contents {}", metadata);
- if (entityStatement instanceof EntityConfiguration entityConfiguration) {
- final EntityConfigurationPayloadImpl payload =
- new EntityConfigurationPayloadImpl(entityConfiguration.getParsedPayload());
- payload.setMetadata(metadata);
- return new EntityConfigurationImpl(entityStatement.getJwt(), payload);
- } else if (entityStatement instanceof SubordinateStatement subordinateStatement) {
- final SubordinateStatementPayloadImpl payload =
- new SubordinateStatementPayloadImpl(subordinateStatement.getParsedPayload());
- payload.setMetadata(metadata);
- return new SubordinateStatementImpl(entityStatement.getJwt(), payload);
- }
- return null;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/DefaultMaxPathLengthConstraint.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/DefaultMaxPathLengthConstraint.java
deleted file mode 100644
index 1dd7010..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/DefaultMaxPathLengthConstraint.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default implementation for the 'max_path_length' -constraint.
- */
-public class DefaultMaxPathLengthConstraint extends AbstractFederationPolicyConstraint<Integer> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultMaxPathLengthConstraint.class);
-
- /** {@inheritDoc} */
- @Override @Nullable
- protected Integer parseConstraint(@Nullable final Object constraint)
- throws ConstraintViolationException {
- if (constraint instanceof Integer integer) {
- return integer;
- } else if (constraint != null) {
- throw new ConstraintViolationException("Unexpected value type for max_path_length: " + constraint);
- }
- return null;
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doValidate(@Nonnull final Integer constraintData,
- @Nonnull final SubordinateStatement subordinateStatement,
- @Nonnull final List<EntityStatement<?>> trustChain) {
- final int length = trustChain.indexOf(subordinateStatement);
- if (length < 1) {
- log.error("Unexpected contents in the trust chain: subordinate statement index is {}", length);
- }
- log.trace("Maximum path length: {}, amount of intermediates is {}", constraintData, length - 1);
- if (constraintData < length - 1) {
- log.warn("Maximum path length is constricted to {}, amount of intermediates is {}",
- constraintData, length - 1);
- return false;
- }
- return true;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/DefaultNamingConstraintsConstraint.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/DefaultNamingConstraintsConstraint.java
deleted file mode 100644
index 9cebffb..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/constraints/impl/DefaultNamingConstraintsConstraint.java
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl;
-
-import java.net.URI;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.bouncycastle.asn1.x509.GeneralName;
-import org.bouncycastle.asn1.x509.GeneralSubtree;
-import org.bouncycastle.asn1.x509.NameConstraintValidatorException;
-import org.bouncycastle.asn1.x509.PKIXNameConstraintValidator;
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.primitive.NonnullSupplier;
-
-/**
- * Default implementation for the 'naming_constraints' -constraint.
- */
-public class DefaultNamingConstraintsConstraint extends AbstractFederationPolicyConstraint<Map<String, List<String>>> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultNamingConstraintsConstraint.class);
-
- /** {@inheritDoc} */
- @Override @Nullable
- protected Map<String, List<String>> parseConstraint(@Nullable final Object constraint)
- throws ConstraintViolationException {
- if (constraint instanceof Map<?,?> map) {
- return map.keySet().stream()
- .filter(key -> "permitted".equals(key) || "excluded".equals(key))
- .map(String::valueOf)
- .collect(Collectors.toMap(key -> key, key -> parseListOfStrings(key, map.get(key))));
- } else if (constraint != null) {
- throw new ConstraintViolationException("Unexpected value type for naming_constraints: " + constraint);
- }
- return null;
- }
-
- /**
- * Parses the raw object value into a list of strings.
- *
- * @param key the key (used solely in a potential exception)
- * @param raw the value to be parsed
- * @return the value as list of strings, or null if the input was null
- * @throws ConstraintViolationException if a non-null value could not be parsed
- */
- @Nullable private List<String> parseListOfStrings(@Nullable final String key, @Nullable final Object raw)
- throws ConstraintViolationException {
- if (raw instanceof List<?> list) {
- final List<String> result = list.stream().filter(Objects::nonNull).map(String::valueOf).toList();
- return result;
- } else if (raw != null) {
- throw new ConstraintViolationException("The value for " + key + " is not a list: " + raw);
- }
- return null;
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doValidate(@Nonnull final Map<String, List<String>> constraintData,
- @Nonnull final SubordinateStatement subordinateStatement,
- @Nonnull final List<EntityStatement<?>> trustChain) {
- final PKIXNameConstraintValidator bcValidator = new PKIXNameConstraintValidator();
-
- Optional.ofNullable(constraintData.get("excluded"))
- .orElseGet(NonnullSupplier.of(CollectionSupport.emptyList()))
- .forEach(item -> bcValidator.addExcludedSubtree(
- new GeneralSubtree(new GeneralName(GeneralName.dNSName, item))));
-
- Optional.ofNullable(constraintData.get("permitted"))
- .orElseGet(NonnullSupplier.of(CollectionSupport.emptyList()))
- .forEach(item -> bcValidator.intersectPermittedSubtree(
- new GeneralSubtree(new GeneralName(GeneralName.dNSName, item))));
-
- for (final EntityStatement<?> entityStatement : trustChain) {
- if (subordinateStatement.equals(entityStatement)) {
- break;
- }
- final String host = URI.create(entityStatement.getSubject()).getHost();
- try {
- bcValidator.checkExcluded(new GeneralName(GeneralName.dNSName, host));
- log.trace("Validation for 'excluded' was successful for {}", host);
- } catch (final NameConstraintValidatorException e) {
- log.warn("Constraint excludes entity name {}", host);
- return false;
- }
- try {
- bcValidator.checkPermitted(new GeneralName(GeneralName.dNSName, host));
- log.trace("Validation for 'permitted' was successful for {}", host);
- } catch (final NameConstraintValidatorException e) {
- log.warn("Constraint does not permit entity name {}", host);
- return false;
- }
- }
- return true;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/AbstractJWTWrapperImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/AbstractJWTWrapperImpl.java
deleted file mode 100644
index c3ea00e..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/AbstractJWTWrapperImpl.java
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl;
-
-import javax.annotation.Nonnull;
-
-import com.google.common.base.MoreObjects;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BaseJWTWrapper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BasePayload;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * Abstract wrapper class containing {@link SignedJWT} and its parsed payload.
- *
- * @param <T> payload format
- */
-public abstract class AbstractJWTWrapperImpl<T extends BasePayload> implements BaseJWTWrapper<T> {
-
- /** Entity statement as JWT. */
- @Nonnull private final SignedJWT jwt;
-
- /** Entity statement payload. */
- @Nonnull private final T parsedPayload;
-
- /**
- *
- * Constructor.
- *
- * @param signedJwt entity statement
- * @param payload entity statement payload
- * @throws ConstraintViolationException if the payload syntax/content is not expected
- */
- protected AbstractJWTWrapperImpl(@Nonnull final SignedJWT signedJwt, @Nonnull final T payload)
- throws ConstraintViolationException {
- jwt = Constraint.isNotNull(signedJwt, "JWT cannot be null");
- parsedPayload = Constraint.isNotNull(payload, "Entity statement payload cannot be null");
- Constraint.isNotEmpty(parsedPayload.getIssuer(), "Issuer cannot be empty in the payload");
- }
-
- /**
- * Get the entity statement as JWT.
- *
- * @return JWT
- */
- @Nonnull public SignedJWT getJwt() {
- return jwt;
- }
-
- /**
- * Get the issuer claim of the entity statement.
- *
- * @return issuer
- */
- @Nonnull @NotEmpty public String getIssuer() {
- final String issuer = parsedPayload.getIssuer();
- assert issuer != null;
- return issuer;
- }
-
- /**
- * Get the payload of the entity statement.
- *
- * @return payload
- */
- @Nonnull public T getParsedPayload() {
- return parsedPayload;
- }
-
- /** {@inheritDoc} */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("jwt", jwt.serialize())
- .add("parsedPayload", parsedPayload)
- .toString();
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/EntityConfigurationImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/EntityConfigurationImpl.java
deleted file mode 100644
index f484422..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/EntityConfigurationImpl.java
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityConfigurationPayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.EntityConfigurationPayloadImpl;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * A wrapper class extending {@link EntityStatementImpl} with parsed claims related to entity configuration.
- */
-public class EntityConfigurationImpl extends EntityStatementImpl<EntityConfigurationPayload>
- implements EntityConfiguration {
-
- /**
- * Constructor.
- *
- * @param signedJwt entity configuration
- * @param payload entity configuration payload
- * @throws ConstraintViolationException if the payload syntax/content is not expected
- */
- public EntityConfigurationImpl(@Nonnull final SignedJWT signedJwt,
- @Nonnull final EntityConfigurationPayload payload)
- throws ConstraintViolationException {
- super(signedJwt, payload);
- }
-
- /**
- * Parse an {@link EntityConfigurationImpl} from the given JWT by using the given object mapper.
- *
- * @param jwt entity statement JWT
- * @param objectMapper object mapper capable of parsing JWT payload
- * @return entity configuration
- * @throws JsonProcessingException if the payload could not be parsed
- */
- @Nonnull public static EntityConfigurationImpl parse(@Nonnull final SignedJWT jwt,
- @Nonnull final ObjectMapper objectMapper) throws JsonProcessingException {
- final JavaType objectType = objectMapper.constructType(EntityConfigurationPayloadImpl.class);
- final EntityConfigurationPayloadImpl result =
- objectMapper.readValue(jwt.getPayload().toString(), objectType);
- assert result != null;
- return new EntityConfigurationImpl(jwt, result);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/EntityStatementImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/EntityStatementImpl.java
deleted file mode 100644
index d996b16..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/EntityStatementImpl.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl;
-
-import javax.annotation.Nonnull;
-
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityStatementPayload;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * A wrapper class containing the {@link SignedJWT} and parsed claims related to entity statement.
- *
- * @param <T> payload format
- */
-public abstract class EntityStatementImpl<T extends EntityStatementPayload> extends AbstractJWTWrapperImpl<T>
- implements EntityStatement<T> {
-
- /**
- *
- * Constructor.
- *
- * @param signedJwt entity statement
- * @param payload entity statement payload
- * @throws ConstraintViolationException if the payload syntax/content is not expected
- */
- public EntityStatementImpl(@Nonnull final SignedJWT signedJwt, @Nonnull final T payload)
- throws ConstraintViolationException {
- super(signedJwt, payload);
- Constraint.isNotEmpty(payload.getSubject(), "Subject cannot be empty in the payload");
- }
-
- /**
- * Get the subject claim of the entity statement.
- *
- * @return subject
- */
- @Nonnull @NotEmpty public String getSubject() {
- final String subject = getParsedPayload().getSubject();
- assert subject != null;
- return subject;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/ResolveEntityResponseImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/ResolveEntityResponseImpl.java
deleted file mode 100644
index ecdf38f..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/ResolveEntityResponseImpl.java
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.ResolveEntityResponsePayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.ResolveEntityResponsePayloadImpl;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * A wrapper class extending {@link EntityStatementImpl} with parsed claims related to resolve entity response.
- */
-public class ResolveEntityResponseImpl extends AbstractJWTWrapperImpl<ResolveEntityResponsePayload>
- implements ResolveEntityResponse {
-
- /**
- * Constructor.
- *
- * @param signedJwt entity configuration
- * @param payload entity configuration payload
- * @throws ConstraintViolationException if the payload syntax/content is not expected
- */
- public ResolveEntityResponseImpl(@Nonnull final SignedJWT signedJwt,
- @Nonnull final ResolveEntityResponsePayload payload)
- throws ConstraintViolationException {
- super(signedJwt, payload);
- }
-
- /**
- * Parse an {@link ResolveEntityResponseImpl} from the given JWT by using the given object mapper.
- *
- * @param jwt entity statement JWT
- * @param objectMapper object mapper capable of parsing JWT payload
- * @return entity configuration
- * @throws JsonProcessingException if the payload could not be parsed
- */
- @Nonnull public static ResolveEntityResponseImpl parse(@Nonnull final SignedJWT jwt,
- @Nonnull final ObjectMapper objectMapper) throws JsonProcessingException {
- final JavaType objectType = objectMapper.constructType(ResolveEntityResponsePayloadImpl.class);
- final ResolveEntityResponsePayloadImpl result = objectMapper.readValue(jwt.getPayload().toString(), objectType);
- assert result != null;
- return new ResolveEntityResponseImpl(jwt, result);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/SignedKeysetImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/SignedKeysetImpl.java
deleted file mode 100644
index 6113649..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/SignedKeysetImpl.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignedKeyset;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.SignedKeysetPayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.SignedKeysetPayloadImpl;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * A wrapper class extending {@link EntityStatementImpl} with parsed claims related to signed keyset.
- */
-public class SignedKeysetImpl extends AbstractJWTWrapperImpl<SignedKeysetPayload> implements SignedKeyset {
-
- /**
- * Constructor.
- *
- * @param signedJwt entity configuration
- * @param payload entity configuration payload
- * @throws ConstraintViolationException if the payload syntax/content is not expected
- */
- public SignedKeysetImpl(@Nonnull final SignedJWT signedJwt,
- @Nonnull final SignedKeysetPayload payload)
- throws ConstraintViolationException {
- super(signedJwt, payload);
- }
-
- /**
- * Parse an {@link SignedKeysetImpl} from the given JWT by using the given object mapper.
- *
- * @param jwt entity statement JWT
- * @param objectMapper object mapper capable of parsing JWT payload
- * @return entity configuration
- * @throws JsonProcessingException if the payload could not be parsed
- */
- @Nonnull public static SignedKeysetImpl parse(@Nonnull final SignedJWT jwt,
- @Nonnull final ObjectMapper objectMapper) throws JsonProcessingException {
- final JavaType objectType = objectMapper.constructType(SignedKeysetPayloadImpl.class);
- final SignedKeysetPayloadImpl result = objectMapper.readValue(jwt.getPayload().toString(), objectType);
- assert result != null;
- return new SignedKeysetImpl(jwt, result);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/SubordinateStatementImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/SubordinateStatementImpl.java
deleted file mode 100644
index 8698405..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/SubordinateStatementImpl.java
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.SubordinateStatementPayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.SubordinateStatementPayloadImpl;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * A wrapper class extending {@link EntityStatementImpl} with parsed claims related to subordinate statements.
- */
-public class SubordinateStatementImpl extends EntityStatementImpl<SubordinateStatementPayload>
- implements SubordinateStatement {
-
- /**
- * Constructor.
- *
- * @param signedJwt subordinate statement
- * @param payload subordinate statement payload
- * @throws ConstraintViolationException if the payload syntax/content is not expected
- */
- public SubordinateStatementImpl(@Nonnull final SignedJWT signedJwt,
- @Nonnull final SubordinateStatementPayload payload)
- throws ConstraintViolationException {
- super(signedJwt, payload);
- }
-
- /**
- * Parse a {@link SubordinateStatementImpl} from the given JWT by using the given object mapper.
- *
- * @param jwt entity statement JWT
- * @param objectMapper object mapper capable of parsing JWT payload
- * @return subordinate statement
- * @throws JsonProcessingException if the payload could not be parsed
- */
- @Nonnull public static SubordinateStatementImpl parse(@Nonnull final SignedJWT jwt,
- @Nonnull final ObjectMapper objectMapper) throws JsonProcessingException {
- final JavaType objectType = objectMapper.constructType(SubordinateStatementPayloadImpl.class);
- final SubordinateStatementPayloadImpl result =
- objectMapper.readValue(jwt.getPayload().toString(), objectType);
- assert result != null;
- return new SubordinateStatementImpl(jwt, result);
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/TrustMarkImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/TrustMarkImpl.java
deleted file mode 100644
index 17a7b3b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/TrustMarkImpl.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMark;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.TrustMarkPayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.TrustMarkPayloadImpl;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * A wrapper class extending {@link EntityStatementImpl} with parsed claims related to trust mark.
- */
-public class TrustMarkImpl extends AbstractJWTWrapperImpl<TrustMarkPayload> implements TrustMark {
-
- /**
- * Constructor.
- *
- * @param signedJwt entity configuration
- * @param payload entity configuration payload
- * @throws ConstraintViolationException if the payload syntax/content is not expected
- */
- public TrustMarkImpl(@Nonnull final SignedJWT signedJwt,
- @Nonnull final TrustMarkPayload payload)
- throws ConstraintViolationException {
- super(signedJwt, payload);
- }
-
- /**
- * Parse an {@link TrustMarkImpl} from the given JWT by using the given object mapper.
- *
- * @param jwt entity statement JWT
- * @param objectMapper object mapper capable of parsing JWT payload
- * @return entity configuration
- * @throws JsonProcessingException if the payload could not be parsed
- */
- @Nonnull public static TrustMarkImpl parse(@Nonnull final SignedJWT jwt,
- @Nonnull final ObjectMapper objectMapper) throws JsonProcessingException {
- final JavaType objectType = objectMapper.constructType(TrustMarkPayloadImpl.class);
- final TrustMarkPayloadImpl result = objectMapper.readValue(jwt.getPayload().toString(), objectType);
- assert result != null;
- return new TrustMarkImpl(jwt, result);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/TrustMarkStatusImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/TrustMarkStatusImpl.java
deleted file mode 100644
index 5dacdbb..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/impl/TrustMarkStatusImpl.java
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMarkStatus;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.TrustMarkStatusPayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.TrustMarkStatusPayloadImpl;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * A wrapper class extending {@link EntityStatementImpl} with parsed claims related to trust mark status.
- */
-public class TrustMarkStatusImpl extends AbstractJWTWrapperImpl<TrustMarkStatusPayload>
- implements TrustMarkStatus {
-
- /**
- * Constructor.
- *
- * @param signedJwt entity configuration
- * @param payload entity configuration payload
- * @throws ConstraintViolationException if the payload syntax/content is not expected
- */
- public TrustMarkStatusImpl(@Nonnull final SignedJWT signedJwt,
- @Nonnull final TrustMarkStatusPayload payload)
- throws ConstraintViolationException {
- super(signedJwt, payload);
- }
-
- /**
- * Parse an {@link TrustMarkStatusImpl} from the given JWT by using the given object mapper.
- *
- * @param jwt entity statement JWT
- * @param objectMapper object mapper capable of parsing JWT payload
- * @return entity configuration
- * @throws JsonProcessingException if the payload could not be parsed
- */
- @Nonnull public static TrustMarkStatusImpl parse(@Nonnull final SignedJWT jwt,
- @Nonnull final ObjectMapper objectMapper) throws JsonProcessingException {
- final JavaType objectType = objectMapper.constructType(TrustMarkStatusPayloadImpl.class);
- final TrustMarkStatusPayloadImpl result = objectMapper.readValue(jwt.getPayload().toString(), objectType);
- assert result != null;
- return new TrustMarkStatusImpl(jwt, result);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/InstantDeserializer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/InstantDeserializer.java
deleted file mode 100644
index 80fdd1b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/InstantDeserializer.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson;
-
-import java.io.IOException;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.core.JsonParser;
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.DeserializationContext;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.JsonDeserializer;
-import com.fasterxml.jackson.databind.type.TypeFactory;
-
-/**
- * Jackson deserializer for {@link Instant} that exploits {@link Instant#ofEpochSecond(long)}.
- */
-public class InstantDeserializer extends JsonDeserializer<Instant> {
-
- /**
- * Constructor.
- */
- public InstantDeserializer() {
- // no op
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull
- public Instant deserialize(final JsonParser jsonParser, final DeserializationContext deserializationContext)
- throws IOException, JsonProcessingException {
-
- final JavaType longType = TypeFactory.defaultInstance().constructType(Long.class);
- final Long longValue = deserializationContext.readValue(jsonParser, longType);
- final Instant result = Instant.ofEpochSecond(longValue);
- assert result != null;
- return result;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/JWKDeserializer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/JWKDeserializer.java
deleted file mode 100644
index 9516191..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/JWKDeserializer.java
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson;
-
-import java.io.IOException;
-import java.text.ParseException;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonParser;
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.DeserializationContext;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.JsonDeserializer;
-import com.fasterxml.jackson.databind.type.MapType;
-import com.fasterxml.jackson.databind.type.TypeFactory;
-import com.nimbusds.jose.jwk.JWK;
-
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Jackson deserializer for {@link JWK} that exploits {@link JWK#parse(Map)}.
- */
-public class JWKDeserializer extends JsonDeserializer<JWK> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(JWKDeserializer.class);
-
- /**
- * Constructor.
- */
- public JWKDeserializer() {
- // no op
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull
- public JWK deserialize(final JsonParser jsonParser, final DeserializationContext deserializationContext)
- throws IOException, JsonProcessingException {
-
- log.debug("Starting deseralize");
- final JavaType objectType = TypeFactory.defaultInstance().constructType(Object.class);
- final JavaType stringType = TypeFactory.defaultInstance().constructType(String.class);
- final MapType objectMapType =
- TypeFactory.defaultInstance().constructMapType(Map.class, stringType, objectType);
-
- final Map<String,Object> map = deserializationContext.readValue(jsonParser, objectMapType);
- try {
- final JWK result = JWK.parse(map);
- assert result != null;
- return result;
- } catch (final ParseException e) {
- throw new IOException("Could not parse JWK from the given input", e);
- }
-
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/JWKSetDeserializer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/JWKSetDeserializer.java
deleted file mode 100644
index f5c0762..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/JWKSetDeserializer.java
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson;
-
-import java.io.IOException;
-import java.text.ParseException;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonParser;
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.DeserializationContext;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.JsonDeserializer;
-import com.fasterxml.jackson.databind.type.MapType;
-import com.fasterxml.jackson.databind.type.TypeFactory;
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Jackson deserializer for {@link JWKSet} that exploits {@link JWKSet#parse(Map)}.
- */
-public class JWKSetDeserializer extends JsonDeserializer<JWKSet> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(JWKSetDeserializer.class);
-
- /**
- * Constructor.
- */
- public JWKSetDeserializer() {
- // no op
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull
- public JWKSet deserialize(final JsonParser jsonParser, final DeserializationContext deserializationContext)
- throws IOException, JsonProcessingException {
-
- log.debug("Starting deseralize");
- final JavaType objectType = TypeFactory.defaultInstance().constructType(Object.class);
- final JavaType stringType = TypeFactory.defaultInstance().constructType(String.class);
- final MapType objectMapType =
- TypeFactory.defaultInstance().constructMapType(Map.class, stringType, objectType);
-
- final Map<String,Object> map = deserializationContext.readValue(jsonParser, objectMapType);
- try {
- final JWKSet result = JWKSet.parse(map);
- assert result != null;
- return result;
- } catch (final ParseException e) {
- throw new IOException("Could not parse JWKSet from the given input", e);
- }
-
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/LocalKeyContainerDeserializer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/LocalKeyContainerDeserializer.java
deleted file mode 100644
index b30af43..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/jackson/LocalKeyContainerDeserializer.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson;
-
-import java.io.IOException;
-import java.text.ParseException;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JacksonException;
-import com.fasterxml.jackson.core.JsonParser;
-import com.fasterxml.jackson.databind.DeserializationContext;
-import com.fasterxml.jackson.databind.JsonDeserializer;
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Jackson deserializer for {@link LocalKeyContainer}.
- */
-public class LocalKeyContainerDeserializer extends JsonDeserializer<LocalKeyContainer> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(LocalKeyContainerDeserializer.class);
-
- /** {@inheritDoc} */
- @Override
- public LocalKeyContainer deserialize(@Nullable final JsonParser jsonParser,
- @Nullable final DeserializationContext deserializationContext)
- throws IOException, JacksonException {
- assert jsonParser != null;
- final String raw = jsonParser.readValueAsTree().toString();
- log.trace("Raw string to be parsed into JWTSet: {}", raw);
- try {
- final LocalKeyContainer keyContainer = new LocalKeyContainer();
- keyContainer.setJWKSet(JWKSet.parse(raw));
- return keyContainer;
- } catch (final ParseException e) {
- throw new IOException("Could not parse JWKSet", e);
- }
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/impl/MetadataImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/impl/MetadataImpl.java
deleted file mode 100644
index fbc3784..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/impl/MetadataImpl.java
+++ /dev/null
@@ -1,293 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.fasterxml.jackson.annotation.JsonAnyGetter;
-import com.fasterxml.jackson.annotation.JsonAnySetter;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * Metadata claim as defined by the OpenID Federation 1.0 Section 5.
- */
-public class MetadataImpl implements Metadata {
-
- /** Federation entity metadata. */
- @JsonProperty("federation_entity") private Map<String,Object> federationEntityMetadata;
-
- /** OpenID Connect Relying Party metadata. */
- @JsonProperty("openid_relying_party") private Map<String,Object> openidRelyingPartyMetadata;
-
- /** OpenID Connect OpenID Provider metadata. */
- @JsonProperty("openid_provider") private Map<String,Object> openidProviderMetadata;
-
- /** OAuth Authorization Server metadata. */
- @JsonProperty("oauth_authorization_server") private Map<String,Object> oauthAuthorizationServerMetadata;
-
- /** OAuth Client metadata. */
- @JsonProperty("oauth_client") private Map<String,Object> oauthClientMetadata;
-
- /** OAuth Protected Resource metadata. */
- @JsonProperty("oauth_resource") private Map<String,Object> oauthResourceMetadata;
-
- /** The map of any other claims not directly mapped. */
- private final Map<String, Map<String, Object>> customClaims = new HashMap<>();
-
- /**
- * Constructor.
- */
- public MetadataImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param allClaims claims used for populating this object
- */
- public MetadataImpl(@Nonnull final Map<String, Map<String, Object>> allClaims) {
- for (final String claim : allClaims.keySet()) {
- verifyNoNullValues(allClaims.get(claim), Constraint.isNotNull(claim,
- "Metadata for entity type " + claim + " contains a null claim key"));
- }
- final Map<String,Map<String,Object>> input = new HashMap<>(allClaims);
- if (allClaims.containsKey("federation_entity")) {
- federationEntityMetadata = allClaims.get("federation_entity");
- input.remove("federation_entity");
- }
- if (allClaims.containsKey("openid_relying_party")) {
- openidRelyingPartyMetadata = allClaims.get("openid_relying_party");
- input.remove("openid_relying_party");
- }
- if (allClaims.containsKey("openid_provider")) {
- openidProviderMetadata = allClaims.get("openid_provider");
- input.remove("openid_provider");
- }
- if (allClaims.containsKey("oauth_authorization_server")) {
- oauthAuthorizationServerMetadata = allClaims.get("oauth_authorization_server");
- input.remove("oauth_authorization_server");
- }
- if (allClaims.containsKey("oauth_client")) {
- oauthClientMetadata = allClaims.get("oauth_client");
- input.remove("oauth_client");
- }
- if (allClaims.containsKey("oauth_resource")) {
- oauthResourceMetadata = allClaims.get("oauth_resource");
- input.remove("oauth_resource");
- }
- customClaims.putAll(input);
- }
-
- /**
- * Get the federation entity metadata.
- *
- * @return federation entity metadata
- */
- @Nullable public Map<String,Object> getFederationEntityMetadata() {
- return federationEntityMetadata;
- }
-
- /**
- * Set the federation entity metadata.
- *
- * @param metadata federation entity metadata
- */
- public void setFederationEntityMetadata(@Nullable final Map<String,Object> metadata) {
- federationEntityMetadata = verifyNoNullValues(metadata, "federation_entity");
- }
-
- /**
- * Get the OpenID Connect Relying Party metadata.
- *
- * @return OIDC RP metadata
- */
- @Nullable public Map<String,Object> getOpenidRelyingPartyMetadata() {
- return openidRelyingPartyMetadata;
- }
-
- /**
- * Set the OpenID Connect Relying Party metadata.
- *
- * @param metadata OIDC RP metadata
- */
- public void setOpenidRelyingPartyMetadata(@Nullable final Map<String,Object> metadata) {
- openidRelyingPartyMetadata = verifyNoNullValues(metadata, "openid_relying_party");
- }
-
- /**
- * Get the OpenID Connect OpenID Provider metadata.
- *
- * @return OIDC OP metadata
- */
- @Nullable public Map<String,Object> getOpenidProviderMetadata() {
- return openidProviderMetadata;
- }
-
- /**
- * Set the OpenID Connect OpenID Provider metadata.
- *
- * @param metadata OIDC OP metadata
- */
- public void setOpenidProviderMetadata(@Nullable final Map<String,Object> metadata) {
- openidProviderMetadata = verifyNoNullValues(metadata, "openid_provider");
- }
-
- /**
- * Get the OAuth Authorization Server metadata.
- *
- * @return OAuth AS metadata
- */
- @Nullable public Map<String,Object> getOauthAuthorizationServerMetadata() {
- return oauthAuthorizationServerMetadata;
- }
-
- /**
- * Set the OAuth Authorization Server metadata.
- *
- * @param metadata OAuth AS metadata
- */
- public void setOauthAuthorizationServerMetadata(@Nullable final Map<String,Object> metadata) {
- oauthAuthorizationServerMetadata = verifyNoNullValues(metadata, "oauth_authorization_server");
- }
-
- /**
- * Get the OAuth Client metadata.
- *
- * @return OAuth client metadata
- */
- @Nullable public Map<String,Object> getOauthClientMetadata() {
- return oauthClientMetadata;
- }
-
- /**
- * Set the OAuth Client metadata.
- *
- * @param metadata OAuth client metadata
- */
- public void setOauthClientMetadata(@Nullable final Map<String,Object> metadata) {
- oauthClientMetadata = verifyNoNullValues(metadata, "oauth_client");
- }
-
- /**
- * Get the OAuth Protected Resource metadata.
- *
- * @return OAuth protected resource metadata
- */
- @Nullable public Map<String,Object> getOauthResourceMetadata() {
- return oauthClientMetadata;
- }
-
- /**
- * Set the OAuth Protected Resource metadata.
- *
- * @param metadata OAuth protected resource metadata
- */
- public void setOauthResourceMetadata(@Nullable final Map<String,Object> metadata) {
- oauthClientMetadata = verifyNoNullValues(metadata, "oauth_resource");
- }
-
- /**
- * Get the map of custom claims.
- *
- * @return The map of any other claims not directly mapped.
- */
- @JsonAnyGetter
- public Map<String,Map<String, Object>> getCustomClaims() {
- return customClaims;
- }
-
- /**
- * Add a custom claim to the map of custom claims.
- *
- * @param name The name of the custom claim.
- * @param value The value of the custom claim.
- */
- @JsonAnySetter
- public void setCustomClaims(final String name, final Map<String,Object> value) {
- customClaims.put(name, Constraint.isNotNull(value, "Metadata entity type " + name + " cannot be null"));
- }
-
- /**
- * Get all claims (standard and custom) in a map keyed by entity types.
- *
- * @return all claims
- */
- @Nonnull public Map<String,Map<String,Object>> getAllClaims() {
- final Map<String,Map<String,Object>> claims = new HashMap<>();
- if (federationEntityMetadata != null) {
- claims.put("federation_entity", federationEntityMetadata);
- }
- if (openidRelyingPartyMetadata != null) {
- claims.put("openid_relying_party", openidRelyingPartyMetadata);
- }
- if (openidProviderMetadata != null) {
- claims.put("openid_provider", openidProviderMetadata);
- }
- if (oauthAuthorizationServerMetadata != null) {
- claims.put("oauth_authorization_server", oauthAuthorizationServerMetadata);
- }
- if (oauthClientMetadata != null) {
- claims.put("oauth_client", oauthClientMetadata);
- }
- if (oauthResourceMetadata != null) {
- claims.put("oauth_resource", oauthClientMetadata);
- }
- claims.putAll(getCustomClaims());
- return CollectionSupport.copyToMap(claims);
- }
-
- /**
- * Verifies the given map meets syntax requirements: is not null and does not have null claim values.
- *
- * @param map the map to be verified
- * @param entityType the entity type
- * @return verified map
- * @throws ConstraintViolationException if the map does not meet the requirements
- */
- protected Map<String,Object> verifyNoNullValues(@Nullable final Map<String,Object> map,
- @Nonnull final String entityType) throws ConstraintViolationException {
- Constraint.isNotNull(map, "Metadata entity type " + entityType + " cannot be null");
- assert map != null;
- for (final String claim : map.keySet()) {
- Constraint.isNotNull(map.get(claim), "Metadata for entity type " + entityType
- + " contains a claim with null value: " + claim);
- }
- return map;
- }
-
- /** {@inheritDoc} */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("federationEntityMetadata", getFederationEntityMetadata())
- .add("openidRelyingPartyMetadata", getOpenidRelyingPartyMetadata())
- .add("openidProviderMetadata", getOpenidProviderMetadata())
- .add("oauthAuthorizationServerMetadata", getOauthAuthorizationServerMetadata())
- .add("oauthClientMetadata", getOauthClientMetadata())
- .add("oauthResourceMetadata", getOauthResourceMetadata())
- .add("customClaims", getCustomClaims()).toString();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/impl/TrustMarkOwnerImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/impl/TrustMarkOwnerImpl.java
deleted file mode 100644
index c6b7644..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/claim/impl/TrustMarkOwnerImpl.java
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.fasterxml.jackson.annotation.JsonAnyGetter;
-import com.fasterxml.jackson.annotation.JsonAnySetter;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.TrustMarkOwner;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Trust mark owner claim to be used with a map of trust_mark_owners as defined by the OpenID Federation 1.0 Section
- * 3.1.2.
- */
-public class TrustMarkOwnerImpl implements TrustMarkOwner {
-
- /** Subject. */
- @JsonProperty("sub") private String sub;
-
- /** A JSON Web Key Set representing the public part of the owner's Federation Entity signing keys. */
- @JsonProperty("jwks") private JWKSet jwks;
-
- /** The map of any other claims not directly mapped. */
- private final Map<String, Object> customClaims = new HashMap<>();
-
- /**
- * Constructor.
- */
- public TrustMarkOwnerImpl() {
- // no op
- }
-
- /**
- * Get the subject.
- *
- * @return subject
- */
- @Nullable public String getSub() {
- return sub;
- }
-
- /**
- * Set the subject.
- *
- * @param subject subject
- */
- public void setSub(@Nullable final String subject) {
- sub = subject;
- }
-
- /**
- * Get the map of custom claims.
- *
- * @return The map of any other claims not directly mapped.
- */
- @JsonAnyGetter
- public Map<String, Object> getCustomClaims() {
- return customClaims;
- }
-
- /**
- * Get the JWK set.
- *
- * @return JWK set
- */
- public JWKSet getJwks() {
- return jwks;
- }
-
- /**
- * Set the JWK set.
- *
- * @param jwkSet JWK set
- */
- public void setJwks(final JWKSet jwkSet) {
- jwks = jwkSet;
- }
-
- /**
- * Add a custom claim to the map of custom claims.
- *
- * @param name The name of the custom claim.
- * @param value The value of the custom claim.
- */
- @JsonAnySetter
- public void setCustomClaims(@Nonnull @NotEmpty final String name, @Nullable final Object value) {
- customClaims.put(Constraint.isNotEmpty(name, "Claim name cannot be null"), value);
- }
-
- /** {@inheritDoc} */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("sub", getSub())
- .add("jwks", getJwks())
- .add("customClaims", getCustomClaims()).toString();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/BaseExpirableSubjectPayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/BaseExpirableSubjectPayloadImpl.java
deleted file mode 100644
index 4c7745c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/BaseExpirableSubjectPayloadImpl.java
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.BaseExpirableSubjectPayload;
-
-/**
- * Base payload carrying subject and expiration.
- */
-public class BaseExpirableSubjectPayloadImpl extends BasePayloadImpl implements BaseExpirableSubjectPayload {
-
- /** The Entity Identifier of the subject. */
- @JsonProperty("sub") private String subject;
-
- /** Expiration time after which this statement MUST NOT be accepted for processing. */
- @JsonProperty("exp") private Instant expiration;
-
- /**
- * Constructor.
- */
- public BaseExpirableSubjectPayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public BaseExpirableSubjectPayloadImpl(@Nonnull final BaseExpirableSubjectPayload payload) {
- super(payload);
- setSubject(payload.getSubject());
- setExpiration(payload.getExpiration());
- }
-
- /**
- * Get the subject.
- *
- * @return subject
- */
- public String getSubject() {
- return subject;
- }
-
- /**
- * Set the subject.
- *
- * @param sub subject to set.
- */
- public void setSubject(final String sub) {
- subject = sub;
- }
-
- /**
- * Get the expiration time.
- *
- * @return expiration time
- */
- public Instant getExpiration() {
- return expiration;
- }
-
- /**
- * Set the expiration time.
- *
- * @param exp expiration time
- */
- public void setExpiration(final Instant exp) {
- expiration = exp;
- }
-
- /**
- * {@inheritDoc}
- */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("iss", getIssuer())
- .add("iat", getIssuedAt())
- .add("sub", subject)
- .add("exp", expiration).toString();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/BaseMetadataPayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/BaseMetadataPayloadImpl.java
deleted file mode 100644
index db6c0d1..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/BaseMetadataPayloadImpl.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.BaseMetadataPayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
-
-/**
- * Base payload carrying metadata claim.
- */
-public class BaseMetadataPayloadImpl extends BaseExpirableSubjectPayloadImpl implements BaseMetadataPayload {
-
- /** A JSON object that declares roles that the Entity plays per its Entity Types. */
- @JsonProperty("metadata") private Metadata metadata;
-
- /**
- * Constructor.
- */
- public BaseMetadataPayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public BaseMetadataPayloadImpl(@Nonnull final BaseMetadataPayload payload) {
- super(payload);
- setMetadata(payload.getMetadata());
- }
-
- /**
- * Get the metadata.
- *
- * @return metadata
- */
- public Metadata getMetadata() {
- return metadata;
- }
-
- /**
- * Set the metadata.
- *
- * @param data metadata
- */
- public void setMetadata(final Metadata data) {
- metadata = data;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/BasePayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/BasePayloadImpl.java
deleted file mode 100644
index fb6b302..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/BasePayloadImpl.java
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import java.time.Instant;
-import java.util.HashMap;
-import java.util.Map;
-
-import com.fasterxml.jackson.annotation.JsonAnyGetter;
-import com.fasterxml.jackson.annotation.JsonAnySetter;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BasePayload;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Base payload for claims used within all payloads.
- */
-public class BasePayloadImpl implements BasePayload {
-
- /** The Entity Identifier of the Entity Statement. */
- @JsonProperty("iss") private String issuer;
-
- /** Time when this statement was issued. */
- @JsonProperty("iat") private Instant issuedAt;
-
- /** The map of any other claims not directly mapped. */
- private final Map<String, Object> customClaims = new HashMap<>();
-
- /**
- * Constructor.
- */
- public BasePayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public BasePayloadImpl(final BasePayload payload) {
- Constraint.isNotNull(payload, "Payload cannot be null");
- setIssuer(payload.getIssuer());
- setIssuedAt(payload.getIssuedAt());
- for (final String customClaim : payload.getCustomClaims().keySet()) {
- setCustomClaims(customClaim, payload.getCustomClaims().get(customClaim));
- }
- }
-
- /**
- * Get the issuer.
- *
- * @return issuer
- */
- public String getIssuer() {
- return issuer;
- }
-
- /**
- * Set the issuer.
- *
- * @param iss issuer to set
- */
- public void setIssuer(final String iss) {
- issuer = iss;
- }
-
- /**
- * Get the issuance time.
- *
- * @return issuance time
- */
- public Instant getIssuedAt() {
- return issuedAt;
- }
-
- /**
- * Set the issuance time.
- *
- * @param iat issuance time
- */
- public void setIssuedAt(final Instant iat) {
- issuedAt = iat;
- }
-
- /**
- * Get the map of custom claims.
- *
- * @return The map of any other claims not directly mapped.
- */
- @JsonAnyGetter
- public Map<String, Object> getCustomClaims() {
- return customClaims;
- }
-
- /**
- * Add a custom claim to the map of custom claims.
- *
- * @param name The name of the custom claim.
- * @param value The value of the custom claim.
- */
- @JsonAnySetter
- public void setCustomClaims(final String name, final Object value) {
- customClaims.put(name, value);
- }
-
- /**
- * {@inheritDoc}
- */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("iss", issuer)
- .add("iat", issuedAt)
- .add("customClaims", customClaims).toString();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/EntityConfigurationPayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/EntityConfigurationPayloadImpl.java
deleted file mode 100644
index f22dddc..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/EntityConfigurationPayloadImpl.java
+++ /dev/null
@@ -1,186 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityConfigurationPayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.TrustMarkOwner;
-
-/**
- * Entity Configuration payload claims as defined by the OpenID Federation 1.0 Section 3.2. This class extends the
- * list of claims defined by {@link EntityStatementPayloadImpl} with the claims that MUST or MAY appear in Entity
- * Configurations but not in Subordinate Statements.
- */
-public class EntityConfigurationPayloadImpl extends EntityStatementPayloadImpl implements EntityConfigurationPayload {
-
- /** An array of strings representing the Entity Identifiers of Immediate Superiors. */
- @JsonProperty("authority_hints") private List<String> authorityHints;
-
- /** An array of strings representing the Entity Identifiers of Trust Anchors trusted by the Entity. */
- @JsonProperty("trust_anchor_hints") private List<String> trustAnchorHints;
-
- /** An array of Trust Marks. */
- @JsonProperty("trust_marks") private List<Map<String,String>> trustMarks;
-
- /**
- * A map of arrays of Entity Identifiers that are trusted to represent the accreditation authority for Trust Marks.
- */
- @JsonProperty("trust_mark_issuers") private Map<String, List<String>> trustMarkIssuers;
-
- /** A map of Owners of the Trust Marks. */
- @JsonProperty("trust_mark_owners") private Map<String, TrustMarkOwner> trustMarkOwners;
-
- /**
- * Constructor.
- */
- public EntityConfigurationPayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public EntityConfigurationPayloadImpl(@Nonnull final EntityConfigurationPayload payload) {
- super(payload);
- setAuthorityHints(payload.getAuthorityHints());
- setTrustAnchorHints(payload.getTrustAnchorHints());
- setTrustMarks(payload.getTrustMarks());
- setTrustMarkIssuers(payload.getTrustMarkIssuers());
- setTrustMarkOwners(payload.getTrustMarkOwners());
- }
-
- /**
- * {@inheritDoc}
- */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("iss", getIssuer())
- .add("sub", getSubject())
- .add("iat", getIssuedAt())
- .add("exp", getExpiration())
- .add("jwks", getJwks())
- .add("metadata", getMetadata())
- .add("crit", getCritical())
- .add("authority_hints", authorityHints)
- .add("trust_anchor_hints", trustAnchorHints)
- .add("trust_marks", trustMarks)
- .add("trust_mark_issuers", trustMarkIssuers)
- .add("trust_mark_owners", trustMarkOwners)
- .add("customClaims", getCustomClaims()).toString();
- }
-
- /**
- * Get the array of strings representing the Entity Identifiers of Immediate Superiors.
- *
- * @return authority hints
- */
- @Nullable public List<String> getAuthorityHints() {
- return authorityHints;
- }
-
- /**
- * Set the array of strings representing the Entity Identifiers of Immediate Superiors.
- *
- * @param hints authority hints
- */
- public void setAuthorityHints(@Nullable List<String> hints) {
- authorityHints = hints;
- }
-
- /**
- * Get the array of strings representing the Entity Identifiers of Trust Anchors trusted by the Entity.
- *
- * @return trust anchor hints
- */
- @Nullable public List<String> getTrustAnchorHints() {
- return trustAnchorHints;
- }
-
- /**
- * Set the array of strings representing the Entity Identifiers of Trust Anchors trusted by the Entity.
- *
- * @param hints trust anchor hints
- */
- public void setTrustAnchorHints(@Nullable List<String> hints) {
- trustAnchorHints = hints;
- }
-
- /**
- * Get the array of Trust Marks.
- *
- * @return trust marks
- */
- @Nullable public List<Map<String, String>> getTrustMarks() {
- return trustMarks;
- }
-
- /**
- * Set the array of Trust Marks.
- *
- * @param marks trust marks
- */
- public void setTrustMarks(@Nullable List<Map<String, String>> marks) {
- trustMarks = marks;
- }
-
- /**
- * Get the map of arrays of Entity Identifiers that are trusted to represent the accreditation authority for Trust
- * Marks.
- *
- * @return trust mark issuers
- */
- @Nullable public Map<String, List<String>> getTrustMarkIssuers() {
- return trustMarkIssuers;
- }
-
- /**
- * Set the map of arrays of Entity Identifiers that are trusted to represent the accreditation authority for Trust
- * Marks.
- *
- * @param issuers trust mark issuers
- */
- public void setTrustMarkIssuers(@Nullable Map<String, List<String>> issuers) {
- trustMarkIssuers = issuers;
- }
-
- /**
- * Get the map of Owners of the Trust Marks.
- *
- * @return trust mark owners
- */
- @Nullable public Map<String, TrustMarkOwner> getTrustMarkOwners() {
- return trustMarkOwners;
- }
-
- /**
- * Set the map of Owners of the Trust Marks.
- *
- * @param owners trust mark owners
- */
- public void setTrustMarkOwners(@Nullable Map<String, TrustMarkOwner> owners) {
- trustMarkOwners = owners;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/EntityStatementPayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/EntityStatementPayloadImpl.java
deleted file mode 100644
index 8aa913d..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/EntityStatementPayloadImpl.java
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityStatementPayload;
-
-/**
- * Entity Statement payload claims as defined by the OpenID Federation 1.0 Section 3.1. These claims MUST or MAY appear
- * in both Entity Configurations and Subordinate Statements.
- */
-public class EntityStatementPayloadImpl extends BaseMetadataPayloadImpl implements EntityStatementPayload {
-
- /** A JSON Web Key Set representing the public part of the subject's Federation Entity signing keys. */
- @JsonProperty("jwks") private JWKSet jwkSet;
-
- /** The critical Claims that must be understood and processed. */
- @JsonProperty("crit") private List<String> critical;
-
- /**
- * Constructor.
- */
- public EntityStatementPayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public EntityStatementPayloadImpl(@Nonnull final EntityStatementPayload payload) {
- super(payload);
- setJwks(payload.getJwks());
- setCritical(payload.getCritical());
- }
-
- /**
- * Get the JWK set.
- *
- * @return JWK set
- */
- public JWKSet getJwks() {
- return jwkSet;
- }
-
- /**
- * Set the JWK set.
- *
- * @param jwks JWK set
- */
- public void setJwks(final JWKSet jwks) {
- jwkSet = jwks;
- }
-
- /**
- * Get the critical claims.
- *
- * @return critical claims
- */
- public List<String> getCritical() {
- return critical;
- }
-
- /**
- * Set the critical claims.
- *
- * @param crit critical claims
- */
- public void setCritical(final List<String> crit) {
- critical = crit;
- }
-
- /**
- * {@inheritDoc}
- */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("iss", getIssuer())
- .add("sub", getSubject())
- .add("iat", getIssuedAt())
- .add("exp", getExpiration())
- .add("jwks", jwkSet)
- .add("metadata", getMetadata())
- .add("crit", critical)
- .add("customClaims", getCustomClaims()).toString();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/ResolveEntityResponsePayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/ResolveEntityResponsePayloadImpl.java
deleted file mode 100644
index 653a839..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/ResolveEntityResponsePayloadImpl.java
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.ResolveEntityResponsePayload;
-
-/**
- * Resolve Entity response payload claims as defined by the OpenID Federation 1.0 Section 8.3.2.
- */
-public class ResolveEntityResponsePayloadImpl extends BaseMetadataPayloadImpl implements ResolveEntityResponsePayload {
-
- /** An array containing the sequence of Entity Statements that compose the Trust Chain. */
- @JsonProperty("trust_chain") private List<String> trustChain;
-
- /** An array of Trust Marks. */
- @JsonProperty("trust_marks") private List<Map<String,String>> trustMarks;
-
- /**
- * Constructor.
- */
- public ResolveEntityResponsePayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public ResolveEntityResponsePayloadImpl(@Nonnull final ResolveEntityResponsePayload payload) {
- super(payload);
- setTrustChain(payload.getTrustChain());
- setTrustMarks(payload.getTrustMarks());
- }
- /**
- * {@inheritDoc}
- */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("iss", getIssuer())
- .add("sub", getSubject())
- .add("iat", getIssuedAt())
- .add("exp", getExpiration())
- .add("metadata", getMetadata())
- .add("trust_chain", getTrustChain())
- .add("trust_marks", getTrustMarks())
- .add("customClaims", getCustomClaims()).toString();
- }
-
- /**
- * Get the array containing the sequence of Entity Statements that compose the Trust Chain.
- *
- * @return trust chain
- */
- @Nullable public List<String> getTrustChain() {
- return trustChain;
- }
-
- /**
- * Set the array containing the sequence of Entity Statements that compose the Trust Chain.
- *
- * @param chain trust chain
- */
- public void setTrustChain(final @Nullable List<String> chain) {
- trustChain = chain;
- }
-
- /**
- * Get the array of Trust Marks.
- *
- * @return trust marks
- */
- @Nullable public List<Map<String, String>> getTrustMarks() {
- return trustMarks;
- }
-
- /**
- * Set the array of Trust Marks.
- *
- * @param marks trust marks
- */
- public void setTrustMarks(@Nullable List<Map<String, String>> marks) {
- trustMarks = marks;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/SignedKeysetPayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/SignedKeysetPayloadImpl.java
deleted file mode 100644
index f18363d..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/SignedKeysetPayloadImpl.java
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-import com.nimbusds.jose.jwk.JWK;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.SignedKeysetPayload;
-
-/**
- * Signed keyset payload claims as defined by the OpenID Federation 1.0 Section 5.2.1.
- */
-public class SignedKeysetPayloadImpl extends BaseExpirableSubjectPayloadImpl implements SignedKeysetPayload {
-
- /** A JWK set. */
- @JsonProperty("keys") private List<JWK> keys;
-
- /**
- * Constructor.
- */
- public SignedKeysetPayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public SignedKeysetPayloadImpl(@Nonnull final SignedKeysetPayload payload) {
- super(payload);
- setKeys(payload.getKeys());
- }
-
- /**
- * Get the JWK set.
- *
- * @return JWK set
- */
- public List<JWK> getKeys() {
- return keys;
- }
-
- /**
- * Set the JWK set.
- *
- * @param jwks JWK set
- */
- public void setKeys(final List<JWK> jwks) {
- keys = jwks;
- }
-
- /**
- * {@inheritDoc}
- */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("iss", getIssuer())
- .add("sub", getSubject())
- .add("iat", getIssuedAt())
- .add("exp", getExpiration())
- .add("keys", keys)
- .add("customClaims", getCustomClaims()).toString();
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/SubordinateStatementPayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/SubordinateStatementPayloadImpl.java
deleted file mode 100644
index 708acf2..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/SubordinateStatementPayloadImpl.java
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.SubordinateStatementPayload;
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-
-/**
- * Subordinate Statement payload claims as defined by the OpenID Federation 1.0 Section 3.3. This class extends the
- * list of claims defined by {@link EntityStatementPayloadImpl} with the claims that MUST or MAY appear in Subordinate
- * Statements but not in Entity Configurations.
- */
-public class SubordinateStatementPayloadImpl extends EntityStatementPayloadImpl
- implements SubordinateStatementPayload {
-
- /** A map that defines Trust Chain constraints. */
- @JsonProperty("constraints") private Map<String, Object> constraints;
-
- /** A map that defines a metadata policy. */
- @JsonProperty("metadata_policy") private Map<String,Map<String,MetadataPolicy>> metadataPolicy;
-
- /** A list of critical metadata policy operators. */
- @JsonProperty("metadata_policy_crit") private List<String> metadataPolicyCritical;
-
- /** A string containing the fetch endpoint URL from which the entity statement was issued. */
- @JsonProperty("source_endpoint") private String sourceEndpoint;
-
- /**
- * Constructor.
- */
- public SubordinateStatementPayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public SubordinateStatementPayloadImpl(@Nonnull final SubordinateStatementPayload payload) {
- super(payload);
- setConstraints(payload.getConstraints());
- setMetadataPolicy(payload.getMetadataPolicy());
- setMetadataPolicyCritical(payload.getMetadataPolicyCritical());
- setSourceEndpoint(payload.getSourceEndpoint());
- }
-
- /**
- * {@inheritDoc}
- */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("iss", getIssuer())
- .add("sub", getSubject())
- .add("iat", getIssuedAt())
- .add("exp", getExpiration())
- .add("jwks", getJwks())
- .add("metadata", getMetadata())
- .add("crit", getCritical())
- .add("constraints", constraints)
- .add("metadata_policy", metadataPolicy)
- .add("metadata_policy_crit", metadataPolicyCritical)
- .add("source_endpoint", sourceEndpoint)
- .add("customClaims", getCustomClaims()).toString();
- }
-
- /**
- * Get the map that defines Trust Chain constraints.
- *
- * @return constraints
- */
- @Nullable public Map<String, Object> getConstraints() {
- return constraints;
- }
-
- /**
- * Set the map that defines Trust Chain constraints.
- *
- * @param map constraints
- */
- public void setConstraints(@Nullable final Map<String, Object> map) {
- constraints = map;
- }
-
- /**
- * Get the map that defines a metadata policy.
- *
- * @return metadata policy
- */
- @Nullable public Map<String, Map<String, MetadataPolicy>> getMetadataPolicy() {
- return metadataPolicy;
- }
-
- /**
- * Set the map that defines a metadata policy.
- *
- * @param map metadata policy
- */
- public void setMetadataPolicy(@Nullable final Map<String, Map<String, MetadataPolicy>> map) {
- metadataPolicy = map;
- }
-
- /**
- * Get the list of critical metadata policy operators.
- *
- * @return critical metadata policy operators
- */
- @Nullable public List<String> getMetadataPolicyCritical() {
- return metadataPolicyCritical;
- }
-
- /**
- * Set the list of critical metadata policy operators.
- *
- * @param operators critical metadata policy operators
- */
- public void setMetadataPolicyCritical(@Nullable final List<String> operators) {
- metadataPolicyCritical = operators;
- }
-
- /**
- * Get the fetch endpoint URL from which the entity statement was issued.
- *
- * @return fetch endpoint URL
- */
- @Nullable public String getSourceEndpoint() {
- return sourceEndpoint;
- }
-
- /**
- * Set the fetch endpoint URL from which the entity statement was issued.
- *
- * @param url endpoint URL
- */
- public void setSourceEndpoint(@Nullable final String url) {
- sourceEndpoint = url;
- }
-
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/TrustMarkPayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/TrustMarkPayloadImpl.java
deleted file mode 100644
index 1fa5fcd..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/TrustMarkPayloadImpl.java
+++ /dev/null
@@ -1,149 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.TrustMarkPayload;
-
-/**
- * Trust Mark payload claims as defined by the OpenID Federation 1.0 Section 7.1.
- */
-public class TrustMarkPayloadImpl extends BaseExpirableSubjectPayloadImpl implements TrustMarkPayload {
-
- /** An identifier of the type of the Trust Mark. */
- @JsonProperty("trust_mark_type") private String trustMarkType;
-
- /** A URL that references a logo for the issued Trust Mark. */
- @JsonProperty("logo_uri") private String logoUri;
-
- /** A URL referring to human-readable information about the issuance of the Trust Mark. */
- @JsonProperty("ref") private String reference;
-
- /** A Trust Mark delegation JWT. */
- @JsonProperty("delegation") private String delegation;
-
- /**
- * Constructor.
- */
- public TrustMarkPayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public TrustMarkPayloadImpl(@Nonnull final TrustMarkPayload payload) {
- super(payload);
- setTrustMarkType(payload.getTrustMarkType());
- setLogoUri(payload.getLogoUri());
- setReference(payload.getReference());
- setDelegation(payload.getDelegation());
- }
-
- /**
- * {@inheritDoc}
- */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("iss", getIssuer())
- .add("sub", getSubject())
- .add("iat", getIssuedAt())
- .add("exp", getExpiration())
- .add("trust_mark_type", trustMarkType)
- .add("logo_uri", logoUri)
- .add("ref", reference)
- .add("delegation", delegation)
- .add("customClaims", getCustomClaims()).toString();
- }
-
- /**
- * Get the identifier of the type of the Trust Mark.
- *
- * @return trust mark type
- */
- @Nullable public String getTrustMarkType() {
- return trustMarkType;
- }
-
- /**
- * Set the identifier of the type of the Trust Mark.
- *
- * @param type trust mark type
- */
- public void setTrustMarkType(@Nullable final String type) {
- trustMarkType = type;
- }
-
- /**
- * Get the URL that references a logo for the issued Trust Mark.
- *
- * @return logo URL
- */
- @Nullable public String getLogoUri() {
- return logoUri;
- }
-
- /**
- * Set the URL that references a logo for the issued Trust Mark.
- *
- * @param url logo URL
- */
- public void setLogoUri(@Nullable final String url) {
- logoUri = url;
- }
-
- /**
- * Get the URL referring to human-readable information about the issuance of the Trust Mark.
- *
- * @return reference URL
- */
- @Nullable public String getReference() {
- return reference;
- }
-
- /**
- * Set the URL referring to human-readable information about the issuance of the Trust Mark.
- *
- * @param ref reference URL
- */
- public void setReference(@Nullable final String ref) {
- reference = ref;
- }
-
- /**
- * Get the Trust Mark delegation JWT.
- *
- * @return delegation JWT
- */
- @Nullable public String getDelegation() {
- return delegation;
- }
-
- /**
- * Set the Trust Mark delegation JWT.
- *
- * @param jwt delegation JWT
- */
- public void setDelegation(@Nullable final String jwt) {
- delegation = jwt;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/TrustMarkStatusPayloadImpl.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/TrustMarkStatusPayloadImpl.java
deleted file mode 100644
index f379954..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/payload/impl/TrustMarkStatusPayloadImpl.java
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.MoreObjects;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.TrustMarkStatusPayload;
-
-/**
- * Trust Mark Status payload claims as defined by the OpenID Federation 1.0 Section 8.4.2.
- */
-public class TrustMarkStatusPayloadImpl extends BasePayloadImpl implements TrustMarkStatusPayload {
-
- /** A Trust Mark. */
- @JsonProperty("trust_mark") private String trustMark;
-
- /** A status indicator for the Trust Mark. */
- @JsonProperty("status") private String status;
-
- /**
- * Constructor.
- */
- public TrustMarkStatusPayloadImpl() {
- // no op
- }
-
- /**
- * Constructor.
- *
- * @param payload content
- */
- public TrustMarkStatusPayloadImpl(@Nonnull final TrustMarkStatusPayload payload) {
- super(payload);
- setTrustMark(payload.getTrustMark());
- setStatus(payload.getStatus());
- }
-
- /**
- * {@inheritDoc}
- */
- @Override public String toString() {
- return MoreObjects.toStringHelper(this)
- .add("iss", getIssuer())
- .add("iat", getIssuedAt())
- .add("trust_mark", trustMark)
- .add("status", status)
- .add("customClaims", getCustomClaims()).toString();
- }
-
- /**
- * Get the Trust Mark.
- *
- * @return trust mark
- */
- @Nullable public String getTrustMark() {
- return trustMark;
- }
-
- /**
- * Set the Trust Mark.
- *
- * @param mark trust mark
- */
- public void setTrustMark(@Nullable final String mark) {
- trustMark = mark;
- }
-
- /**
- * Get the status indicator for the Trust Mark.
- *
- * @return status
- */
- @Nullable public String getStatus() {
- return status;
- }
-
- /**
- * Set the status indicator for the Trust Mark.
- *
- * @param value status
- */
- public void setStatus(@Nullable final String value) {
- status = value;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/FederationMetadataPolicyDeserializer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/FederationMetadataPolicyDeserializer.java
deleted file mode 100644
index 4db5a65..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/FederationMetadataPolicyDeserializer.java
+++ /dev/null
@@ -1,159 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy;
-
-import java.io.IOException;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonParser;
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.DeserializationContext;
-import com.fasterxml.jackson.databind.JavaType;
-import com.fasterxml.jackson.databind.JsonDeserializer;
-import com.fasterxml.jackson.databind.type.MapType;
-import com.fasterxml.jackson.databind.type.TypeFactory;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default deserializer for the {@link MetadataPolicy} used within OpenID Federation. If the value for the "value"
- * -operator is explicitly set to null in JSON, this deserializer sets {@link MetadataPolicy#setValue(Object)} into
- * {@link Optional#empty()}.
- */
-public class FederationMetadataPolicyDeserializer extends JsonDeserializer<MetadataPolicy> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(FederationMetadataPolicyDeserializer.class);
-
- /** List of claim names who are transformed from a space-separated String into a List. */
- @Nonnull private final List<String> arraysAsSpaceSeparatedList;
-
- /**
- * Constructor.
- */
- public FederationMetadataPolicyDeserializer() {
- this("scope");
- }
-
- /**
- * Constructor.
- *
- * @param string comma-separated list of claim names who are transformed from a space-separated String into a List.
- */
- public FederationMetadataPolicyDeserializer(
- @Nonnull @ParameterName(name = "arraysAsSpaceSeparatedList") final String string) {
- final List<String> list = Arrays.asList(Constraint.isNotEmpty(string, "The string cannot be empty").split(","));
- assert list != null;
- arraysAsSpaceSeparatedList = list;
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull
- public MetadataPolicy deserialize(final JsonParser jsonParser, final DeserializationContext deserializationContext)
- throws IOException, JsonProcessingException {
- final MetadataPolicy policy = new MetadataPolicy();
- log.debug("Starting deseralize");
- final JavaType objectType = TypeFactory.defaultInstance().constructType(Object.class);
- final JavaType stringType = TypeFactory.defaultInstance().constructType(String.class);
- final MapType objectMapType =
- TypeFactory.defaultInstance().constructMapType(Map.class, stringType, objectType);
-
- final Map<String,Object> map = deserializationContext.readValue(jsonParser, objectMapType);
- final String claim = jsonParser.getParsingContext().getCurrentName();
- if (claim == null) {
- throw new IOException("Could not find the parent claim name for the metadata policy");
- }
- log.debug("Processing claim {}, value {}", claim, map);
-
- if (map != null) {
- log.debug("Processing map object {}", map);
- for (final String key : map.keySet().stream().filter(Objects::nonNull).toList()) {
- switch (key) {
- case "value":
- final Object value = FederationMetadataPolicyHelper.transformSpaceSeparatedStringIntoList(
- arraysAsSpaceSeparatedList, claim, map.get("value"));
- policy.setValue(value != null ? value : Optional.empty());
- break;
- case "add":
- policy.setAdd(FederationMetadataPolicyHelper.transformSpaceSeparatedStringIntoList(
- arraysAsSpaceSeparatedList, claim, map.get("add")));
- break;
- case "default":
- policy.setDefaultValue(FederationMetadataPolicyHelper.transformSpaceSeparatedStringIntoList(
- arraysAsSpaceSeparatedList, claim, map.get("default")));
- break;
- case "essential":
- policy.setEssential(map.get("essential") != null ?
- Boolean.valueOf(String.valueOf(map.get("essential"))).booleanValue() : false);
- break;
- case "one_of":
- policy.setOneOfValues(transformObjectIntoList("one_of",
- FederationMetadataPolicyHelper.transformSpaceSeparatedStringIntoList(
- arraysAsSpaceSeparatedList, claim, map.get("one_of"))));
- break;
- case "subset_of":
- policy.setSubsetOfValues(transformObjectIntoList("subset_of",
- FederationMetadataPolicyHelper.transformSpaceSeparatedStringIntoList(
- arraysAsSpaceSeparatedList, claim, map.get("subset_of"))));
- break;
- case "superset_of":
- policy.setSupersetOfValues(transformObjectIntoList("superset_of",
- FederationMetadataPolicyHelper.transformSpaceSeparatedStringIntoList(
- arraysAsSpaceSeparatedList, claim, map.get("superset_of"))));
- break;
- case "regexp":
- policy.setRegexp(map.get("regexp") == null ? null : "" + map.get("regexp"));
- break;
- default:
- policy.setCustomOperator(key, map.get(key));
- break;
- }
- }
- } else {
- log.debug("No map object could be parsed from the input, leaving the policy empty");
- }
- return policy;
- }
-
- /**
- * Transforms the given value into a list of objects.
- *
- * @param id the key for the map of objects
- * @param object the object value
- * @return the value for the key as list or null
- * @throws IOException if a non-null value could not be transformed into a list
- */
- @Nullable private List<Object> transformObjectIntoList(@Nonnull final String id,
- @Nullable final Object object) throws IOException {
- if (object instanceof List<?> list) {
- return list.stream().filter(Object.class::isInstance).map(Object.class::cast).toList();
- } else if (object != null) {
- throw new IOException("The value '" + object + "' for '" + id + "' is not a list");
- }
- return null;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/FederationMetadataPolicyHelper.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/FederationMetadataPolicyHelper.java
deleted file mode 100644
index 287e203..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/FederationMetadataPolicyHelper.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy;
-
-import java.util.List;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * Static utility method related to federation metadata policies.
- */
-public class FederationMetadataPolicyHelper {
-
- /**
- * Transforms a list into a space-separated string. Operation is done for non-null values if the given claim is
- * included in the given list of claims that are to be transformed.
- *
- * @param arraysAsSpaceSeparatedList the list of claim names to be transformed
- * @param claim the candidate claim
- * @param value the candidate claim value
- * @return the claim value transformed into a space-separated string if it met the requirements, or initial value
- * if not
- * @throws ConstraintViolationException if the non-null value to be transformed was not a list
- */
- @Nullable
- public static Object transformListIntoSpaceSeparatedString(@Nonnull final List<String> arraysAsSpaceSeparatedList,
- @Nonnull final String claim, @Nullable final Object value) throws ConstraintViolationException {
- if (arraysAsSpaceSeparatedList.contains(claim)) {
- if (value instanceof List<?> list) {
- return list.stream()
- .map(item -> String.valueOf(item))
- .collect(Collectors.joining(" "));
- } else if (value != null) {
- throw new ConstraintViolationException(
- "Unexpected value for claim " + claim + ": the value is not a List");
- }
- }
- return value;
- }
-
- /**
- * Transforms a space-separated string into a list. Operation is done for non-null values if the given claim is
- * included in the given list of claims that are to be transformed.
- *
- * @param arraysAsSpaceSeparatedList the list of claim names to be transformed
- * @param claim the candidate claim
- * @param value the candidate claim value
- * @return the claim value transformed into a list if it met the requirements, or initial value
- * @throws ConstraintViolationException if the non-null value to be transformed was not a string
- */
- @Nullable
- public static Object transformSpaceSeparatedStringIntoList(@Nonnull final List<String> arraysAsSpaceSeparatedList,
- @Nonnull final String claim, @Nullable final Object value) throws ConstraintViolationException {
- if (arraysAsSpaceSeparatedList.contains(claim)) {
- if (value instanceof String string) {
- return List.of(string.split(" "));
- } else if (value != null) {
- throw new ConstraintViolationException(
- "Unexpected value for claim " + claim + ": the value is not a String");
- }
- }
- return value;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/FederationMetadataPolicyOperator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/FederationMetadataPolicyOperator.java
deleted file mode 100644
index dbfd708..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/FederationMetadataPolicyOperator.java
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * Interface to be implemented by the federation metadata policy operators.
- *
- * TODO: once moved to commons, merge with net.shibboleth.oidc.metadata.policy.impl.CustomMetadataPolicyOperator
- */
-public interface FederationMetadataPolicyOperator {
-
- /**
- * The unique case-sensitive name of this operator.
- *
- * @return the operator name.
- */
- @Nonnull @NotEmpty public String getOperatorName();
-
- /**
- * Validate whether the operator is compatible with the other operators in the policy.
- *
- * @param policy The metadata policy to be used by the custom policy operator.
- * @return true if the policy is valid for this operator, false otherwise.
- */
- public boolean validate(@Nonnull final MetadataPolicy policy);
-
- /**
- * Apply the operator for the given input that has the given metadata policy attached.
- *
- * @param inputValue The value to be used by the custom policy operator.
- * @param policy The metadata policy to be used by the custom policy operator.
- * @return The value returned by the custom policy operator.
- * @throws ConstraintViolationException If the value-check of the custom operator fails.
- */
- @Nullable public Object apply(@Nullable final Object inputValue, @Nonnull final MetadataPolicy policy)
- throws ConstraintViolationException;
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/AbstractFederationMetadataPolicyOperator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/AbstractFederationMetadataPolicyOperator.java
deleted file mode 100644
index 926edbb..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/AbstractFederationMetadataPolicyOperator.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyOperator;
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * Base implementation for the classes implementing {@link FederationMetadataPolicyOperator}.
- */
-public abstract class AbstractFederationMetadataPolicyOperator extends AbstractIdentifiableInitializableComponent
- implements FederationMetadataPolicyOperator {
-
- /** {@inheritDoc} */
- @Override
- public boolean validate(@Nonnull final MetadataPolicy policy) {
- return true;
- }
-
- /**
- * Parses a list from the given object.
- *
- * @param object the object to be parsed
- * @return a list of it couöd be parsed from the object, or null if input was null
- * @throws ConstraintViolationException thrown if non-null input value was not a list
- */
- @Nullable protected static List<Object> parseList(@Nullable final Object object)
- throws ConstraintViolationException {
- if (object instanceof List<?> list) {
- return list.stream().filter(Object.class::isInstance).map(Object.class::cast).toList();
- } else if (object != null) {
- throw new ConstraintViolationException("Could not parse list from the given object");
- }
- return null;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyAddOperator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyAddOperator.java
deleted file mode 100644
index 0995e74..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyAddOperator.java
+++ /dev/null
@@ -1,115 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import java.util.Collection;
-import java.util.List;
-import java.util.stream.Stream;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.oidc.metadata.policy.impl.MetadataPolicyHelper;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default implementation for the 'add'-operator.
- */
-public class DefaultFederationMetadataPolicyAddOperator extends AbstractFederationMetadataPolicyOperator {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultFederationMetadataPolicyAddOperator.class);
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getOperatorName() {
- return "add";
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Object apply(@Nullable final Object candidate, @Nonnull final MetadataPolicy policy)
- throws ConstraintViolationException {
- final List<Object> add = parseList(policy.getAdd());
- if (add != null) {
- if (candidate instanceof List<?> list) {
- log.debug("Combining candidate {} and add {}", list, add);
- return buildResult(Stream.concat(list.stream(), add.stream()));
- } else if (candidate == null) {
- log.debug("Returning the contents of the add operator: {}", add);
- return buildResult(add.stream());
- } else {
- log.debug("Candidate value {} is not a list/array", candidate);
- throw new ConstraintViolationException("Candidate " + candidate + " is not a list/array");
- }
- }
- return candidate;
- }
-
- /**
- * Builds a list from the given stream.
- *
- * @param stream the stream
- * @return the list
- */
- @Nonnull protected List<Object> buildResult(final Stream<?> stream) {
- final List<Object> result = stream
- .filter(Object.class::isInstance)
- .map(Object.class::cast)
- .distinct()
- .toList();
- assert result != null;
- return CollectionSupport.copyToList(result);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean validate(@Nonnull final MetadataPolicy policy) {
- final List<Object> add;
- try {
- add = parseList(policy.getAdd());
- } catch (final ConstraintViolationException e) {
- log.warn("The value for add operator {} is not a list/array", policy.getAdd());
- return false;
- }
- if (add == null || add.isEmpty()) {
- return true;
- }
- boolean validation = true;
- final Object value = policy.getValue();
- if (value instanceof Collection<?> valueCollection) {
- if (!MetadataPolicyHelper.isSubsetOfValues(add, valueCollection)) {
- log.debug("The value for add operator {} is not a subset of value {}", add, valueCollection);
- validation = false;
- }
- } else if (value != null) {
- log.warn("The value {} is not a list/array", value);
- validation = false;
- }
- final List<Object> subsetOf = policy.getSubsetOfValues();
- if (subsetOf != null && !MetadataPolicyHelper.isSubsetOfValues(add, subsetOf)) {
- log.debug("The value for add operator {} is not a subset of value for the subset_of operator {}", add,
- subsetOf);
- validation = false;
- }
- return validation;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyDefaultOperator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyDefaultOperator.java
deleted file mode 100644
index f0ebe6b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyDefaultOperator.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * Default implementation for the 'default' -operator.
- */
-public class DefaultFederationMetadataPolicyDefaultOperator extends AbstractFederationMetadataPolicyOperator {
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getOperatorName() {
- return "default";
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Object apply(@Nullable final Object candidate, @Nonnull final MetadataPolicy policy)
- throws ConstraintViolationException {
- if (candidate != null) {
- return candidate;
- }
- final Object defaultValue = policy.getDefaultValue();
- return defaultValue != null ? defaultValue : candidate;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEnforcer.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEnforcer.java
deleted file mode 100644
index 8bbeda6..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEnforcer.java
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import java.util.List;
-import java.util.Optional;
-import java.util.function.BiFunction;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyOperator;
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.collection.Pair;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * <p>A function that applies the given {@link MetadataPolicy} to the given object. The input is given as a {@link
- * Pair} of the object and the policy. The policy is applied to the incoming object as specified in the OpenID
- * Federation specification 1.0 (draft 42 / April 2025)</p>
- *
- * <p>In addition to the standard operators, we also support regular expression validation.</p>
- *
- * <p>The function returns a {@link Pair} of the object for which the value modifiers of the metadata policy have
- * been applied to, and a flag indicating if the object was compatible with the value checks of the metadata policy.
- * </p>
- */
-public class DefaultFederationMetadataPolicyEnforcer extends AbstractIdentifiableInitializableComponent
- implements BiFunction<Object,MetadataPolicy,Pair<Object,Boolean>> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultFederationMetadataPolicyEnforcer.class);
-
- /** The list of metadata policy operators used for enforcing the metadata policy. */
- @NonnullAfterInit List<FederationMetadataPolicyOperator> operators;
-
- /**
- * Set the list of metadata policy operators used for enforcing the metadata policy.
- *
- * @param policyOperators What to set
- */
- public void setMetadataPolicyOperators(@Nonnull final List<FederationMetadataPolicyOperator> policyOperators) {
- checkSetterPreconditions();
- operators = Constraint.isNotNull(policyOperators, "List of metadata policy operators cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override @Nullable public Pair<Object, Boolean> apply(@Nullable final Object candidate,
- @Nullable final MetadataPolicy policy) {
- if (policy == null) {
- return new Pair<>(candidate, Boolean.TRUE);
- }
- Object operatorResult = candidate;
- for (final FederationMetadataPolicyOperator operator : operators) {
- try {
- operatorResult = operator.apply(operatorResult, policy);
- } catch (final ConstraintViolationException e) {
- log.debug("Operator {} returned a non-success result", operator.getClass());
- return new Pair<>(operatorResult, Boolean.FALSE);
- }
- }
- return new Pair<>(operatorResult, Boolean.TRUE);
- }
-
- /**
- * Checks if the given result of metadata policy operator is a success result.
- *
- * @param result operator result to be verified
- * @return true if success, false otherwise (including null)
- */
- protected boolean isSuccessResult(@Nullable final Pair<Object,Boolean> result) {
- return Optional.ofNullable(result)
- .map(pair -> pair.getSecond())
- .map(second -> second.booleanValue())
- .orElse(false);
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEssentialOperator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEssentialOperator.java
deleted file mode 100644
index 3167a63..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEssentialOperator.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-
-/**
- * Default implementation for the 'essential' -operator.
- */
-public class DefaultFederationMetadataPolicyEssentialOperator extends AbstractFederationMetadataPolicyOperator {
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getOperatorName() {
- return "essential";
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Object apply(@Nullable final Object candidate, @Nonnull final MetadataPolicy policy)
- throws ConstraintViolationException {
- if (candidate != null) {
- return candidate;
- }
- if (policy.isEssential()) {
- throw new ConstraintViolationException("Essential value is missing");
- }
- return candidate;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyMergingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyMergingStrategy.java
deleted file mode 100644
index 1fb28ca..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyMergingStrategy.java
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.BiFunction;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyOperator;
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.oidc.metadata.policy.impl.MetadataPolicyHelper;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.collection.Pair;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * A function that merges two maps of metadata policies according to the rules specified in the OID federation spec
- * (draft 42), section 6.1. The function returns a pair of map of merged metadata policies and a boolean indicating if
- * the merging operators in the policies were compliant.
- */
-public class DefaultFederationMetadataPolicyMergingStrategy extends AbstractIdentifiableInitializableComponent
- implements BiFunction<Map<String, MetadataPolicy>, Map<String, MetadataPolicy>,
- Pair<Map<String, MetadataPolicy>, Boolean>> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultFederationMetadataPolicyMergingStrategy.class);
-
- /** The list of metadata policy operators used for enforcing the metadata policy. */
- @NonnullAfterInit List<FederationMetadataPolicyOperator> operators;
-
- /**
- * Set the list of metadata policy operators used for enforcing the metadata policy.
- *
- * @param policyOperators What to set
- */
- public void setMetadataPolicyOperators(@Nonnull final List<FederationMetadataPolicyOperator> policyOperators) {
- checkSetterPreconditions();
- operators = Constraint.isNotNull(policyOperators, "List of metadata policy operators cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull
- public Pair<Map<String, MetadataPolicy>, Boolean> apply(@Nullable final Map<String,MetadataPolicy> first,
- @Nullable final Map<String,MetadataPolicy> second) {
- if (first == null || first.isEmpty()) {
- return new Pair<>(second == null ? (first == null ? null : Collections.emptyMap()) : second , Boolean.TRUE);
- } else if (second == null || second.isEmpty()) {
- return new Pair<>(first, Boolean.TRUE);
- }
- final Set<String> combinedKeys = Stream.concat(first.keySet().stream(),
- second.keySet().stream()).collect(Collectors.toSet());
- final Map<String, MetadataPolicy> result = new HashMap<>();
- boolean valid = true;
- for (final String key : combinedKeys) {
- try {
- final MetadataPolicy merged =
- MetadataPolicyHelper.mergeMetadataPolicies(first.get(key), second.get(key));
- log.debug("Merging result of {} with {}: {}", first.get(key), second.get(key), merged);
- if (merged != null && merged.getOneOfValues() != null && merged.getOneOfValues().isEmpty()) {
- log.warn("Value of 'one_of' operator is empty after merging");
- valid = false;
- }
- result.put(key, merged);
- for (final FederationMetadataPolicyOperator operator : operators) {
- if (merged != null && !operator.validate(merged)) {
- valid = false;
- }
- }
- } catch (final ConstraintViolationException e) {
- log.warn("Incompatible metadata policies for claim '{}' that cannot be merged.", key);
- valid = false;
- }
- }
- return new Pair<>(result, Boolean.valueOf(valid));
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyOneOfOperator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyOneOfOperator.java
deleted file mode 100644
index 5165e0b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyOneOfOperator.java
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default implementation for the 'one_of' -operator.
- */
-public class DefaultFederationMetadataPolicyOneOfOperator extends AbstractFederationMetadataPolicyOperator {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultFederationMetadataPolicyOneOfOperator.class);
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getOperatorName() {
- return "one_of";
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Object apply(@Nullable final Object candidate, @Nonnull final MetadataPolicy policy)
- throws ConstraintViolationException {
- final List<Object> oneOf = policy.getOneOfValues();
- if (candidate == null || oneOf == null) {
- log.debug("No candidate or one_of value present. nothing to do");
- return candidate;
- }
- if (!oneOf.contains(candidate)) {
- throw new ConstraintViolationException(
- "The candidate " + candidate + " is not included in the values for one_of: " + oneOf);
- }
- return candidate;
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean validate(@Nonnull final MetadataPolicy policy) {
- final List<Object> oneOf = policy.getOneOfValues();
- if (oneOf == null) {
- return true;
- }
- final Object value = policy.getValue();
- if (value != null && !oneOf.contains(value)) {
- log.debug("The value {} is not included in the values for one_of: {}", value, oneOf);
- return false;
- }
- return true;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicySubsetOfOperator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicySubsetOfOperator.java
deleted file mode 100644
index 1668048..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicySubsetOfOperator.java
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.oidc.metadata.policy.impl.MetadataPolicyHelper;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default implementation for the 'subset_of' -operator.
- */
-public class DefaultFederationMetadataPolicySubsetOfOperator extends AbstractFederationMetadataPolicyOperator {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultFederationMetadataPolicySubsetOfOperator.class);
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getOperatorName() {
- return "subset_of";
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Object apply(@Nullable final Object candidate, @Nonnull final MetadataPolicy policy)
- throws ConstraintViolationException {
- final List<Object> subsetOf = policy.getSubsetOfValues();
- if (candidate == null || subsetOf == null) {
- log.debug("No candidate or subset_of value present. nothing to do");
- return candidate;
- }
- if (candidate instanceof List<?> list) {
- final List<Object> candidateList = list.stream()
- .filter(Object.class::isInstance)
- .map(Object.class::cast)
- .filter(item -> subsetOf.contains(item))
- .toList();
- assert candidateList != null;
- return CollectionSupport.copyToList(candidateList);
- }
- log.debug("Candidate value {} is not a list/array", candidate);
- throw new ConstraintViolationException("Candidate value " + candidate + " is not a list/array");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean validate(@Nonnull final MetadataPolicy policy) {
- final List<Object> subsetOf = policy.getSubsetOfValues();
- if (subsetOf == null) {
- return true;
- }
- boolean validation = true;
- final Object value = policy.getValue();
- if (value != null && !MetadataPolicyHelper.isSubsetOfValues(value, subsetOf)) {
- log.debug("The value {} is not a subset of the values for subset_of operator {}", value, subsetOf);
- validation = false;
- }
- final Object add = policy.getAdd();
- if (add != null && !MetadataPolicyHelper.isSubsetOfValues(add, subsetOf)) {
- log.debug("The value for add operator {} is not a subset of the values for subset_of operator {}", add,
- subsetOf);
- validation = false;
- }
- final List<Object> supersetOf = policy.getSupersetOfValues();
- if (supersetOf != null && !MetadataPolicyHelper.isSupersetOfValues(subsetOf, supersetOf)) {
- log.debug("The value for subset_of operator {} is not a subset of the values for superset_of operator {}",
- subsetOf, supersetOf);
- validation = false;
- }
- return validation;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicySupersetOfOperator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicySupersetOfOperator.java
deleted file mode 100644
index fae223e..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicySupersetOfOperator.java
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.oidc.metadata.policy.impl.MetadataPolicyHelper;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default implementation for the 'superset_of' -operator.
- */
-public class DefaultFederationMetadataPolicySupersetOfOperator extends AbstractFederationMetadataPolicyOperator {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultFederationMetadataPolicySupersetOfOperator.class);
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getOperatorName() {
- return "superset_of";
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Object apply(@Nullable final Object candidate, @Nonnull final MetadataPolicy policy)
- throws ConstraintViolationException {
- final List<Object> supersetOf = policy.getSupersetOfValues();
- if (candidate == null || supersetOf == null) {
- return candidate;
- }
- final List<Object> candidateList;
- if (candidate instanceof List<?> list) {
- candidateList = list.stream().filter(Object.class::isInstance).map(Object.class::cast).toList();
- } else {
- log.warn("The value for superset_of is not a list/array {}", candidate);
- throw new ConstraintViolationException("Candidate value " + candidate + " is not a list/array");
- }
- assert candidateList != null;
-
- if (!candidateList.containsAll(supersetOf)) {
- log.debug("The candidate {} did not contain all the values of superset_of: {}", candidate, supersetOf);
- throw new ConstraintViolationException(
- "Candidate value " + candidate + " did not contain all values of superset_of: " + supersetOf);
- }
-
- return CollectionSupport.copyToList(candidateList);
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean validate(@Nonnull final MetadataPolicy policy) {
- final List<Object> supersetOf = policy.getSupersetOfValues();
- if (supersetOf == null) {
- return true;
- }
-
- boolean validation = true;
- final Object value = policy.getValue();
- if (value != null && !MetadataPolicyHelper.isSupersetOfValues(value, supersetOf)) {
- log.debug("The value {} is not a superset of the values for subset_of operator {}", value, supersetOf);
- validation = false;
- }
- final List<Object> subsetOf = policy.getSubsetOfValues();
- if (subsetOf != null && !MetadataPolicyHelper.isSupersetOfValues(subsetOf, supersetOf)) {
- log.debug("The value for subset_of operator {} is not a superset of the values for superset_of operator {}",
- subsetOf, supersetOf);
- validation = false;
- }
- return validation;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyValueOperator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyValueOperator.java
deleted file mode 100644
index 6fdaefb..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyValueOperator.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl;
-
-import java.util.List;
-import java.util.Optional;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.oidc.metadata.policy.impl.MetadataPolicyHelper;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default implementation for the 'value' -operator.
- */
-public class DefaultFederationMetadataPolicyValueOperator extends AbstractFederationMetadataPolicyOperator {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultFederationMetadataPolicyValueOperator.class);
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getOperatorName() {
- return "value";
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Object apply(@Nullable final Object candidate, @Nonnull final MetadataPolicy policy)
- throws ConstraintViolationException {
- final Object value = policy.getValue();
- return value != null ?value instanceof Optional optional && optional.isEmpty() ? null : value : candidate;
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean validate(@Nonnull final MetadataPolicy policy) {
- final Object value = policy.getValue();
- if (value instanceof Optional optional && optional.isEmpty()) {
- if (policy.isEssential()) {
- log.debug("Value for the value operator is null and essential is true");
- return false;
- }
- if (policy.getDefaultValue() != null) {
- log.debug("Null value cannot be combined with non-empty default: {}", policy.getDefaultValue());
- return false;
- }
- log.debug("Value for the value operator is null and essential is false");
- return true;
- } else if (value == null) {
- return true;
- }
- boolean validation = true;
- final List<Object> oneOf = policy.getOneOfValues();
- if (oneOf != null && !oneOf.contains(value)) {
- log.debug("Value {} is not included in the one_of values {}", value, oneOf);
- validation = false;
- }
- final List<Object> subsetOf = policy.getSubsetOfValues();
- if (subsetOf != null && !MetadataPolicyHelper.isSubsetOfValues(value, subsetOf)) {
- log.debug("Value {} is not included in the of subset_of values {}", value, subsetOf);
- validation = false;
- }
- final List<Object> supersetOf = policy.getSupersetOfValues();
- if (supersetOf != null && !MetadataPolicyHelper.isSupersetOfValues(value, supersetOf)) {
- log.debug("Value {} is not included in the of superset_of values {}", value, supersetOf);
- validation = false;
- }
- return validation;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java
deleted file mode 100644
index 1f2fc19..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/util/EntityStatementHelper.java
+++ /dev/null
@@ -1,203 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util;
-
-import java.text.ParseException;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.List;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.EntityConfigurationImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.SubordinateStatementImpl;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Static utility method related to entity statements.
- */
-public class EntityStatementHelper {
-
- /** Class logger. */
- @Nonnull private final static Logger log = LoggerFactory.getLogger(EntityStatementHelper.class);
-
- /**
- * Serialize the given trust chain into a comma-separated list of strings.
- *
- * @param trustChain input trust chain
- * @return serialized trust chain
- */
- @Nullable
- public static String getSerializedTrustChain(@Nullable final List<EntityStatement<?>> trustChain) {
- return trustChain == null ? null :
- String.join(",", trustChain.stream().map(es -> es.getJwt().serialize()).toList());
- }
-
- /**
- * Serialize the given entity statement into a string.
- *
- * @param entityStatement input entity statement
- * @return serialized entity statement
- */
- @Nullable
- public static String getSerializedEntityStatement(@Nullable final EntityStatement<?> entityStatement) {
- return entityStatement == null ? null : entityStatement.getJwt().serialize();
- }
-
- /**
- * Get the list of entity IDs of the entities in the given trust chain. The first item is the entity ID of the
- * leaf entity.
- *
- * @param trustChain trust chain
- * @return list of entity IDs
- */
- @Nonnull public static List<String> getEntityIds(@Nonnull final List<EntityStatement<?>> trustChain) {
- final List<String> result = trustChain.subList(1, trustChain.size()).stream()
- .filter(Objects::nonNull)
- .map(statement -> statement.getSubject())
- .toList();
- assert result != null;
- return result;
- }
-
- /**
- * Checks if the given subject already exists in the trust chain.
- *
- * @param subject subject to be looked after
- * @param trustChain trust chain
- * @return true if subject already exists in the trust chain, false otherwise
- */
- public static boolean subjectAlreadyExists(@Nullable final String subject,
- @Nonnull final List<EntityStatement<?>> trustChain) {
- return subject == null ? false : trustChain.stream()
- .filter(Objects::nonNull)
- .map(statement -> statement.getSubject())
- .anyMatch(id -> subject.equals(id));
- }
-
- /**
- * Deserialize the given list of strings into a list of entity statements. The method also verifies that the
- * trust chain syntax is correct: it contains three or more items, it begins and ends with an entity configuration,
- * other items being subordinate statements.
- *
- * @param chain serialized trust chain
- * @param objectMapper object mapper used for deserializing the statement payloads
- * @return list of entity statements, or null if the input was invalid
- */
- @Nullable public static List<EntityStatement<?>> deserializeTrustChain(
- @Nonnull @NonnullElements final List<String> chain, @Nonnull final ObjectMapper objectMapper) {
- if (chain.size() < 3) {
- log.warn("Invalid trust chain: shorter than three items");
- return null;
- }
- final List<EntityStatement<?>> result = new ArrayList<>();
- for (final String entry : chain) {
- try {
- assert entry != null;
- result.add(parseEntityStatement(entry, objectMapper));
- } catch (final ConstraintViolationException e) {
- log.warn("Could not deserialize the given trust chain", e);
- return null;
- }
- }
- if (!(result.get(0) instanceof EntityConfiguration)) {
- log.warn("Trust chain does not begin with an entity configuration");
- return null;
- }
- for (int i = 1; i < result.size() - 1; i++) {
- if (!(result.get(i) instanceof SubordinateStatement)) {
- log.warn("Trust chain entry {} is not a subordinate statement", i);
- return null;
- }
- }
- if (!(result.get(result.size() - 1) instanceof EntityConfiguration)) {
- log.warn("Trust chain does not end with an entity configuration");
- return null;
- }
- return result;
- }
-
- /**
- * Parse an entity statement from the given input. If the subject and issuer matches in the payload, an entity
- * configuration is returned. Otherwise, a subordinate statement is returned.
- *
- * @param input serialized entity statement
- * @param objectMapper object mapper used for deserializing the statement payload
- * @return entity configuration or subordinate statement, edpending on the content
- * @throws ConstraintViolationException if input was invalid
- */
- @Nonnull public static EntityStatement<?> parseEntityStatement(@Nonnull final String input,
- @Nonnull final ObjectMapper objectMapper) throws ConstraintViolationException {
- final SignedJWT jwt;
- final JWTClaimsSet claimsSet;
- try {
- jwt = SignedJWT.parse(input);
- assert jwt != null;
- claimsSet = jwt.getJWTClaimsSet();
- } catch (final ParseException e) {
- log.warn("Could not construct a JWT from the entity statement", e);
- throw new ConstraintViolationException(e.getMessage());
- }
- assert objectMapper != null;
- final String subject = claimsSet.getSubject();
- if (subject == null) {
- throw new ConstraintViolationException("Subject is null");
- }
- final String issuer = claimsSet.getIssuer();
- if (issuer == null) {
- throw new ConstraintViolationException("Issuer is null");
- }
- try {
- if (subject.equals(issuer)) {
- return EntityConfigurationImpl.parse(jwt, objectMapper);
- } else {
- return SubordinateStatementImpl.parse(jwt, objectMapper);
- }
- } catch (final JsonProcessingException e) {
- log.debug("Could not parse the entity statement " + subject + ", issued by " + issuer, e);
- throw new ConstraintViolationException(e.getMessage());
- }
- }
-
- /**
- * Parse the expiration time from the trust chain: the lowest expiration time value is taken from the chain.
- *
- * @param trustChain trust chain
- * @return expiration instant
- */
- @Nonnull public static Instant parseTrustChainExpiration(@Nonnull final List<EntityStatement<?>> trustChain) {
- final Instant result = trustChain.stream()
- .map(statement -> statement.getParsedPayload().getExpiration())
- .min(Comparator.comparing(Instant::toEpochMilli))
- .orElse(Instant.now());
- assert result != null;
- return result;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/AbstractOIDFederationRegistrationProfileConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/AbstractOIDFederationRegistrationProfileConfiguration.java
deleted file mode 100644
index 2ac713e..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/AbstractOIDFederationRegistrationProfileConfiguration.java
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl;
-
-import java.time.Duration;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationRegistrationProfileConfiguration;
-import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
-import net.shibboleth.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Positive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-
-/**
- * Abstract implementation class for profile configurations related OpenID Federation client registration.
- */
-public class AbstractOIDFederationRegistrationProfileConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDFederationRegistrationProfileConfiguration {
-
- /** Lookup function to local metadata policy to be merged into the federation policy. */
- @Nonnull private Function<ProfileRequestContext,Map<String, MetadataPolicy>> localMetadataPolicyLookupStrategy;
-
- /** Lookup function to mandatory trust marks. */
- @Nonnull private Function<ProfileRequestContext,List<String>> mandatoryTrustMarksLookupStrategy;
-
- /** Lookup function to supply maximum trust mark lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> maximumTrustMarkLifetimeLookupStrategy;
-
- /** Whether trust marks should be remotely validated. */
- @Nonnull private Predicate<ProfileRequestContext> remoteTrustMarkValidationCondition;
-
- /**
- * Constructor.
- *
- * @param id ID of the communication profile, never null or empty
- */
- public AbstractOIDFederationRegistrationProfileConfiguration(
- @Nonnull @NotEmpty @ParameterName(name="id") final String id) {
- super(id);
- localMetadataPolicyLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyMap());
- mandatoryTrustMarksLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
- maximumTrustMarkLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofDays(365));
- remoteTrustMarkValidationCondition = PredicateSupport.alwaysTrue();
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull @NonnullElements @NotLive @Unmodifiable
- public Map<String, MetadataPolicy> getLocalMetadataPolicy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Map<String, MetadataPolicy> policy = localMetadataPolicyLookupStrategy.apply(profileRequestContext);
- if (policy != null) {
- return CollectionSupport.copyToMap(policy);
- }
- return CollectionSupport.emptyMap();
- }
-
- /**
- * Set local metadata policy to be merged into the federation policy.
- *
- * @param policy metadata policy
- */
- public void setLocalMetadataPolicy(
- @Nonnull @NonnullElements @NotLive @Unmodifiable final Map<String, MetadataPolicy> policy) {
- localMetadataPolicyLookupStrategy = FunctionSupport.constant(policy);
- }
-
- /**
- * Sets lookup strategy for local metadata policy to be merged into the federation policy.
- *
- * @param strategy lookup strategy
- */
- public void setLocalMetadataPolicyLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Map<String, MetadataPolicy>> strategy) {
- localMetadataPolicyLookupStrategy =
- Constraint.isNotNull(strategy, "Local metadata policy lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull @NonnullElements @NotLive @Unmodifiable
- public List<String> getMandatoryTrustMarks(@Nullable final ProfileRequestContext profileRequestContext) {
- final List<String> trustMarks = mandatoryTrustMarksLookupStrategy.apply(profileRequestContext);
- if (trustMarks != null) {
- return CollectionSupport.copyToList(trustMarks);
- }
- return CollectionSupport.emptyList();
- }
-
- /**
- * Set mandatory trust marks.
- *
- * @param marks trust marks
- */
- public void setMandatoryTrustMarks(@Nonnull @NonnullElements @NotLive @Unmodifiable final List<String> marks) {
- mandatoryTrustMarksLookupStrategy = FunctionSupport.constant(marks);
- }
-
- /**
- * Sets lookup strategy for mandatory trust marks value.
- *
- * @param strategy lookup strategy
- */
- public void setMandatoryTrustMarksLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
- mandatoryTrustMarksLookupStrategy =
- Constraint.isNotNull(strategy, "Mandatory trust marks lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull
- public Duration getMaximumTrustMarkLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = maximumTrustMarkLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Maximum trust mark lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the maximum lifetime of a trust mark.
- *
- * @param lifetime lifetime of a trust mark
- */
- public void setMaximumTrustMarkLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration trustMarkLifetime = Constraint.isNotNull(lifetime, "Maximum trust mark lifetime cannot be null");
- Constraint.isTrue(!trustMarkLifetime.isZero() && !trustMarkLifetime.isNegative(),
- "Maximum trust mark lifetime must be greater than 0");
-
- maximumTrustMarkLifetimeLookupStrategy = FunctionSupport.constant(trustMarkLifetime);
- }
-
- /**
- * Set a lookup strategy for the maximum trust mark lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setMaximumTrustMarkLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- maximumTrustMarkLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isRemoteTrustMarkValidation(@Nullable final ProfileRequestContext profileRequestContext) {
- return remoteTrustMarkValidationCondition.test(profileRequestContext);
- }
-
- /**
- * Set whether trust marks should be remotely validated.
- *
- * @param flag flag to set
- */
- public void setRemoteTrustMarkValidation(final boolean flag) {
- remoteTrustMarkValidationCondition = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition for whether trust marks should be remotely validated.
- *
- * @param condition condition to set
- */
- public void setRemoteTrustMarkValidationPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- remoteTrustMarkValidationCondition = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/AbstractOIDFederationResponseCachingProfileConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/AbstractOIDFederationResponseCachingProfileConfiguration.java
deleted file mode 100644
index 2ec0896..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/AbstractOIDFederationResponseCachingProfileConfiguration.java
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl;
-
-import java.time.Duration;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationResponseCachingProfileConfiguration;
-import net.shibboleth.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.Positive;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-
-/**
- * Abstract implementation class for profile configurations related OpenID Federation response caching configuration.
- */
-public abstract class AbstractOIDFederationResponseCachingProfileConfiguration
- extends AbstractConditionalProfileConfiguration
- implements OIDFederationResponseCachingProfileConfiguration {
-
- /** Lookup function to supply cached success response lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> cachedSuccessResponseLifetimeLookupStrategy;
-
- /**
- * Constructor.
- *
- * @param id ID of the communication profile, never null or empty
- */
- public AbstractOIDFederationResponseCachingProfileConfiguration(
- @Nonnull @NotEmpty @ParameterName(name="id") final String id) {
- super(id);
- cachedSuccessResponseLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull
- public Duration getCachedSuccessResponseLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = cachedSuccessResponseLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Success response lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of a cached success response.
- *
- * @param lifetime lifetime of a cached success response
- */
- public void setCachedSuccessResponseLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration successLifetime = Constraint.isNotNull(lifetime,
- "Cached success response lifetime cannot be null");
- Constraint.isTrue(!successLifetime.isZero() && !successLifetime.isNegative(),
- "Cached success response lifetime must be greater than 0");
-
- cachedSuccessResponseLifetimeLookupStrategy = FunctionSupport.constant(successLifetime);
- }
-
- /**
- * Set a lookup strategy for the cached success response lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setCachedSuccessResponseLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- cachedSuccessResponseLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationAutomaticRegistrationProfileConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationAutomaticRegistrationProfileConfiguration.java
deleted file mode 100644
index 533b00f..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationAutomaticRegistrationProfileConfiguration.java
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationAutomaticRegistrationProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/**
- * Implementation of a profile configuration for the OpenID Federation Automatic Registration.
- */
-public class DefaultOIDFederationAutomaticRegistrationProfileConfiguration
- extends AbstractOIDFederationRegistrationProfileConfiguration
- implements OIDFederationAutomaticRegistrationProfileConfiguration {
-
- /** OIDC provider information profile counter name. */
- @Nonnull @NotEmpty
- public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.oidfed.automaticregistration";
-
- /** Lookup function to supply claims set decoration type. */
- @Nonnull private Function<ProfileRequestContext,String> claimsSetDecorationTypeLookupStrategy;
-
- /** Lookup function to supply claims set decoration type for clients with request-provided trust chains. */
- @Nonnull private Function<ProfileRequestContext,String> providedChainClaimsSetDecorationTypeLookupStrategy;
-
- /**
- * Constructor.
- */
- public DefaultOIDFederationAutomaticRegistrationProfileConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public DefaultOIDFederationAutomaticRegistrationProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- claimsSetDecorationTypeLookupStrategy = FunctionSupport.constant(null);
- providedChainClaimsSetDecorationTypeLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Override @Nullable @NotEmpty
- public String getDefaultClaimsSetDecorationType(@Nullable final ProfileRequestContext profileRequestContext) {
- return StringSupport.trimOrNull(claimsSetDecorationTypeLookupStrategy.apply(profileRequestContext));
- }
-
- /**
- * Set claims set decoration type.
- *
- * @param type decoration type, or null for default
- */
- public void setDefaultClaimsSetDecorationType(@Nullable @NotEmpty final String type) {
- claimsSetDecorationTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
- }
-
- /**
- * Set lookup strategy for claims set decoration type.
- *
- * @param strategy lookup strategy
- */
- public void setDefaultClaimsSetDecorationTypeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,String> strategy) {
- claimsSetDecorationTypeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override @Nullable @NotEmpty
- public String getProvidedChainClaimsSetDecorationType(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return StringSupport.trimOrNull(
- providedChainClaimsSetDecorationTypeLookupStrategy.apply(profileRequestContext));
- }
-
- /**
- * Set claims set decoration type for clients with request-provided trust chain.
- *
- * @param type decoration type
- */
- public void setProvidedChainClaimsSetDecorationType(@Nullable @NotEmpty final String type) {
- providedChainClaimsSetDecorationTypeLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(type));
- }
-
- /**
- * Set lookup strategy for claims set decoration type for clients with request-provided trust chain.
- *
- * @param strategy lookup strategy
- */
- public void setProvidedChainClaimsSetDecorationTypeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,String> strategy) {
- providedChainClaimsSetDecorationTypeLookupStrategy =
- Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationEntityConfigurationProfileConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationEntityConfigurationProfileConfiguration.java
deleted file mode 100644
index c72fc6b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationEntityConfigurationProfileConfiguration.java
+++ /dev/null
@@ -1,237 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl;
-
-import java.time.Duration;
-import java.util.List;
-import java.util.Map;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationEntityConfigurationProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Positive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-
-/**
- * Implementation of a profile configuration for the OpenID Federation Entity Configuration.
- */
-public class DefaultOIDFederationEntityConfigurationProfileConfiguration
- extends AbstractOIDFederationResponseCachingProfileConfiguration
- implements OIDFederationEntityConfigurationProfileConfiguration {
-
- /** OIDC provider information profile counter name. */
- @Nonnull @NotEmpty public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.oidfed.configuration";
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Lookup function to authority hints. */
- @Nonnull private Function<ProfileRequestContext,List<String>> authorityHintsLookupStrategy;
-
- /** Lookup function to supply entity statement lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> entityStatementLifetimeLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating entity statement claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- entityStatementClaimsSetManipulationStrategyLookupStrategy;
-
- /** Lookup function to supply map of strategies for optional claims to be included in the entity configuration. */
- @Nonnull
- private Function<ProfileRequestContext,Map<String,Function<ProfileRequestContext,Object>>>
- optionalClaimsLookupStrategiesLookupStrategy;
-
- /**
- * Constructor.
- */
- public DefaultOIDFederationEntityConfigurationProfileConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public DefaultOIDFederationEntityConfigurationProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- authorityHintsLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
- entityStatementLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(24));
- entityStatementClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- optionalClaimsLookupStrategiesLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull @NonnullElements @NotLive @Unmodifiable
- public List<String> getAuthorityHints(@Nullable final ProfileRequestContext profileRequestContext) {
- final List<String> authorityHints = authorityHintsLookupStrategy.apply(profileRequestContext);
- if (authorityHints != null) {
- return CollectionSupport.copyToList(authorityHints);
- }
- return CollectionSupport.emptyList();
- }
-
- /**
- * Set authority hints value.
- *
- * @param hints authority hints
- */
- public void setAuthorityHints(@Nonnull @NonnullElements @NotLive @Unmodifiable final List<String> hints) {
- authorityHintsLookupStrategy = FunctionSupport.constant(hints);
- }
-
- /**
- * Sets lookup strategy for authority hints value.
- *
- * @param strategy lookup strategy
- */
- public void setAuthorityHintsLookupStrategy(@Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
- authorityHintsLookupStrategy = Constraint.isNotNull(strategy, "Authority hints lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull
- public Duration getEntityStatementLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = entityStatementLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Entity statement lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of an entity statement.
- *
- * @param lifetime lifetime of an entity statement
- */
- public void setEntityStatementLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration statementLifetime = Constraint.isNotNull(lifetime, "Entity statement lifetime cannot be null");
- Constraint.isTrue(!statementLifetime.isZero() && !statementLifetime.isNegative(),
- "Entity statement lifetime must be greater than 0");
-
- entityStatementLifetimeLookupStrategy = FunctionSupport.constant(statementLifetime);
- }
-
- /**
- * Set a lookup strategy for the entity statement lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setEntityStatementLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- entityStatementLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getEntityStatementClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return entityStatementClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-function for manipulating entity statement claims set.
- *
- * @param strategy bi-function for manipulating entity statement claims set
- */
- public void setEntityStatementClaimsSetManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- entityStatementClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-function for manipulating entity statement claims set.
- *
- * @param strategy lookup strategy
- */
- public void setEntityStatementClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- entityStatementClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- public Map<String,Function<ProfileRequestContext,Object>> getOptionalClaimsLookupStrategies(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Map<String,Function<ProfileRequestContext,Object>> strategies =
- optionalClaimsLookupStrategiesLookupStrategy.apply(profileRequestContext);
- return strategies != null ? strategies : CollectionSupport.emptyMap();
- }
-
- /**
- * Set the lookup strategies for optional claims to be included to the entity configuration.
- *
- * @param strategies lookup strategies for optional claims to be included to the entity configuration
- */
- public void setOptionalClaimsLookupStrategies(
- @Nullable final Map<String,Function<ProfileRequestContext,Object>> strategies) {
- optionalClaimsLookupStrategiesLookupStrategy = FunctionSupport.constant(strategies);
- }
-
- /**
- * Set a lookup strategy for the lookup strategies for optional claims to be included to the entity configuration.
- *
- * @param strategy lookup strategy
- */
- public void setOptionalClaimsLookupStrategiesLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,Map<String,Function<ProfileRequestContext,Object>>> strategy) {
- optionalClaimsLookupStrategiesLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationExplicitRegistrationProfileConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationExplicitRegistrationProfileConfiguration.java
deleted file mode 100644
index 33f6b6b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationExplicitRegistrationProfileConfiguration.java
+++ /dev/null
@@ -1,341 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl;
-
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationExplicitRegistrationProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Positive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/**
- * Implementation of a profile configuration for the OpenID Federation Explicit Registration.
- */
-public class DefaultOIDFederationExplicitRegistrationProfileConfiguration
- extends AbstractOIDFederationRegistrationProfileConfiguration
- implements OIDFederationExplicitRegistrationProfileConfiguration {
-
- /** OIDC provider information profile counter name. */
- @Nonnull @NotEmpty
- public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.oidfed.explicitregistration";
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Predicate used to indicate whether authorization code flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> authorizationCodeFlowPredicate;
-
- /** Predicate used to indicate whether implicit flow is supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> implicitFlowPredicate;
-
- /** Predicate used to indicate whether refresh tokens are supported by this profile. Default true. */
- @Nonnull private Predicate<ProfileRequestContext> refreshTokensPredicate;
-
- /** Enabled token endpoint authentication methods. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> tokenEndpointAuthMethodsLookupStrategy;
-
- /** Lookup function to supply entity statement lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> entityStatementLifetimeLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating entity statement claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- entityStatementClaimsSetManipulationStrategyLookupStrategy;
-
- /** Lookup function to supply map of strategies for optional claims to be included in the entity statement. */
- @Nonnull
- private Function<ProfileRequestContext,Map<String,Function<ProfileRequestContext,Object>>>
- optionalClaimsLookupStrategiesLookupStrategy;
-
- /**
- * Constructor.
- */
- public DefaultOIDFederationExplicitRegistrationProfileConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public DefaultOIDFederationExplicitRegistrationProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- authorizationCodeFlowPredicate = PredicateSupport.alwaysTrue();
- implicitFlowPredicate = PredicateSupport.alwaysTrue();
- refreshTokensPredicate = PredicateSupport.alwaysTrue();
- tokenEndpointAuthMethodsLookupStrategy = FunctionSupport.constant(
- CollectionSupport.setOf(
- ClientAuthenticationMethod.CLIENT_SECRET_BASIC.toString(),
- ClientAuthenticationMethod.CLIENT_SECRET_POST.toString(),
- ClientAuthenticationMethod.CLIENT_SECRET_JWT.toString(),
- ClientAuthenticationMethod.PRIVATE_KEY_JWT.toString()));
- entityStatementClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- entityStatementLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(24));
- optionalClaimsLookupStrategiesLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isAuthorizationCodeFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return authorizationCodeFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether authorization code flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setAuthorizationCodeFlowEnabled(final boolean flag) {
- authorizationCodeFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether authorization code flow is supported by this profile.
- *
- * @param condition condition to set
- */
- public void setAuthorizationCodeFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- authorizationCodeFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether authorization code flow is supported cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isImplicitFlowEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return implicitFlowPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether hybrid flow is supported by this profile.
- *
- * @param flag flag to set
- */
- public void setImplicitFlowEnabled(final boolean flag) {
- implicitFlowPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether hybrid flow is supported by this profile.
- *
- * @param condition condition to set.
- */
- public void setImplicitFlowEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- implicitFlowPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether hybrid flow is supported cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isRefreshTokensEnabled(@Nullable final ProfileRequestContext profileRequestContext) {
- return refreshTokensPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether refresh tokens are supported by this profile.
- *
- * @param flag flag to set
- */
- public void setRefreshTokensEnabled(final boolean flag) {
- refreshTokensPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition used to indicate whether refresh tokens are supported by this profile.
- *
- * @param condition condition to set
- */
- public void setRefreshTokensEnabledPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- refreshTokensPredicate = Constraint.isNotNull(condition,
- "Condition used to indicate whether refresh tokens are supported cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getTokenEndpointAuthMethods(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Collection<String> methods = tokenEndpointAuthMethodsLookupStrategy.apply(profileRequestContext);
- if (methods != null) {
- return CollectionSupport.copyToSet(methods);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the enabled token endpoint authentication methods.
- *
- * @param methods What to set.
- */
- public void setTokenEndpointAuthMethods(@Nonnull @NonnullElements final Collection<String> methods) {
- Constraint.isNotNull(methods, "Collection of methods cannot be null");
-
- tokenEndpointAuthMethodsLookupStrategy =
- FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(methods)));
- }
-
- /**
- * Set a lookup strategy for the enabled token endpoint authentication methods.
- *
- * @param strategy lookup strategy
- */
- public void setTokenEndpointAuthMethodsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- tokenEndpointAuthMethodsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getEntityStatementClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return entityStatementClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-function for manipulating entity statement claims set.
- *
- * @param strategy bi-function for manipulating entity statement claims set
- */
- public void setEntityStatementClaimsSetManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- entityStatementClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-function for manipulating entity statement claims set.
- *
- * @param strategy lookup strategy
- */
- public void setEntityStatementClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- entityStatementClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull
- public Duration getEntityStatementLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = entityStatementLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Entity statement lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of an entity statement.
- *
- * @param lifetime lifetime of an entity statement
- */
- public void setEntityStatementLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration statementLifetime = Constraint.isNotNull(lifetime, "Entity statement lifetime cannot be null");
- Constraint.isTrue(!statementLifetime.isZero() && !statementLifetime.isNegative(),
- "Entity statement lifetime must be greater than 0");
-
- entityStatementLifetimeLookupStrategy = FunctionSupport.constant(statementLifetime);
- }
-
- /**
- * Set a lookup strategy for the entity statement lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setEntityStatementLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- entityStatementLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- public Map<String,Function<ProfileRequestContext,Object>> getOptionalClaimsLookupStrategies(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Map<String,Function<ProfileRequestContext,Object>> strategies =
- optionalClaimsLookupStrategiesLookupStrategy.apply(profileRequestContext);
- return strategies != null ? strategies : CollectionSupport.emptyMap();
- }
-
- /**
- * Set the lookup strategies for optional claims to be included to the entity statement.
- *
- * @param strategies lookup strategies for optional claims to be included to the entity statement
- */
- public void setOptionalClaimsLookupStrategies(
- @Nullable final Map<String,Function<ProfileRequestContext,Object>> strategies) {
- optionalClaimsLookupStrategiesLookupStrategy = FunctionSupport.constant(strategies);
- }
-
- /**
- * Set a lookup strategy for the lookup strategies for optional claims to be included to the entity statement.
- *
- * @param strategy lookup strategy
- */
- public void setOptionalClaimsLookupStrategiesLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,Map<String,Function<ProfileRequestContext,Object>>> strategy) {
- optionalClaimsLookupStrategiesLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationResolveEntityProfileConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationResolveEntityProfileConfiguration.java
deleted file mode 100644
index 2a3cf90..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationResolveEntityProfileConfiguration.java
+++ /dev/null
@@ -1,274 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl;
-
-import java.time.Duration;
-import java.util.List;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationResolveEntityProfileConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.impl.AbstractOAuth2ClientAuthenticableProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Positive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-
-/**
- * Implementation of a profile configuration for the OpenID Federation Resolve Entity.
- */
-public class DefaultOIDFederationResolveEntityProfileConfiguration
- extends AbstractOAuth2ClientAuthenticableProfileConfiguration
- implements OIDFederationResolveEntityProfileConfiguration {
-
- /** OIDC provider information profile counter name. */
- @Nonnull @NotEmpty public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.oidfed.resolve-entity";
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Lookup function to supply cached success response lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> cachedSuccessResponseLifetimeLookupStrategy;
-
- /** Lookup function to supply cached error response lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> cachedErrorResponseLifetimeLookupStrategy;
-
- /** Lookup function to mandatory trust marks. */
- @Nonnull private Function<ProfileRequestContext,List<String>> mandatoryTrustMarksLookupStrategy;
-
- /** Lookup function to supply maximum trust mark lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> maximumTrustMarkLifetimeLookupStrategy;
-
- /** Whether trust marks should be remotely validated. */
- @Nonnull private Predicate<ProfileRequestContext> remoteTrustMarkValidationCondition;
-
- /**
- * Constructor.
- */
- public DefaultOIDFederationResolveEntityProfileConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public DefaultOIDFederationResolveEntityProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- cachedSuccessResponseLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
- cachedErrorResponseLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofMinutes(5));
- mandatoryTrustMarksLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
- maximumTrustMarkLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofDays(365));
- remoteTrustMarkValidationCondition = PredicateSupport.alwaysTrue();
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull
- public Duration getCachedSuccessResponseLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = cachedSuccessResponseLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Success response lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of a cached success response.
- *
- * @param lifetime lifetime of a cached success response
- */
- public void setCachedSuccessResponseLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration successLifetime = Constraint.isNotNull(lifetime,
- "Cached success response lifetime cannot be null");
- Constraint.isTrue(!successLifetime.isZero() && !successLifetime.isNegative(),
- "Cached success response lifetime must be greater than 0");
-
- cachedSuccessResponseLifetimeLookupStrategy = FunctionSupport.constant(successLifetime);
- }
-
- /**
- * Set a lookup strategy for the cached success response lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setCachedSuccessResponseLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- cachedSuccessResponseLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull
- public Duration getCachedErrorResponseLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = cachedErrorResponseLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Error response lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of a cached error response.
- *
- * @param lifetime lifetime of a cached error response
- */
- public void setCachedErrorResponseLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration errorLifetime = Constraint.isNotNull(lifetime,
- "Cached error response lifetime cannot be null");
- Constraint.isTrue(!errorLifetime.isZero() && !errorLifetime.isNegative(),
- "Cached error response lifetime must be greater than 0");
-
- cachedErrorResponseLifetimeLookupStrategy = FunctionSupport.constant(errorLifetime);
- }
-
- /**
- * Set a lookup strategy for the cached error response lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setCachedErrorResponseLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- cachedErrorResponseLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull @NonnullElements @NotLive @Unmodifiable
- public List<String> getMandatoryTrustMarks(@Nullable final ProfileRequestContext profileRequestContext) {
- final List<String> trustMarks = mandatoryTrustMarksLookupStrategy.apply(profileRequestContext);
- if (trustMarks != null) {
- return CollectionSupport.copyToList(trustMarks);
- }
- return CollectionSupport.emptyList();
- }
-
- /**
- * Set mandatory trust marks.
- *
- * @param marks trust marks
- */
- public void setMandatoryTrustMarks(@Nonnull @NonnullElements @NotLive @Unmodifiable final List<String> marks) {
- mandatoryTrustMarksLookupStrategy = FunctionSupport.constant(marks);
- }
-
- /**
- * Sets lookup strategy for mandatory trust marks value.
- *
- * @param strategy lookup strategy
- */
- public void setMandatoryTrustMarksLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
- mandatoryTrustMarksLookupStrategy =
- Constraint.isNotNull(strategy, "Mandatory trust marks lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Positive @Nonnull
- public Duration getMaximumTrustMarkLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = maximumTrustMarkLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isZero() && !lifetime.isNegative(),
- "Maximum trust mark lifetime must be greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the maximum lifetime of a trust mark.
- *
- * @param lifetime lifetime of a trust mark
- */
- public void setMaximumTrustMarkLifetime(@Positive @Nonnull final Duration lifetime) {
- final Duration trustMarkLifetime = Constraint.isNotNull(lifetime, "Maximum trust mark lifetime cannot be null");
- Constraint.isTrue(!trustMarkLifetime.isZero() && !trustMarkLifetime.isNegative(),
- "Maximum trust mark lifetime must be greater than 0");
-
- maximumTrustMarkLifetimeLookupStrategy = FunctionSupport.constant(trustMarkLifetime);
- }
-
- /**
- * Set a lookup strategy for the maximum trust mark lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setMaximumTrustMarkLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- maximumTrustMarkLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- public boolean isRemoteTrustMarkValidation(@Nullable final ProfileRequestContext profileRequestContext) {
- return remoteTrustMarkValidationCondition.test(profileRequestContext);
- }
-
- /**
- * Set whether trust marks should be remotely validated.
- *
- * @param flag flag to set
- */
- public void setRemoteTrustMarkValidation(final boolean flag) {
- remoteTrustMarkValidationCondition = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
- }
-
- /**
- * Set condition for whether trust marks should be remotely validated.
- *
- * @param condition condition to set
- */
- public void setRemoteTrustMarkValidationPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- remoteTrustMarkValidationCondition = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationSignedKeysetProfileConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationSignedKeysetProfileConfiguration.java
deleted file mode 100644
index 3df320c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/config/impl/DefaultOIDFederationSignedKeysetProfileConfiguration.java
+++ /dev/null
@@ -1,199 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl;
-
-import java.time.Duration;
-import java.util.Map;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationSignedKeysetProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-
-/**
- * Implementation of a profile configuration for the OpenID Federation Signed keyset.
- */
-public class DefaultOIDFederationSignedKeysetProfileConfiguration
- extends AbstractOIDFederationResponseCachingProfileConfiguration
- implements OIDFederationSignedKeysetProfileConfiguration {
-
- /** OIDC provider information profile counter name. */
- @Nonnull @NotEmpty public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.oidfed.keyset";
-
- /** Lookup function to override issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Lookup function to supply entity statement lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> entityStatementLifetimeLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating entity statement claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- entityStatementClaimsSetManipulationStrategyLookupStrategy;
-
- /** Lookup function to supply map of strategies for optional claims to be included in the entity statement. */
- @Nonnull
- private Function<ProfileRequestContext,Map<String,Function<ProfileRequestContext,Object>>>
- optionalClaimsLookupStrategiesLookupStrategy;
-
- /**
- * Constructor.
- */
- public DefaultOIDFederationSignedKeysetProfileConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Creates a new configuration instance.
- *
- * @param profileId Unique profile identifier.
- */
- public DefaultOIDFederationSignedKeysetProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- issuerLookupStrategy = FunctionSupport.constant(null);
- entityStatementClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(null);
- entityStatementLifetimeLookupStrategy = FunctionSupport.constant(Duration.ofHours(24));
- optionalClaimsLookupStrategiesLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set overridden issuer value.
- *
- * @param issuer issuer value
- */
- public void setIssuer(@Nullable @NotEmpty final String issuer) {
- issuerLookupStrategy = FunctionSupport.constant(issuer);
- }
-
- /**
- * Sets lookup strategy for overridden issuer value.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull
- public Duration getEntityStatementLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = entityStatementLifetimeLookupStrategy.apply(profileRequestContext);
-
- Constraint.isTrue(lifetime != null && !lifetime.isNegative(),
- "Entity statement lifetime must be equal to or greater than 0");
- assert lifetime != null;
- return lifetime;
- }
-
- /**
- * Set the lifetime of an entity statement.
- *
- * @param lifetime lifetime of an entity statement
- */
- public void setEntityStatementLifetime(@Nonnull final Duration lifetime) {
- final Duration statementLifetime = Constraint.isNotNull(lifetime, "Entity statement lifetime cannot be null");
- Constraint.isTrue(!statementLifetime.isNegative(),
- "Entity statement lifetime must be equal or greater than 0");
-
- entityStatementLifetimeLookupStrategy = FunctionSupport.constant(statementLifetime);
- }
-
- /**
- * Set a lookup strategy for the entity statement lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setEntityStatementLifetimeLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Duration> strategy) {
- entityStatementLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable
- public BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>
- getEntityStatementClaimsSetManipulationStrategy(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return entityStatementClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the bi-function for manipulating entity statement claims set.
- *
- * @param strategy bi-function for manipulating entity statement claims set
- */
- public void setEntityStatementClaimsSetManipulationStrategy(
- @Nullable final BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> strategy) {
- entityStatementClaimsSetManipulationStrategyLookupStrategy = FunctionSupport.constant(strategy);
- }
-
- /**
- * Set a lookup strategy for the bi-function for manipulating entity statement claims set.
- *
- * @param strategy lookup strategy
- */
- public void setEntityStatementClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- entityStatementClaimsSetManipulationStrategyLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull
- public Map<String,Function<ProfileRequestContext,Object>> getOptionalClaimsLookupStrategies(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Map<String,Function<ProfileRequestContext,Object>> strategies =
- optionalClaimsLookupStrategiesLookupStrategy.apply(profileRequestContext);
- return strategies != null ? strategies : CollectionSupport.emptyMap();
- }
-
- /**
- * Set the lookup strategies for optional claims to be included to the entity statement.
- *
- * @param strategies lookup strategies for optional claims to be included to the entity statement
- */
- public void setOptionalClaimsLookupStrategies(
- @Nullable final Map<String,Function<ProfileRequestContext,Object>> strategies) {
- optionalClaimsLookupStrategiesLookupStrategy = FunctionSupport.constant(strategies);
- }
-
- /**
- * Set a lookup strategy for the lookup strategies for optional claims to be included to the entity statement.
- *
- * @param strategy lookup strategy
- */
- public void setOptionalClaimsLookupStrategiesLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,Map<String,Function<ProfileRequestContext,Object>>> strategy) {
- optionalClaimsLookupStrategiesLookupStrategy = Constraint.isNotNull(strategy,
- "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AbstractBuildEntityStatementAction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AbstractBuildEntityStatementAction.java
deleted file mode 100644
index 4ed8004..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AbstractBuildEntityStatementAction.java
+++ /dev/null
@@ -1,301 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import java.text.ParseException;
-import java.time.Instant;
-import java.util.Date;
-import java.util.Map;
-import java.util.function.BiFunction;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.encoder.AbstractMessageEncoder;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.jwt.JWT;
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.PlainJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.EntityStatementClaimsSetManipulationStrategyLookupFunction;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.security.IdentifierGenerationStrategy;
-import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
-
-/**
- * Abstract action used by actions that build entity statements.
- */
-public abstract class AbstractBuildEntityStatementAction extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AbstractBuildEntityStatementAction.class);
-
- /** Used to log protocol messages. */
- @Nonnull protected Logger protocolMessageLog =
- LoggerFactory.getLogger(AbstractMessageEncoder.BASE_PROTOCOL_MESSAGE_LOGGER_CATEGORY + ".OIDFED");
-
- /** Strategy used to obtain the issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Strategy used to obtain the subject value. */
- @Nonnull private Function<ProfileRequestContext,String> subjectLookupStrategy;
-
- /** Strategy used to locate the {@link IdentifierGenerationStrategy} to use. */
- @Nonnull private Function<ProfileRequestContext,IdentifierGenerationStrategy> idGeneratorLookupStrategy;
-
- /** Strategy used to locate the subcontext to hold the statement. */
- @Nonnull private Function<ProfileRequestContext,EntityStatementContext> entityStatementContextLookupStrategy;
-
- /** Lookup function to supply strategy bi-function for manipulating entity statement claims set. */
- @Nonnull
- private Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- entityStatementClaimsSetManipulationStrategyLookupStrategy;
-
- /** The strategy used for manipulating the entity statement claims set. */
- @Nullable private BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>> manipulationStrategy;
-
- /** Object mapper used for pretty-printing JWT contents. */
- @NonnullAfterInit private ObjectMapper objectMapper;
-
- /** The generator to use. */
- @NonnullBeforeExec protected IdentifierGenerationStrategy idGenerator;
-
- /** Entity statement context. */
- @NonnullBeforeExec protected EntityStatementContext entityStatementCtx;
-
- /** Constructor. */
- public AbstractBuildEntityStatementAction() {
- issuerLookupStrategy = new IssuerLookupFunction();
- subjectLookupStrategy = new IssuerLookupFunction();
-
- idGeneratorLookupStrategy = FunctionSupport.constant(new SecureRandomIdentifierGenerationStrategy());
-
- final Function<ProfileRequestContext,EntityStatementContext> escls =
- new ChildContextLookup<>(EntityStatementContext.class, true).compose(
- new OutboundMessageContextLookup());
- assert escls != null;
- entityStatementContextLookupStrategy = escls;
-
- entityStatementClaimsSetManipulationStrategyLookupStrategy =
- new EntityStatementClaimsSetManipulationStrategyLookupFunction();
- }
-
- /**
- * Set the strategy used to locate the {@link IdentifierGenerationStrategy} to use.
- *
- * @param strategy lookup strategy
- */
- public void setIdentifierGeneratorLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,IdentifierGenerationStrategy> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
-
- idGeneratorLookupStrategy =
- Constraint.isNotNull(strategy, "Identifier generation strategy cannot be null");
- }
-
- /**
- * Set the strategy used to locate the issuer value to use.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
-
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to locate the subject value to use.
- *
- * @param strategy lookup strategy
- */
- public void setSubjectLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
-
- subjectLookupStrategy = Constraint.isNotNull(strategy, "Subject lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to lookup the {@link EntityStatementContext} to use.
- *
- * @param strategy lookup strategy
- */
- public void setEntityStatementContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,EntityStatementContext> strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
-
- entityStatementContextLookupStrategy =
- Constraint.isNotNull(strategy, "EntityStatementContext lookup strategy cannot be null");
- }
-
- /**
- * Set the lookup function to supply strategy bi-function for manipulating entity statement claims set.
- *
- * @param strategy What to set
- */
- public void setEntityStatementClaimsSetManipulationStrategyLookupStrategy(@Nonnull final
- Function<ProfileRequestContext,BiFunction<ProfileRequestContext,Map<String,Object>,Map<String,Object>>>
- strategy) {
- ifInitializedThrowUnmodifiabledComponentException();
-
- entityStatementClaimsSetManipulationStrategyLookupStrategy =
- Constraint.isNotNull(strategy, "Manipulation strategy lookup strategy cannot be null");
- }
-
- /**
- * Set the object mapper used for pretty-printing JWT contents.
- *
- * @param mapper What to set.
- */
- public void setObjectMapper(@Nonnull final ObjectMapper mapper) {
- checkSetterPreconditions();
- objectMapper = Constraint.isNotNull(mapper, "Object mapper cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (objectMapper == null) {
- throw new ComponentInitializationException("Object mapper cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- idGenerator = idGeneratorLookupStrategy.apply(profileRequestContext);
- if (idGenerator == null) {
- log.error("{} No identifier generation strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- entityStatementCtx = entityStatementContextLookupStrategy.apply(profileRequestContext);
- if (entityStatementCtx == null) {
- log.error("{} Unable to fetch EntityStatementContext", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- manipulationStrategy =
- entityStatementClaimsSetManipulationStrategyLookupStrategy.apply(profileRequestContext);
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final String issuer = issuerLookupStrategy.apply(profileRequestContext);
- final String subject = subjectLookupStrategy.apply(profileRequestContext);
-
- final Instant now = Instant.now();
-
- final JWTClaimsSet.Builder builder = new JWTClaimsSet.Builder()
- .issuer(issuer)
- .subject(subject)
- .issueTime(Date.from(now));
- assert builder != null;
- if (!populateClaimsSetBuilder(builder, profileRequestContext)) {
- return;
- }
- final JWTClaimsSet claimsSet = builder.build();
-
- assert claimsSet != null;
- if (manipulationStrategy != null) {
- log.debug("{} Manipulation strategy has been set, applying it to the claims set {}", getLogPrefix(),
- claimsSet.toJSONObject());
- assert manipulationStrategy != null;
- final Map<String, Object> result = manipulationStrategy.apply(profileRequestContext,
- claimsSet.toJSONObject());
- if (result == null) {
- log.debug("{} Manipulation strategy returned null, leaving statement claims set untouched.",
- getLogPrefix());
- } else {
- log.debug("{} Applying the manipulated claims into the entity statement claims set", getLogPrefix());
- try {
- final JWTClaimsSet parsedSet = JWTClaimsSet.parse(result);
- assert parsedSet != null;
- logAndConstructEntityStatement(parsedSet);
- return;
- } catch (final ParseException e) {
- log.error("{} The resulted claims set could not be transformed into ", getLogPrefix(), e);
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
- return;
- }
- }
- } else {
- log.debug("{} No manipulation strategy configured", getLogPrefix());
- }
- logAndConstructEntityStatement(claimsSet);
- }
-
- /**
- * Populates the claims set builder with claims specific to the action extending this abstract action. If any
- * problem occures during population, the profile request context should be populated with an appropriate
- * event.
- *
- * @param builder the claims set builder
- * @param profileRequestContext profile request context
- * @return true if population was successful, false otherwise
- */
- protected abstract boolean populateClaimsSetBuilder(@Nonnull final JWTClaimsSet.Builder builder,
- @Nonnull final ProfileRequestContext profileRequestContext);
-
- /**
- * Logs the entity statement contents via protocol message logger and constructs a plain (i.e. non-signed) JWT out
- * of it and includes it to the {@link EntityStatementContext#setJWT(JWT)}.
- *
- * @param claimsSet the claims set
- */
- protected void logAndConstructEntityStatement(@Nonnull final JWTClaimsSet claimsSet) {
- log.trace("{} Building JWT from the claims set {}", getLogPrefix(), claimsSet);
- assert objectMapper != null;
- try {
- final Object jsonObject = objectMapper.readValue(claimsSet.toString(), Object.class);
- final String contents = objectMapper.writerWithDefaultPrettyPrinter().writeValueAsString(jsonObject);
- protocolMessageLog.trace("Entity statement payload contents:\n{}", contents);
- } catch (final JsonProcessingException e) {
- log.error("{} Could not construct protocol log message", getLogPrefix(), e);
- }
- assert entityStatementCtx != null;
- final JWT jwt = new PlainJWT(claimsSet);
- entityStatementCtx.setJWT(jwt);
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AbstractTrustChainResolutionAction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AbstractTrustChainResolutionAction.java
index 94aee56..da2f09e 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AbstractTrustChainResolutionAction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AbstractTrustChainResolutionAction.java
@@ -32,18 +32,18 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
import net.minidev.json.JSONObject;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.FederationPolicyConstraint;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.FederationPolicyConstraintHelper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.EntityConfigurationImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl.MetadataImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.EntityConfigurationPayloadImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyHelper;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.constraints.FederationPolicyConstraint;
+import net.shibboleth.oidfed.metadata.constraints.FederationPolicyConstraintHelper;
+import net.shibboleth.oidfed.metadata.impl.EntityConfigurationImpl;
+import net.shibboleth.oidfed.metadata.payload.claim.impl.MetadataImpl;
+import net.shibboleth.oidfed.metadata.payload.impl.EntityConfigurationPayloadImpl;
+import net.shibboleth.oidfed.metadata.policy.FederationMetadataPolicyHelper;
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AddExtensionsToClientInformation.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AddExtensionsToClientInformation.java
index 6e8a347..537d4d3 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AddExtensionsToClientInformation.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AddExtensionsToClientInformation.java
@@ -32,11 +32,11 @@ import org.slf4j.Logger;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistrationResponseContext;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.support.ClientInformationExtensionSupport;
import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.support.ClientInformationExtensionSupport;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AutoRegisteredClientInformationStoreClaimsSetDecorator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AutoRegisteredClientInformationStoreClaimsSetDecorator.java
index c911d9e..4666410 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AutoRegisteredClientInformationStoreClaimsSetDecorator.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/AutoRegisteredClientInformationStoreClaimsSetDecorator.java
@@ -30,13 +30,13 @@ import org.slf4j.Logger;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.support.ClaimsSetExtensionSupport;
import net.shibboleth.oidc.metadata.ClientInformationManager;
import net.shibboleth.oidc.metadata.ClientInformationManagerException;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.util.EntityStatementHelper;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java
deleted file mode 100644
index a6fed36..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildEntityConfiguration.java
+++ /dev/null
@@ -1,215 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-
-import com.nimbusds.jose.jwk.JWK;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.AuthorityHintsLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.EntityStatementLifetimeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.OptionalClaimsLookupStrategiesLookupFunction;
-import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction;
-import net.shibboleth.oidc.security.CredentialConversionUtil;
-import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-import org.opensaml.profile.action.ActionSupport;
-
-/**
- * Action that creates an Entity Statement, and stores it to an {@link EntityStatementContext}.
- *
- * @event {@link EventIds#PROCEED_EVENT_ID}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link EventIds#IO_ERROR}
- * @event {@link IdPEventIds#INVALID_PROFILE_CONFIG}
- */
-public class BuildEntityConfiguration extends AbstractBuildEntityStatementAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(BuildEntityConfiguration.class);
-
- /** Strategy used to locate the {@link SignatureSigningConfiguration}s to fetch JWK set from. */
- @Nonnull private
- Function<ProfileRequestContext,List<SignatureSigningConfiguration>> signingConfigurationsLookupStrategy;
-
- /** Strategy used to obtain the entity statement lifetime. */
- @Nonnull private Function<ProfileRequestContext,Duration> entityConfigurationLifetimeLookupStrategy;
-
- /** Strategy used to locate authority hints. */
- @Nonnull private Function<ProfileRequestContext,List<String>> authorityHintsLookupStrategy;
-
- /** Strategy used to locate strategies for optional claims. */
- @Nonnull private Function<ProfileRequestContext,Map<String, Function<ProfileRequestContext,Object>>>
- optionalClaimsLookupStrategiesLookupStrategy;
-
- /** Metadata to publish. */
- @NonnullBeforeExec private Metadata metadata;
-
- /** Constructor. */
- public BuildEntityConfiguration() {
- signingConfigurationsLookupStrategy = new JWTSignatureSigningConfigurationLookupFunction();
- entityConfigurationLifetimeLookupStrategy = new EntityStatementLifetimeLookupFunction();
- authorityHintsLookupStrategy = new AuthorityHintsLookupFunction();
- optionalClaimsLookupStrategiesLookupStrategy = new OptionalClaimsLookupStrategiesLookupFunction();
- }
-
- /**
- * Set the strategy used to locate the {@link SignatureSigningConfiguration}s to fetch JWK set from.
- *
- * @param strategy lookup strategy
- */
- public void setSigningConfigurationsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,List<SignatureSigningConfiguration>> strategy) {
- checkSetterPreconditions();
-
- signingConfigurationsLookupStrategy =
- Constraint.isNotNull(strategy, "Signing configuration lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to obtain the entity configuration lifetime.
- *
- * @param strategy lookup strategy
- */
- public void setEntityConfigurationLifetimeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- checkSetterPreconditions();
-
- entityConfigurationLifetimeLookupStrategy =
- Constraint.isNotNull(strategy, "Entity configuration lifetime lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to locate authority hints.
- *
- * @param strategy lookup strategy
- */
- public void setAuthorityHintsLookupStrategy(@Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
- checkSetterPreconditions();
-
- authorityHintsLookupStrategy = Constraint.isNotNull(strategy, "Authority hints lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to locate strategies for optional claims.
- *
- * @param strategy lookup strategy
- */
- public void setOptionalClaimsLookupStrategiesLookupStrategy(@Nonnull final
- Function<ProfileRequestContext, Map<String,Function<ProfileRequestContext,Object>>> strategy) {
- checkSetterPreconditions();
-
- optionalClaimsLookupStrategiesLookupStrategy =
- Constraint.isNotNull(strategy, "Optional claims lookup strategies lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- metadata = entityStatementCtx.getMetadata();
- if (metadata == null) {
- log.error("{} Could not resolve provider metadata", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean populateClaimsSetBuilder(@Nonnull final JWTClaimsSet.Builder builder,
- @Nonnull final ProfileRequestContext profileRequestContext) {
- final List<SignatureSigningConfiguration> signingConfigurations =
- signingConfigurationsLookupStrategy.apply(profileRequestContext);
- if (signingConfigurations == null || signingConfigurations.isEmpty()) {
- log.error("{} Could not fetch any signature signing configurations", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
- return false;
- }
-
- final List<JWK> jwks = new ArrayList<>();
- for (final SignatureSigningConfiguration signingConfiguration : signingConfigurations) {
- for (final Credential credential : signingConfiguration.getSigningCredentials()) {
- final JWK jwk = CredentialConversionUtil.credentialToKey(credential);
- if (jwk != null) {
- jwks.add(jwk);
- log.debug("{} Included {} to the keyset", getLogPrefix(), jwk.toJSONString());
- }
- }
- }
-
- final Duration lifetime = entityConfigurationLifetimeLookupStrategy.apply(profileRequestContext);
- if (lifetime == null) {
- log.error("{} No lifetime supplied for entity statement", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
- return false;
- }
- final Instant now = Instant.now();
- final Instant dateExp = now.plus(lifetime);
- assert dateExp != null;
-
- builder.expirationTime(Date.from(dateExp));
- builder.claim("jwks", new JWKSet(jwks).toJSONObject(true));
- builder.claim("metadata", CollectionSupport.copyToMap(metadata.getAllClaims()));
- final List<String> authorityHints = authorityHintsLookupStrategy.apply(profileRequestContext);
- if (authorityHints != null && !authorityHints.isEmpty()) {
- builder.claim("authority_hints", authorityHints);
- }
- final Map<String, Function<ProfileRequestContext, Object>> optionalClaimsLookupStrategies =
- optionalClaimsLookupStrategiesLookupStrategy.apply(profileRequestContext);
- if (optionalClaimsLookupStrategies != null) {
- for (final String claim : optionalClaimsLookupStrategies.keySet()) {
- log.trace("{} Looking up the value for clain {}", getLogPrefix(), claim);
- final Function<ProfileRequestContext,Object> lookup = optionalClaimsLookupStrategies.get(claim);
- final Object value = lookup.apply(profileRequestContext);
- if (value != null) {
- log.debug("{} Resolved value {} for clain {}", getLogPrefix(), value, claim);
- builder.claim(claim, value);
- } else {
- log.debug("{} No value resolved for clain {}", getLogPrefix(), claim);
- }
- }
- }
-
- return true;
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildExplicitRegistrationResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildExplicitRegistrationResponse.java
index 6eaadcf..921d048 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildExplicitRegistrationResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildExplicitRegistrationResponse.java
@@ -38,6 +38,7 @@ import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrus
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultSelectedTrustChainImmediateSuperiorLookupStrategy;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultSelectedTrustChainTrustAnchorLookupStrategy;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.ExplicitClientRegistrationRequestJWKSetLookupFunction;
+import net.shibboleth.oidfed.profile.impl.AbstractBuildEntityStatementAction;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityErrorResponseFromEvent.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityErrorResponseFromEvent.java
index 2790250..527f119 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityErrorResponseFromEvent.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityErrorResponseFromEvent.java
@@ -34,16 +34,17 @@ import com.nimbusds.oauth2.sdk.ErrorObject;
import com.nimbusds.oauth2.sdk.ErrorResponse;
import com.nimbusds.oauth2.sdk.http.HTTPResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityRequestCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityResponseContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.CachedErrorResponseLifetimeLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
import net.shibboleth.oidc.profile.messaging.JSONErrorResponse;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityRequest;
+import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.oidfed.metadata.cache.local.NimbusResponseCriterion;
+import net.shibboleth.oidfed.metadata.cache.local.ResolveEntityRequestCriterion;
+import net.shibboleth.oidfed.metadata.cache.local.ResolveEntityResponseContainer;
+import net.shibboleth.oidfed.profile.config.navigate.CachedErrorResponseLifetimeLookupFunction;
+import net.shibboleth.oidfed.profile.impl.RelyingPartyCachedMessageContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
index aa341d4..1aa7113 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildResolveEntityResponse.java
@@ -37,11 +37,12 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultEntityTypesLookupFunction;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.payload.claim.Metadata;
+import net.shibboleth.oidfed.profile.impl.AbstractBuildEntityStatementAction;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.logic.Constraint;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildSignedKeyset.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildSignedKeyset.java
index ccf421a..14ab51a 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildSignedKeyset.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/BuildSignedKeyset.java
@@ -29,9 +29,11 @@ import org.slf4j.Logger;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jwt.JWTClaimsSet;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.EntityStatementLifetimeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.OptionalClaimsLookupStrategiesLookupFunction;
import net.shibboleth.idp.profile.IdPEventIds;
+import net.shibboleth.oidfed.profile.config.navigate.EntityStatementLifetimeLookupFunction;
+import net.shibboleth.oidfed.profile.config.navigate.OptionalClaimsLookupStrategiesLookupFunction;
+import net.shibboleth.oidfed.profile.impl.AbstractBuildEntityStatementAction;
+import net.shibboleth.oidfed.profile.impl.EntityStatementContext;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
index 25a8b96..a2dc42d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/CallResolveEntityApi.java
@@ -44,21 +44,6 @@ import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.id.ClientID;
import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver.ResolveEntityCacheContainerIdentifier;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver.ResolveEntityCacheIdentifierCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver.ResolveEntityResponseContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.ResolveEntityResponsePayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteResolverEntity;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultPreSelectedTrustChainIDsLookupStrategy;
@@ -66,6 +51,21 @@ import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustCha
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.ResolveEntityResponse;
+import net.shibboleth.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion;
+import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
+import net.shibboleth.oidfed.metadata.cache.resolver.ResolveEntityCacheContainerIdentifier;
+import net.shibboleth.oidfed.metadata.cache.resolver.ResolveEntityCacheIdentifierCriterion;
+import net.shibboleth.oidfed.metadata.cache.resolver.ResolveEntityResponseContainer;
+import net.shibboleth.oidfed.metadata.payload.ResolveEntityResponsePayload;
+import net.shibboleth.oidfed.metadata.payload.claim.Metadata;
+import net.shibboleth.oidfed.metadata.util.EntityStatementHelper;
+import net.shibboleth.oidfed.profile.TrustedRemoteResolverEntity;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.CollectionSupport;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultProvidedTrustChainResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultProvidedTrustChainResolver.java
index c38952e..f2a58f2 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultProvidedTrustChainResolver.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultProvidedTrustChainResolver.java
@@ -24,8 +24,8 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.ProvidedTrustChainResolver;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.profile.ProvidedTrustChainResolver;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
deleted file mode 100644
index 0c85835..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/DefaultTrustMarkFromMetadataCacheFetchingFunction.java
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import java.net.URI;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.TrustMark;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkCacheIdentifier;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkIdentifierCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteEntity;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Function to fetch a trust mark from the configured cache of trust marks. The configurable cache is used for
- * fetching the trust_mark_endpoint of the trusted entity.
- */
-public class DefaultTrustMarkFromMetadataCacheFetchingFunction extends AbstractIdentifiableInitializableComponent
- implements Function<ProfileRequestContext, Map<String, String>> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultTrustMarkFromMetadataCacheFetchingFunction.class);
-
- /** Cache used to fetch the issuer entity configuration from. */
- @NonnullAfterInit private MetadataCache<EntityConfigurationContainer> entityConfigurationCache;
-
- /** Cache containing responses from Trust Mark APIs. */
- @NonnullAfterInit private MetadataCache<TrustMarkContainer> trustMarkCache;
-
- /** Trusted trust mark API entity. */
- @NonnullAfterInit private TrustedRemoteEntity trustedEntity;
-
- /** Trust mark type. */
- @NonnullAfterInit private String trustMarkType;
-
- /** Subject of the trust mark. */
- @NonnullAfterInit private String subject;
-
- /**
- * Set the cache used to fetch the issuer entity configuration from.
- *
- * @param cache cache used to fetch the issuer entity configuration from
- */
- public void setEntityConfigurationCache(@Nonnull final MetadataCache<EntityConfigurationContainer> cache) {
- checkSetterPreconditions();
- entityConfigurationCache = Constraint.isNotNull(cache, "Entity Configuration cache cannot be null");
- }
-
- /**
- * Set the cache containing responses from Trust Mark APIs.
- *
- * @param cache cache containing responses from Trust Mark APIs
- */
- public void setTrustMarkCache(@Nonnull final MetadataCache<TrustMarkContainer> cache) {
- checkSetterPreconditions();
- trustMarkCache = Constraint.isNotNull(cache, "Trust Mark cache cannot be null");
- }
-
- /**
- * Set the trusted trust mark API entity.
- *
- * @param entity trusted trust mark API entity
- */
- public void setTrustedEntity(@Nonnull final TrustedRemoteEntity entity) {
- checkSetterPreconditions();
- trustedEntity = Constraint.isNotNull(entity, "Trusted entity cannot be null");
- }
-
- /**
- * Set the trust mark type.
- *
- * @param type trust mark type
- */
- public void setTrustMarkType(@Nonnull @NotEmpty final String type) {
- checkSetterPreconditions();
- trustMarkType = Constraint.isNotEmpty(type, "Trust mark type cannot be empty");
- }
-
- /**
- * Set the subject.
- *
- * @param sub subject
- */
- public void setSubject(@Nonnull @NotEmpty final String sub) {
- checkSetterPreconditions();
- subject = Constraint.isNotEmpty(sub, "Subject cannot be empty");
- }
-
- /** {@inheritDoc} */
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (entityConfigurationCache == null) {
- throw new ComponentInitializationException("Entity configuration cache cannot be null");
- }
- if (trustMarkCache == null) {
- throw new ComponentInitializationException("Trust Mark cache cannot be null");
- }
- if (trustedEntity == null) {
- throw new ComponentInitializationException("Trusted entity cannot be null");
- }
- if (trustMarkType == null) {
- throw new ComponentInitializationException("Trust mark type cannot be null");
- }
- if (subject == null) {
- throw new ComponentInitializationException("Subject cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public Map<String, String> apply(@Nullable final ProfileRequestContext profileRequestContext) {
- checkComponentActive();
- final String entityId = trustedEntity.getEntityId();
- assert entityConfigurationCache != null;
- final CriteriaSet criteria = new CriteriaSet(new SubjectEntityIDCriterion(entityId));
- final EntityConfiguration configuration;
- try {
- final List<EntityConfigurationContainer> result = entityConfigurationCache.get(criteria);
- if (!result.isEmpty()) {
- configuration = Optional.ofNullable(result.get(0).getStatement()).orElse(null);
- } else {
- return null;
- }
- } catch (final MetadataCacheException e) {
- log.debug("Error while fetching entity configuration for {}", entityId, e);
- return null;
- }
-
- if (configuration == null) {
- log.warn("Could not fetch entity configuration for {}", entityId);
- return null;
- }
-
- final URI uri = Optional.ofNullable(configuration.getParsedPayload().getMetadata())
- .map(metadata -> metadata.getFederationEntityMetadata())
- .map(map -> map.get("trust_mark_endpoint"))
- .filter(String.class::isInstance)
- .map(String.class::cast)
- .map(URI::create)
- .orElse(null);
-
- if (uri == null) {
- log.warn("Could not fetch trust mark endpoint for {}", entityId);
- return null;
- }
- final String uriValue = uri.toString();
- assert uriValue != null; assert trustMarkType != null; assert subject != null;
- final TrustMarkCacheIdentifier trustMarkIdentifier =
- new TrustMarkCacheIdentifier(uriValue, trustMarkType, subject);
- final CriteriaSet criteriaSet = new CriteriaSet(new TrustMarkIdentifierCriterion(trustMarkIdentifier),
- new FederationEndpointEntityStatementCriterion(configuration));
- final List<TrustMarkContainer> cacheResult;
- try {
- cacheResult = trustMarkCache.get(criteriaSet);
- } catch (final MetadataCacheException e) {
- log.warn("Could not resolve trust mark {} from {}", trustMarkType, trustedEntity, e);
- return null;
- }
- if (cacheResult.isEmpty()) {
- log.debug("No data resolved for {} from {}", trustMarkType, trustedEntity);
- return null;
- }
- final TrustMark trustMark = cacheResult.get(0).getStatement();
- if (trustMark != null) {
- return Map.of("trust_mark_type", trustMarkType, "trust_mark", trustMark.getJwt().serialize());
- } else {
- log.debug("The cache container for {} did not contain trust mark", trustedEntity);
- }
- return null;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/EntityStatementContext.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/EntityStatementContext.java
deleted file mode 100644
index 7a1386f..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/EntityStatementContext.java
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import java.time.Duration;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.BaseContext;
-
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jwt.JWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
-
-/**
- * Subcontext carrying information used to produce entity statements.
- */
-public final class EntityStatementContext extends BaseContext {
-
- /** Metadata. */
- @Nullable private Metadata metadata;
-
- /** Lifetime of the statement. */
- @Nullable private Duration lifetime;
-
- /** The entity statement. */
- @Nullable private JWT jwt;
-
- /** The keys claim for the entity statement. */
- @Nullable private JWKSet keys;
-
- /**
- * Get the metadata.
- *
- * @return the metadata
- */
- @Nullable public Metadata getMetadata() {
- return metadata;
- }
-
- /**
- * Set the metadata.
- *
- * @param data the metadata
- *
- * @return this context
- */
- @Nonnull public EntityStatementContext setMetadata(@Nullable final Metadata data) {
- metadata = data;
- return this;
- }
-
- /**
- * Get the entity statement JWT.
- *
- * <p>May be in various states prior to signing.</p>
- *
- * @return the JWT
- */
- @Nullable public JWT getJWT() {
- return jwt;
- }
-
- /**
- * Set the entity statement JWT.
- *
- * <p>May be in various states prior to signing.</p>
- *
- * @param token the JWT
- *
- * @return this context
- */
- @Nonnull public EntityStatementContext setJWT(@Nullable final JWT token) {
- jwt = token;
- return this;
- }
-
- /**
- * Get the statement lifetime.
- *
- * @return lifetime
- */
- @Nullable public Duration getLifetime() {
- return lifetime;
- }
-
- /**
- * Set the statement lifetime.
- *
- * @param lt lifetime
- *
- * @return this context
- */
- @Nonnull public EntityStatementContext setLifetime(@Nullable final Duration lt) {
- lifetime = lt;
- return this;
- }
-
- /**
- * Get the keys claim for the entity statement.
- *
- * @return keys
- */
- @Nullable public JWKSet getKeys() {
- return keys;
- }
-
- /**
- * Set the keys claim for the entity statement.
- *
- * @param jwks keys
- *
- * @return this context
- */
- @Nonnull public EntityStatementContext setKeys(@Nullable final JWKSet jwks) {
- keys = jwks;
- return this;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/EntityStatementUpdateStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/EntityStatementUpdateStrategy.java
deleted file mode 100644
index d88936b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/EntityStatementUpdateStrategy.java
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import java.util.function.BiConsumer;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-
-import com.nimbusds.jwt.JWT;
-
-/**
- * Add the {@link JWT} back to the {@link EntityStatementContext}.
- */
-public class EntityStatementUpdateStrategy implements BiConsumer<JWT, MessageContext> {
-
- /** Strategy used to locate the subcontext with the statement. */
- @Nonnull private Function<MessageContext,EntityStatementContext> entityStatementContextLookupStrategy;
-
- /**
- * Constructor.
- */
- public EntityStatementUpdateStrategy() {
- final Function<MessageContext,EntityStatementContext> escls =
- new ChildContextLookup<>(EntityStatementContext.class);
- assert escls != null;
- entityStatementContextLookupStrategy = escls;
- }
-
- /** {@inheritDoc} */
- @Override
- public void accept(final JWT jwt, final MessageContext messageContext) {
- if (messageContext == null) {
- return;
- }
- final EntityStatementContext entityStatementCtx = entityStatementContextLookupStrategy.apply(messageContext);
- if (entityStatementCtx == null) {
- return;
- }
- entityStatementCtx.setJWT(jwt);
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormExplicitRegistrationResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormExplicitRegistrationResponse.java
index bd6be85..1c81cf2 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormExplicitRegistrationResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormExplicitRegistrationResponse.java
@@ -27,8 +27,9 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationResponse;
import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.oidfed.messaging.impl.ExplicitClientRegistrationResponse;
+import net.shibboleth.oidfed.profile.impl.EntityStatementContext;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundFederationConfigurationResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundFederationConfigurationResponse.java
deleted file mode 100644
index 2060a74..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundFederationConfigurationResponse.java
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-import org.slf4j.Logger;
-
-import com.nimbusds.jwt.SignedJWT;
-import com.nimbusds.oauth2.sdk.Response;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.EntityConfigurationResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.CachedSuccessResponseLifetimeLookupFunction;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * This action builds a response for the OpenID federation configuration request. The response contains an
- * {@link SignedJWT} obtained from {@link EntityStatementContext#getJWT()}.
- */
-public class FormOutboundFederationConfigurationResponse extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(FormOutboundFederationConfigurationResponse.class);
-
- /** Metadata cache for cached response containers. */
- @NonnullAfterInit private MetadataCache<NimbusResponseContainer> responseCache;
-
- /** Strategy used to locate the cached message context. */
- @Nonnull
- private Function<ProfileRequestContext, RelyingPartyCachedMessageContext> cachedMessageContextLookupStrategy;
-
- /** Strategy used to locate the subcontext to hold the statement. */
- @Nonnull private Function<ProfileRequestContext,EntityStatementContext> entityStatementContextLookupStrategy;
-
- /** Strategy used to locate the lifetime for the cached response record. */
- @Nonnull private Function<ProfileRequestContext,Duration> cachedResponseLifetimeLookupStrategy;
-
- /** JWT used to build entity statement. */
- @Nullable private SignedJWT jwt;
-
- /** The resolve entity context to operate on. */
- @NonnullBeforeExec private RelyingPartyCachedMessageContext cachedMessageContext;
-
- /**
- * Constructor.
- */
- public FormOutboundFederationConfigurationResponse() {
- final Function<ProfileRequestContext,EntityStatementContext> escls =
- new ChildContextLookup<>(EntityStatementContext.class).compose(
- new OutboundMessageContextLookup());
- assert escls != null;
- entityStatementContextLookupStrategy = escls;
- cachedMessageContextLookupStrategy = new ChildContextLookup<>(RelyingPartyCachedMessageContext.class);
- cachedResponseLifetimeLookupStrategy = new CachedSuccessResponseLifetimeLookupFunction();
- }
-
- /**
- * Set the strategy used to locate the subcontext to hold the statement
- *
- * @param strategy What to set.
- */
- public void setEntityStatementContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,EntityStatementContext> strategy) {
- checkSetterPreconditions();
- entityStatementContextLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null!");
- }
-
- /**
- * Set the strategy used to locate the cached message context
- *
- * @param strategy What to set.
- */
- public void setCachedMessageContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,RelyingPartyCachedMessageContext> strategy) {
- checkSetterPreconditions();
- cachedMessageContextLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null!");
- }
-
- /**
- * Set the metadata cache for cached response containers.
- *
- * @param cache What to set.
- */
- public void setResponseCache(@Nonnull final MetadataCache<NimbusResponseContainer> cache) {
- checkSetterPreconditions();
- responseCache = Constraint.isNotNull(cache, "Response metadata cache cannot be null");
- }
-
- /**
- * Set the strategy used to locate the lifetime for the cached response record.
- *
- * @param strategy What to set.
- */
- public void setCachedResponseLifetimeLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, Duration> strategy) {
- checkSetterPreconditions();
- cachedResponseLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (responseCache == null) {
- throw new ComponentInitializationException("Response metadata cache cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
- cachedMessageContext = cachedMessageContextLookupStrategy.apply(profileRequestContext);
- if (cachedMessageContext == null) {
- log.error("{} Could not resolve cached message context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final Response cachedResponse = cachedMessageContext.getCachedResponse();
- if (cachedResponse != null) {
- log.debug("{} Cached response found, storing in to the outbound message context", getLogPrefix());
- profileRequestContext.ensureOutboundMessageContext().setMessage(cachedResponse);
- return;
- }
- log.debug("{} No cached response found, resolving the response JWT from the context", getLogPrefix());
- final EntityStatementContext entityStatementContext =
- entityStatementContextLookupStrategy.apply(profileRequestContext);
- if (entityStatementContext == null) {
- log.error("{} Could not resolve entity statement context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return;
- }
- if (entityStatementContext.getJWT() instanceof SignedJWT signedJwt) {
- jwt = signedJwt;
- } else {
- log.error("{} No signed JWT found from the entity statement context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return;
- }
-
- assert jwt != null;
- final EntityConfigurationResponse response = new EntityConfigurationResponse(jwt);
- final NimbusResponseCriterion responseCriterion = new NimbusResponseCriterion(response);
- final Duration lifetime = cachedResponseLifetimeLookupStrategy.apply(profileRequestContext);
- if (lifetime == null) {
- log.error("{} Could not resolve lifetime for the cached response record", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return;
- }
- final Instant expiration = Instant.now().plus(lifetime);
- assert expiration != null;
- final ResponseContainerExpirationCriterion expirationCriterion =
- new ResponseContainerExpirationCriterion(expiration);
- final CriteriaSet criteria = new CriteriaSet(responseCriterion, expirationCriterion);
- try {
- final List<NimbusResponseContainer> result = responseCache.get(criteria);
- if (result.size() != 1) {
- log.error("{} Unexpected result (size={}) when storing response record into the metadata cache",
- getLogPrefix(), result.size());
- } else {
- log.debug("{} Response stored into the cache", getLogPrefix());
- }
- } catch (final MetadataCacheException e) {
- log.error("{} Could not store the response record into tht metadata cache", getLogPrefix(), e);
- }
-
- profileRequestContext.ensureOutboundMessageContext().setMessage(response);
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundResolveEntityResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundResolveEntityResponse.java
index 2f8b3a7..99d1ecb 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundResolveEntityResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundResolveEntityResponse.java
@@ -32,16 +32,18 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.Response;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityRequestCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityResponseContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.CachedSuccessResponseLifetimeLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityRequest;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityResponse;
+import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.oidfed.metadata.cache.local.NimbusResponseCriterion;
+import net.shibboleth.oidfed.metadata.cache.local.ResolveEntityRequestCriterion;
+import net.shibboleth.oidfed.metadata.cache.resolver.ResolveEntityResponseContainer;
+import net.shibboleth.oidfed.profile.config.navigate.CachedSuccessResponseLifetimeLookupFunction;
+import net.shibboleth.oidfed.profile.impl.EntityStatementContext;
+import net.shibboleth.oidfed.profile.impl.RelyingPartyCachedMessageContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundSignedKeysetResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundSignedKeysetResponse.java
index 48b3ae9..c1f62a0 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundSignedKeysetResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/FormOutboundSignedKeysetResponse.java
@@ -32,14 +32,16 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.Response;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.SignedKeysetResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.CachedSuccessResponseLifetimeLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.messaging.impl.SignedKeysetResponse;
+import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.oidfed.metadata.cache.local.NimbusResponseContainer;
+import net.shibboleth.oidfed.metadata.cache.local.NimbusResponseCriterion;
+import net.shibboleth.oidfed.profile.config.navigate.CachedSuccessResponseLifetimeLookupFunction;
+import net.shibboleth.oidfed.profile.impl.EntityStatementContext;
+import net.shibboleth.oidfed.profile.impl.RelyingPartyCachedMessageContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/InitializeEntityStatementContext.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/InitializeEntityStatementContext.java
deleted file mode 100644
index a31db5e..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/InitializeEntityStatementContext.java
+++ /dev/null
@@ -1,199 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Optional;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-import org.slf4j.Logger;
-
-import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
-
-import net.shibboleth.idp.plugin.oidc.op.metadata.resolver.ProviderMetadataResolver;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl.MetadataImpl;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.primitive.NonnullSupplier;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-
-/**
- * Action that creates and initializes the {@link EntityStatementContext}.
- *
- * @event {@link EventIds#PROCEED_EVENT_ID}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link EventIds#IO_ERROR}
- */
-public class InitializeEntityStatementContext extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(InitializeEntityStatementContext.class);
-
- /** The resolver for the metadata that is being distributed. */
- @NonnullAfterInit private ProviderMetadataResolver metadataResolver;
-
- /** Strategy used to locate skeleton for the metadata claim. */
- @NonnullAfterInit
- private Function<CriteriaSet,Map<String,Map<String,Object>>> metadataSkeletonLookupStrategy;
-
- /** Strategy used to create the subcontext to hold the statement. */
- @Nonnull private Function<ProfileRequestContext,EntityStatementContext> entityStatementContextCreationStrategy;
-
- /** Entity statement context. */
- @NonnullBeforeExec private EntityStatementContext entityStatementCtx;
-
- /** Metadata skeleton. */
- @NonnullBeforeExec private Map<String,Map<String,Object>> metadataSkeleton;
-
- /** Constructor. */
- public InitializeEntityStatementContext() {
- final Function<ProfileRequestContext,EntityStatementContext> esccs =
- new ChildContextLookup<>(EntityStatementContext.class, true).compose(
- new OutboundMessageContextLookup());
- assert esccs != null;
- entityStatementContextCreationStrategy = esccs;
- }
-
- /**
- * Set the resolver for the metadata that is being distributed.
- *
- * @param resolver What to set.
- */
- public void setMetadataResolver(@Nonnull final ProviderMetadataResolver resolver) {
- metadataResolver = Constraint.isNotNull(resolver, "The metadata resolver cannot be null!");
- }
-
- /**
- * Set the strategy used to locate skeleton for the metadata claim.
- *
- * @param strategy lookup strategy
- */
- public void setMetadataSkeletonLookupStrategy(
- @Nonnull final Function<CriteriaSet,Map<String,Map<String,Object>>> strategy) {
- checkSetterPreconditions();
-
- metadataSkeletonLookupStrategy =
- Constraint.isNotNull(strategy, "MetadataSkeletonLookupStrategy cannot be null");
- }
-
- /**
- * Set the strategy used to create the {@link EntityStatementContext} to use.
- *
- * @param strategy creation strategy
- */
- public void setEntityStatementContextCreationStrategy(
- @Nonnull final Function<ProfileRequestContext,EntityStatementContext> strategy) {
- checkSetterPreconditions();
-
- entityStatementContextCreationStrategy =
- Constraint.isNotNull(strategy, "EntityStatementContext creation strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (metadataResolver == null) {
- throw new ComponentInitializationException("The metadata resolver cannot be null!");
- }
- if (metadataSkeletonLookupStrategy == null) {
- throw new ComponentInitializationException("MetadataSkeletonLookupStrategy cannot be null");
- }
- }
-
- // Checkstyle: CyclomaticComplexity|MethodLength OFF
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- entityStatementCtx = entityStatementContextCreationStrategy.apply(profileRequestContext);
- if (entityStatementCtx == null) {
- log.error("{} Unable to create EntityStatementContext", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- metadataSkeleton = Optional.ofNullable(metadataSkeletonLookupStrategy.apply(new CriteriaSet()))
- .orElseGet(NonnullSupplier.of(CollectionSupport.emptyMap()));
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final OIDCProviderMetadata metadata;
- try {
- metadata = metadataResolver.resolveSingle(profileRequestContext);
- } catch (final ResolverException e) {
- log.error("{} Could not resolve provider metadata", getLogPrefix(), e);
- ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
- return;
- }
- if (metadata == null) {
- log.error("{} Could not resolve provider metadata", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
- return;
- }
- //TODO more types? (esp. OAuth2 AS)
- final Map<String, Object> metadataMap = metadata.toJSONObject();
- assert metadataSkeleton != null; assert metadataMap != null;
- entityStatementCtx.setMetadata(mergeMetadata(metadataSkeleton, "openid_provider", metadataMap));
- }
-
- /**
- * Merge the given key and input to the given metadata skeleton. The input will overwrite the possibly existing
- * values for the same key.
- *
- * @param metadata the metadata skeleton
- * @param key the key in the skeleton to be merged
- * @param input the data to be merged (overwrites possibly already existing attributes)
- * @return the merged metadata
- */
- protected Metadata mergeMetadata(@Nonnull final Map<String,Map<String,Object>> metadata,
- @Nonnull final String key, @Nonnull final Map<String,Object> input) {
- final Map<String,Map<String,Object>> result = new HashMap<>(metadata);
- final Map<String,Object> base = metadata.get(key);
- if (base != null) {
- final Map<String,Object> values = new HashMap<>(base);
- values.putAll(input);
- result.put(key, values);
- } else {
- result.put(key, input);
- }
- return new MetadataImpl(result);
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/InitializeEntityStatementContextForKeyset.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/InitializeEntityStatementContextForKeyset.java
index 61010a7..40db840 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/InitializeEntityStatementContextForKeyset.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/InitializeEntityStatementContextForKeyset.java
@@ -34,6 +34,7 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.oidc.profile.config.JSONSecurityConfiguration;
import net.shibboleth.oidc.security.CredentialConversionUtil;
+import net.shibboleth.oidfed.profile.impl.EntityStatementContext;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/JWTClaimsSetFromEntityStatementLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/JWTClaimsSetFromEntityStatementLookupFunction.java
deleted file mode 100644
index 22c5f22..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/JWTClaimsSetFromEntityStatementLookupFunction.java
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import java.text.ParseException;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.slf4j.Logger;
-
-import com.nimbusds.jwt.JWT;
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Extract the {@link JWTClaimsSet} from the JWT in {@link EntityStatementContext}.
- */
-public class JWTClaimsSetFromEntityStatementLookupFunction implements Function<MessageContext, JWTClaimsSet> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(JWTClaimsSetFromEntityStatementLookupFunction.class);
-
- /** Strategy used to locate the subcontext with the token. */
- @Nonnull private Function<MessageContext,EntityStatementContext> entityStatementContextLookupStrategy;
-
- /**
- * Constructor.
- */
- public JWTClaimsSetFromEntityStatementLookupFunction() {
- // message context -> OIDC response context -> ATC
- final Function<MessageContext,EntityStatementContext> escl = new ChildContextLookup<>(EntityStatementContext.class);
- assert escl != null;
- entityStatementContextLookupStrategy = escl;
- }
-
- /**
- * Set the strategy used to lookup the {@link EntityStatementContext} to use.
- *
- * @param strategy lookup strategy
- */
- public void setEntityStatementContextCreationStrategy(
- @Nonnull final Function<MessageContext,EntityStatementContext> strategy) {
- entityStatementContextLookupStrategy =
- Constraint.isNotNull(strategy, "EntityStatementContext lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public JWTClaimsSet apply(@Nullable final MessageContext messageContext) {
- if (messageContext == null) {
- return null;
- }
- final EntityStatementContext entityStatementCtx = entityStatementContextLookupStrategy.apply(messageContext);
- if (entityStatementCtx == null) {
- return null;
- }
- final JWT jwt = entityStatementCtx.getJWT();
- try {
- if (jwt != null) {
- return jwt.getJWTClaimsSet();
- }
- } catch (final ParseException e) {
- log.error("Could not fetch the claims set from entity statement", e);
- }
- return null;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedNimbusResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedNimbusResponse.java
deleted file mode 100644
index fd36f36..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedNimbusResponse.java
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.NimbusResponseContainer;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Lookup if a cached response already exists for entity statement. If yes, the response is
- * stored into {@link RelyingPartyCachedMessageContext} and a corresponding event ID is published.
- *
- * @event {@link EventIds#PROCEED_EVENT_ID}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link OidFederationEventIds#CACHED_RESPONSE_FOUND}
- */
-public class LookupCachedNimbusResponse extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(LookupCachedNimbusResponse.class);
-
- /** Strategy used to create the cached message context. */
- @Nonnull
- private Function<ProfileRequestContext, RelyingPartyCachedMessageContext> cachedMessageContextCreationStrategy;
-
- /** Metadata cache for cached response containers. */
- @NonnullAfterInit private MetadataCache<NimbusResponseContainer> responseCache;
-
- /** Cached message context to operate on. */
- @NonnullBeforeExec private RelyingPartyCachedMessageContext cachedMessageContext;
-
- /**
- * Constructor.
- */
- public LookupCachedNimbusResponse() {
- final Function<ProfileRequestContext, RelyingPartyCachedMessageContext> recls =
- new ChildContextLookup<>(RelyingPartyCachedMessageContext.class, true);
- assert recls != null;
- cachedMessageContextCreationStrategy = recls;
- }
-
- /**
- * Set the strategy used to create the cached message context
- *
- * @param strategy What to set.
- */
- public void setCachedMessageContextCreationStrategy(
- @Nonnull final Function<ProfileRequestContext,RelyingPartyCachedMessageContext> strategy) {
- checkSetterPreconditions();
- cachedMessageContextCreationStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null!");
- }
-
- /**
- * Set the metadata cache for cached response containers.
- *
- * @param cache What to set.
- */
- public void setResponseCache(@Nonnull final MetadataCache<NimbusResponseContainer> cache) {
- checkSetterPreconditions();
- responseCache = Constraint.isNotNull(cache, "Response metadata cache cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (responseCache == null) {
- throw new ComponentInitializationException("Response metadata cache cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- cachedMessageContext = cachedMessageContextCreationStrategy.apply(profileRequestContext);
- if (cachedMessageContext == null) {
- log.error("{} Could not create cached response context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final CriteriaSet criteria = new CriteriaSet();
- try {
- final List<NimbusResponseContainer> result = responseCache.get(criteria);
- if (result.size() != 1) {
- log.debug("{} No cached response record found from the metadata cache", getLogPrefix(), result.size());
- } else {
- final NimbusResponseContainer cachedResponse = result.get(0);
- cachedMessageContext.setCachedResponse(cachedResponse.getResponse());
- log.debug("{} Response found from the cache, publishing event {}", getLogPrefix(),
- OidFederationEventIds.CACHED_RESPONSE_FOUND);
- ActionSupport.buildEvent(profileRequestContext,
- OidFederationEventIds.CACHED_RESPONSE_FOUND);
- return;
- }
- } catch (final MetadataCacheException e) {
- log.error("{} Could not fetch response record from the metadata cache", getLogPrefix(), e);
- }
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedResolveEntityResponse.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedResolveEntityResponse.java
index 76d1f8e..e6a5632 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedResolveEntityResponse.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/LookupCachedResolveEntityResponse.java
@@ -26,12 +26,13 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityRequestCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityResponseContainer;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityRequest;
+import net.shibboleth.oidfed.metadata.cache.local.ResolveEntityRequestCriterion;
+import net.shibboleth.oidfed.metadata.cache.local.ResolveEntityResponseContainer;
+import net.shibboleth.oidfed.profile.impl.RelyingPartyCachedMessageContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ProviderMetadataEntityConfigurationMetadataDecorator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ProviderMetadataEntityConfigurationMetadataDecorator.java
new file mode 100644
index 0000000..2a8ea0b
--- /dev/null
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ProviderMetadataEntityConfigurationMetadataDecorator.java
@@ -0,0 +1,174 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
+
+import java.util.Map;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
+import org.slf4j.Logger;
+
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+
+import net.shibboleth.idp.plugin.oidc.op.metadata.resolver.ProviderMetadataResolver;
+import net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration;
+import net.shibboleth.oidfed.profile.EntityConfigurationMetadataDecorator;
+import net.shibboleth.oidfed.profile.impl.EntityStatementContext;
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.ConstraintViolationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.resolver.ResolverException;
+
+/**
+ * An {@link EntityConfigurationMetadataDecorator} that populates openid_provider entity type with the OpenID provider
+ * metadata resolved via configurable {@link ProviderMetadataResolver}.
+ *
+ * Before the resolver is called, the profile configuration is set into {@link OIDCProviderInformationConfiguration}
+ * that is expected to be found in the current {@link RelyingPartyConfiguration}.
+ */
+public class ProviderMetadataEntityConfigurationMetadataDecorator extends AbstractIdentifiableInitializableComponent
+ implements EntityConfigurationMetadataDecorator {
+
+ /** Class logger. */
+ @Nonnull private final Logger log =
+ LoggerFactory.getLogger(ProviderMetadataEntityConfigurationMetadataDecorator.class);
+
+ /** The resolver for the metadata that is being distributed. */
+ @NonnullAfterInit private ProviderMetadataResolver metadataResolver;
+
+ /** Strategy used to locate the subcontext to hold the statement. */
+ @Nonnull private Function<ProfileRequestContext,EntityStatementContext> entityStatementContextLookupStrategy;
+
+ /** Strategy used to locate the relying party context. */
+ @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyContextLookupStrategy;
+
+ /**
+ * Constructor.
+ */
+ public ProviderMetadataEntityConfigurationMetadataDecorator() {
+ final Function<ProfileRequestContext,EntityStatementContext> escls =
+ new ChildContextLookup<>(EntityStatementContext.class, false).compose(
+ new OutboundMessageContextLookup());
+ assert escls != null;
+ entityStatementContextLookupStrategy = escls;
+ final Function<ProfileRequestContext,RelyingPartyContext> rpcls =
+ new ChildContextLookup<>(RelyingPartyContext.class, false);
+ assert rpcls != null;
+ relyingPartyContextLookupStrategy = rpcls;
+ }
+
+ /**
+ * Set the resolver for the metadata that is being distributed.
+ *
+ * @param resolver What to set.
+ */
+ public void setMetadataResolver(@Nonnull final ProviderMetadataResolver resolver) {
+ metadataResolver = Constraint.isNotNull(resolver, "The metadata resolver cannot be null!");
+ }
+
+ /**
+ * Set the strategy used to locate the {@link EntityStatementContext} to use.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setEntityStatementContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,EntityStatementContext> strategy) {
+ checkSetterPreconditions();
+
+ entityStatementContextLookupStrategy =
+ Constraint.isNotNull(strategy, "EntityStatementContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the strategy used to locate the {@link RelyingPartyContext} to use.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
+ checkSetterPreconditions();
+ relyingPartyContextLookupStrategy = Constraint.isNotNull(strategy,
+ "RelyingPartyContext lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (metadataResolver == null) {
+ throw new ComponentInitializationException("The metadata resolver cannot be null!");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void accept(@Nullable final Map<String, Map<String, Object>> metadata,
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ checkComponentActive();
+ if (metadata == null || profileRequestContext == null) {
+ log.error("Metadata {} nor profile request context {} cannot be null", metadata, profileRequestContext);
+ throw new ConstraintViolationException("Metadata nor profile request context cannot be null");
+ }
+ final EntityStatementContext entityStatementCtx =
+ entityStatementContextLookupStrategy.apply(profileRequestContext);
+ if (entityStatementCtx == null) {
+ log.error("Unable to find EntityStatementContext");
+ return;
+ }
+ final RelyingPartyContext relyingPartyCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
+ if (relyingPartyCtx == null || relyingPartyCtx.getConfiguration() == null) {
+ log.error("Unable to find relying party configuration");
+ return;
+ }
+ final RelyingPartyConfiguration rpConfig = relyingPartyCtx.getConfiguration();
+ assert rpConfig != null;
+ final ProfileConfiguration profileConfiguration = rpConfig.getProfileConfiguration(profileRequestContext,
+ OIDCProviderInformationConfiguration.PROFILE_ID);
+ if (profileConfiguration == null) {
+ log.warn("Unable to find profile configuration for OIDC.Configuration");
+ return;
+ }
+ relyingPartyCtx.setProfileConfig(profileConfiguration);
+ final OIDCProviderMetadata providerMetadata;
+ try {
+ providerMetadata = metadataResolver.resolveSingle(profileRequestContext);
+ } catch (final ResolverException e) {
+ log.error("Could not resolve provider metadata", e);
+ return;
+ }
+ if (providerMetadata == null) {
+ log.error("Could not resolve provider metadata");
+ return;
+ }
+ log.trace("Resolved openid_provider metadata {}", providerMetadata.toJSONObject());
+ if (metadata.containsKey("openid_provider")) {
+ metadata.get("openid_provider").putAll(providerMetadata.toJSONObject());
+ } else {
+ metadata.put("openid_provider", providerMetadata.toJSONObject());
+ }
+ }
+}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/RelyingPartyCachedMessageContext.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/RelyingPartyCachedMessageContext.java
deleted file mode 100644
index eaee2e5..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/RelyingPartyCachedMessageContext.java
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.BaseContext;
-
-import com.nimbusds.oauth2.sdk.Request;
-import com.nimbusds.oauth2.sdk.Response;
-
-/**
- * Subcontext carrying information for request and response messages related to a relying party.
- */
-public final class RelyingPartyCachedMessageContext extends BaseContext {
-
- /** Validated (possibly modified) request message. */
- @Nullable private Request validatedRequest;
-
- /** Cached response message. */
- @Nullable private Response cachedResponse;
-
- /**
- * Get the validated (possibly modified) resolve entity request.
- *
- * @return the validated request
- */
- @Nullable public Request getValidatedRequest() {
- return validatedRequest;
- }
-
- /**
- * Set the the validated (possibly modified) resolve entity request.
- *
- * @param request the validated request
- * @return this context
- */
- @Nonnull public RelyingPartyCachedMessageContext setValidatedRequest(@Nullable final Request request) {
- validatedRequest = request;
- return this;
- }
-
- /**
- * Get the cached response message.
- *
- * @return the cached response
- */
- @Nullable public Response getCachedResponse() {
- return cachedResponse;
- }
-
- /**
- * Set the cached response message.
- *
- * @param response cached response
- * @return this context
- */
- @Nonnull public RelyingPartyCachedMessageContext setCachedResponse(@Nullable final Response response) {
- cachedResponse = response;
- return this;
- }
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java
index 1ca9a89..d89334a 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustChains.java
@@ -32,17 +32,17 @@ import org.slf4j.Logger;
import com.nimbusds.oauth2.sdk.id.ClientID;
import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.TrustChainsContainer;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultPreSelectedTrustChainIDsLookupStrategy;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustChainIDsLookupStrategy;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.oidfed.metadata.cache.trustchain.TrustChainsContainer;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.CollectionSupport;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java
index 9ea5e9b..76addf5 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ResolveTrustMarks.java
@@ -39,12 +39,6 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.TrustMarkOwnersCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.TrustChainsContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.TrustMarkOwner;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
import net.shibboleth.idp.profile.AbstractProfileAction;
@@ -52,6 +46,12 @@ import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.oidfed.metadata.cache.TrustMarkOwnersCriterion;
+import net.shibboleth.oidfed.metadata.cache.trustchain.TrustChainsContainer;
+import net.shibboleth.oidfed.metadata.payload.claim.TrustMarkOwner;
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/SelectTrustChain.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/SelectTrustChain.java
index e6702d7..493467d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/SelectTrustChain.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/SelectTrustChain.java
@@ -26,11 +26,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustChainSelectionStrategy;
import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.oidfed.metadata.EntityStatement;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateAutomaticRegistrationProfileConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateAutomaticRegistrationProfileConfiguration.java
index 758f368..7affc9b 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateAutomaticRegistrationProfileConfiguration.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateAutomaticRegistrationProfileConfiguration.java
@@ -33,20 +33,20 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl.MetadataImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.ClaimsSetDecorationTypeLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.LocalMetadataPolicyLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.MandatoryTrustMarksLookupFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.ProvidedChainClaimsSetDecorationTypeLookupFunction;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.AutomaticRegistrationContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultSelectedTrustChainMetadataLookupStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.support.ClientInformationExtensionSupport;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.payload.claim.impl.MetadataImpl;
+import net.shibboleth.oidfed.profile.config.navigate.ClaimsSetDecorationTypeLookupFunction;
+import net.shibboleth.oidfed.profile.config.navigate.LocalMetadataPolicyLookupFunction;
+import net.shibboleth.oidfed.profile.config.navigate.MandatoryTrustMarksLookupFunction;
+import net.shibboleth.oidfed.profile.config.navigate.ProvidedChainClaimsSetDecorationTypeLookupFunction;
+import net.shibboleth.oidfed.support.ClientInformationExtensionSupport;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateProvidedEntityConfiguration.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateProvidedEntityConfiguration.java
index aaf7b95..8158b01 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateProvidedEntityConfiguration.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateProvidedEntityConfiguration.java
@@ -24,8 +24,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.oidfed.metadata.EntityStatement;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateProvidedTrustChain.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateProvidedTrustChain.java
index 51379a2..0899ce9 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateProvidedTrustChain.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateProvidedTrustChain.java
@@ -26,10 +26,10 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.ProvidedTrustChainResolver;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.profile.ProvidedTrustChainResolver;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.CollectionSupport;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateResolveEntityRequest.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateResolveEntityRequest.java
index 9f7e6bb..683e6b7 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateResolveEntityRequest.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateResolveEntityRequest.java
@@ -31,12 +31,13 @@ import org.slf4j.Logger;
import com.nimbusds.oauth2.sdk.Request;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityRequest;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.local.LocalKeyContainer;
+import net.shibboleth.oidfed.profile.impl.RelyingPartyCachedMessageContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateSelectedTrustChain.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateSelectedTrustChain.java
index 7e9913f..0fb28c4 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateSelectedTrustChain.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateSelectedTrustChain.java
@@ -25,15 +25,16 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityRequest;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
+import net.shibboleth.oidfed.profile.impl.RelyingPartyCachedMessageContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.CollectionSupport;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateTrustMarks.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateTrustMarks.java
index 0cb57ae..d11ef44 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateTrustMarks.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/impl/ValidateTrustMarks.java
@@ -32,16 +32,16 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkStatusCacheIdentifier;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkStatusContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkStatusIdentifierCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.RemoteTrustMarkValidationPredicate;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.cache.trustmark.TrustMarkStatusCacheIdentifier;
+import net.shibboleth.oidfed.metadata.cache.trustmark.TrustMarkStatusContainer;
+import net.shibboleth.oidfed.metadata.cache.trustmark.TrustMarkStatusIdentifierCriterion;
+import net.shibboleth.oidfed.profile.config.navigate.RemoteTrustMarkValidationPredicate;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.collection.CollectionSupport;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/logic/DefaultProvidedEntityConfigurationValidationStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/logic/DefaultProvidedEntityConfigurationValidationStrategy.java
index 54603bb..936497b 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/logic/DefaultProvidedEntityConfigurationValidationStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/logic/DefaultProvidedEntityConfigurationValidationStrategy.java
@@ -23,13 +23,13 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.ProvidedEntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.ProvidedEntityConfigurationContainerCriterion;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
+import net.shibboleth.oidfed.metadata.cache.configuration.ProvidedEntityConfigurationContainer;
+import net.shibboleth.oidfed.metadata.cache.configuration.ProvidedEntityConfigurationContainerCriterion;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/logic/DefaultProvidedTrustChainValidationStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/logic/DefaultProvidedTrustChainValidationStrategy.java
index 97ee6c1..e95e53e 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/logic/DefaultProvidedTrustChainValidationStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/logic/DefaultProvidedTrustChainValidationStrategy.java
@@ -23,12 +23,12 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.TrustChainsContainer;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainer;
+import net.shibboleth.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion;
+import net.shibboleth.oidfed.metadata.cache.trustchain.TrustChainsContainer;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/AbstractRequestObjectProvidedTrustChainResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/AbstractRequestObjectProvidedTrustChainResolver.java
index 139b193..e93006f 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/AbstractRequestObjectProvidedTrustChainResolver.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/AbstractRequestObjectProvidedTrustChainResolver.java
@@ -27,9 +27,9 @@ import com.fasterxml.jackson.databind.ObjectMapper;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.ProvidedTrustChainResolver;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.util.EntityStatementHelper;
+import net.shibboleth.oidfed.profile.ProvidedTrustChainResolver;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultCombinedMetadataFromTrustChainLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultCombinedMetadataFromTrustChainLookupStrategy.java
index d08b3c1..618dfdb 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultCombinedMetadataFromTrustChainLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultCombinedMetadataFromTrustChainLookupStrategy.java
@@ -25,7 +25,7 @@ import javax.annotation.Nullable;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.EntityStatement;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultEntityConfigurationTrustMarksLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultEntityConfigurationTrustMarksLookupStrategy.java
deleted file mode 100644
index fd2f506..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultEntityConfigurationTrustMarksLookupStrategy.java
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * Default strategy to fetch trust marks to be included in the entity configuration.
- */
-public class DefaultEntityConfigurationTrustMarksLookupStrategy extends AbstractIdentifiableInitializableComponent
- implements Function<ProfileRequestContext,List<Map<String,String>>> {
-
- /** Lookup strategies to fetch trust mark values to be included in the entity configuration. */
- @Nonnull private List<Function<ProfileRequestContext,Map<String,String>>> trustMarkLookupStrategies;
-
- /**
- * Constructor.
- */
- public DefaultEntityConfigurationTrustMarksLookupStrategy() {
- trustMarkLookupStrategies = CollectionSupport.emptyList();
- }
-
- /**
- * Set the lookup strategies to fetch trust mark values to be included in the entity configuration.
- *
- * @param strategies lookup strategies
- */
- public void setTrustMarkLookupStrategies(
- @Nonnull final List<Function<ProfileRequestContext,Map<String,String>>> strategies) {
- checkSetterPreconditions();
- Constraint.isNotNull(strategies, "Trust mark lookup strategies cannot be null");
- trustMarkLookupStrategies = strategies;
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull
- public List<Map<String, String>> apply(@Nullable final ProfileRequestContext profileRequestContext) {
- checkComponentActive();
- final List<Map<String, String>> trustMarks = new ArrayList<>();
- for (final Function<ProfileRequestContext,Map<String,String>> strategy : trustMarkLookupStrategies) {
- if (strategy == null) {
- continue;
- }
- Optional.ofNullable(strategy.apply(profileRequestContext))
- .filter(trustMark -> trustMark != null && !trustMark.isEmpty())
- .ifPresent(trustMark -> trustMarks.add(trustMark));
-
- }
- return CollectionSupport.copyToList(trustMarks);
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultEntityTypesLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultEntityTypesLookupFunction.java
index 7ba6c81..e2bd6d2 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultEntityTypesLookupFunction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultEntityTypesLookupFunction.java
@@ -22,7 +22,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityRequest;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.NonnullSupplier;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultSelectedTrustChainIDsLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultSelectedTrustChainIDsLookupStrategy.java
index b60a7a9..548abd7 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultSelectedTrustChainIDsLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultSelectedTrustChainIDsLookupStrategy.java
@@ -21,8 +21,8 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
+import net.shibboleth.oidfed.metadata.EntityStatement;
import net.shibboleth.shared.logic.Constraint;
/**
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java
deleted file mode 100644
index a46383d..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustAnchorHintsLookupStrategy.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * Default strategy to fetch value for the trust_amchor_hints -claim. The value is fetched from the configurable
- * {@link MetadataCache} containing trusted trust anchors.
- */
-public class DefaultTrustAnchorHintsLookupStrategy extends AbstractIdentifiableInitializableComponent
- implements Function<ProfileRequestContext,List<String>> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultTrustAnchorHintsLookupStrategy.class);
-
- /** Cache containing trusted trust anchors. */
- @NonnullAfterInit private MetadataCache<Map<String, LocalKeyContainer>> trustAnchorsCache;
-
- /**
- * Set the cache containing trusted trust anchors.
- *
- * @param cache trust anchors cache
- */
- public void setTrustAnchorsCache(
- @Nonnull final MetadataCache<Map<String, LocalKeyContainer>> cache) {
- checkSetterPreconditions();
- trustAnchorsCache = Constraint.isNotNull(cache, "Trust Anchors cache cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (trustAnchorsCache == null) {
- throw new ComponentInitializationException("Trust Anchors cache cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public List<String> apply(@Nullable final ProfileRequestContext profileRequestContext) {
- checkComponentActive();
- final List<Map<String, LocalKeyContainer>> keyContainers;
- try {
- keyContainers = trustAnchorsCache.get(new CriteriaSet());
- } catch (final MetadataCacheException e) {
- log.warn("Could not resolve any trust anchors", e);
- return null;
- }
- if (keyContainers.isEmpty()) {
- log.debug("No keycontainers returned from the trust anchor cache");
- return null;
- }
- return keyContainers.get(0).keySet().stream().filter(Objects::nonNull).toList();
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainIDsLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainIDsLookupStrategy.java
index 672dbaa..aec9433 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainIDsLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainIDsLookupStrategy.java
@@ -21,7 +21,7 @@ import java.util.stream.IntStream;
import javax.annotation.Nullable;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.EntityStatement;
/**
* Default strategy for looking up the entity IDs of a trust chain.
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainMetadataPolicyMergingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainMetadataPolicyMergingStrategy.java
index 3a03509..a694d6c 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainMetadataPolicyMergingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainMetadataPolicyMergingStrategy.java
@@ -23,9 +23,9 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.SubordinateStatementPayload;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.payload.SubordinateStatementPayload;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainSelectionStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainSelectionStrategy.java
index 3286716..62eb95d 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainSelectionStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainSelectionStrategy.java
@@ -21,9 +21,9 @@ import javax.annotation.Nullable;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.VerifiedTrustChain;
+import net.shibboleth.oidfed.metadata.EntityStatement;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustMarksParsingStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustMarksParsingStrategy.java
index 1efbc06..9e57474 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustMarksParsingStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustMarksParsingStrategy.java
@@ -29,8 +29,8 @@ import org.slf4j.Logger;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityConfigurationPayload;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.payload.EntityConfigurationPayload;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java
index e8d7703..ac9fc71 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustedTrustMarkIssuersLookupStrategy.java
@@ -22,8 +22,8 @@ import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityConfigurationPayload;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.payload.EntityConfigurationPayload;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java
index e5aefc3..a7da0cc 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/DefaultTrustChainTrustedTrustMarkOwnersLookupStrategy.java
@@ -24,9 +24,9 @@ import javax.annotation.concurrent.ThreadSafe;
import org.slf4j.Logger;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityConfigurationPayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.TrustMarkOwner;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.payload.EntityConfigurationPayload;
+import net.shibboleth.oidfed.metadata.payload.claim.TrustMarkOwner;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestClientIDLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestClientIDLookupFunction.java
index 29ef8c1..729285b 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestClientIDLookupFunction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestClientIDLookupFunction.java
@@ -25,9 +25,9 @@ import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import com.nimbusds.oauth2.sdk.id.ClientID;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.EntityStatement;
/**
* A function that returns client from the entity configuration in the explicit registration request.
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestEntityConfigurationLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestEntityConfigurationLookupFunction.java
index eec79c7..72cfdac 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestEntityConfigurationLookupFunction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestEntityConfigurationLookupFunction.java
@@ -22,8 +22,8 @@ import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
+import net.shibboleth.oidfed.metadata.EntityStatement;
/**
* A function that returns entity configuration set in the explicit registration request.
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestJWKSetLookupFunction.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestJWKSetLookupFunction.java
index 384d0f6..9152b6f 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestJWKSetLookupFunction.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestJWKSetLookupFunction.java
@@ -25,9 +25,9 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.nimbusds.jose.jwk.JWKSet;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.EntityStatement;
/**
* A function that returns {@link JWKSet} from the entity configuration in the explicit registration request.
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestTrustChainResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestTrustChainResolver.java
index 637f83e..181e421 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestTrustChainResolver.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/profile/navigate/ExplicitClientRegistrationRequestTrustChainResolver.java
@@ -23,9 +23,9 @@ import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.ProvidedTrustChainResolver;
+import net.shibboleth.oidfed.messaging.impl.ExplicitClientRegistrationRequest;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.profile.ProvidedTrustChainResolver;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.ResolverException;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/ClientInformationFederationEntityCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/ClientInformationFederationEntityCredentialResolver.java
deleted file mode 100644
index 652f23f..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/ClientInformationFederationEntityCredentialResolver.java
+++ /dev/null
@@ -1,127 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.support.ClientInformationExtensionSupport;
-import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
-import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
-import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
-import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-
-/**
- * A {@link JOSEObjectCredentialResolver} that resolves credentials from the entity configuration payload. The entity
- * configuration is fetched via client custom claim
- * {@link ClientInformationExtensionSupport#KEY_VALIDATED_TRUST_CHAIN}.
- */
-public class ClientInformationFederationEntityCredentialResolver extends BasicJOSEObjectCredentialResolver {
-
- /** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(ClientInformationFederationEntityCredentialResolver.class);
-
- /** Resolver for fetching federation entity credentials from entity configuration. */
- @Nonnull private final JOSEObjectCredentialResolver entityConfigurationCredentialResolver;
-
- /** Object mapper used for deserializing jwks from the entity configuration payload. */
- @Nonnull private final ObjectMapper objectMapper;
-
- /**
- * Constructor.
- *
- * @param resolver The resolver for fetching federation entity credentials from entity configuration.
- * @param mapper The object mapper used for deserializing jwks from the entity configuration payload.
- */
- public ClientInformationFederationEntityCredentialResolver(@Nonnull
- @ParameterName(name="entityConfigurationCredentialResolver") final JOSEObjectCredentialResolver resolver,
- @Nonnull @ParameterName(name="objectMapper") final ObjectMapper mapper) {
- entityConfigurationCredentialResolver = Constraint.isNotNull(resolver,
- "EntityConfigurationCredentialResolver cannot be null");
- objectMapper = Constraint.isNotNull(mapper, "ObjectMapper cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
- throws ResolverException {
-
- Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
-
- if (criteriaSet != null) {
- final ClientInformationCriterion clientCrit = criteriaSet.get(ClientInformationCriterion.class);
- if (clientCrit != null) {
- return resolveFromMetadata(criteriaSet, clientCrit.getOidcClientInformation());
- }
- }
-
- log.debug("Criteria did not contain a ClientInformationCriterion could not perform resolution");
- return CollectionSupport.emptySet();
- }
-
- /**
- * Resolve the keyset from the entity configuration payload.
- *
- * @param criteriaSet the criteria set
- * @param information the RP/Client information
- *
- * @return a collection of credentials from the entity configuration key set (if any).
- */
- @Nonnull protected Iterable<Credential> resolveFromMetadata(@Nonnull final CriteriaSet criteriaSet,
- @Nonnull final OIDCClientInformation information) throws ResolverException {
-
- final OIDCClientMetadata metadata = information.getOIDCMetadata();
-
- if (metadata.getCustomField(ClientInformationExtensionSupport.KEY_VALIDATED_TRUST_CHAIN)
- instanceof List<?> list) {
- final List<String> serialized =
- list.stream().filter(String.class::isInstance).map(String.class::cast).toList();
- assert serialized != null;
- final List<EntityStatement<?>> trustChain =
- EntityStatementHelper.deserializeTrustChain(serialized, objectMapper);
- if (trustChain != null) {
- final EntityStatement<?> configuration = trustChain.get(0);
- assert configuration != null;
- final SubjectEntityStatementCriterion configurationCriterion =
- new SubjectEntityStatementCriterion(configuration);
- log.debug("Returning credentials resolved via entity configuration credential resolver");
- return entityConfigurationCredentialResolver.resolve(new CriteriaSet(configurationCriterion));
- }
- } else {
- log.debug("Could not find the validated trust chain from the client metadata");
- }
- log.trace("Returning empty set of credentials");
- return CollectionSupport.emptySet();
- }
-
-}
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/ClientInformationSignedKeysetJWKSetDecorator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/ClientInformationSignedKeysetJWKSetDecorator.java
index a3dd70a..51641ed 100644
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/ClientInformationSignedKeysetJWKSetDecorator.java
+++ b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/ClientInformationSignedKeysetJWKSetDecorator.java
@@ -29,15 +29,15 @@ import org.slf4j.Logger;
import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.SignedKeysetContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.SubjectSignedKeysetUriCriterion;
import net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyTrustChainContext;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.oidc.security.credential.ClientInformationJWKSetDecorator;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.oidfed.metadata.cache.keyset.SignedKeysetContainer;
+import net.shibboleth.oidfed.metadata.cache.keyset.SubjectSignedKeysetUriCriterion;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultEntityConfigurationCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultEntityConfigurationCredentialResolver.java
deleted file mode 100644
index 260a517..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultEntityConfigurationCredentialResolver.java
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential;
-
-import java.util.List;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-
-/**
- * Resolves credentials from the jwks-claim located in the signed JWT (entity configuration) payload. The JWT is fetched
- * via {@link SubjectEntityStatementCriterion}. If the JWT is not self-signed (i.e. it's a subordinate statement), a
- * {@link ResolverException} is thrown.
- */
-public class DefaultEntityConfigurationCredentialResolver extends BasicJOSEObjectCredentialResolver {
-
- /** Logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultEntityConfigurationCredentialResolver.class);
-
- /** {@inheritDoc} */
- @Override
- protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
- if (criteriaSet == null) {
- throw new ResolverException("No criteria set supplied");
- }
-
- final List<Credential> result = parseJwkSet(criteriaSet).getKeys().stream()
- .map(jwk -> jwk != null ? buildJWKCredential(jwk, null) : null)
- .filter(Objects::nonNull)
- .map(Credential.class::cast)
- .toList();
- assert result != null;
- return result;
- }
-
- /**
- * Parses the JWKSet from the given criteria set.
- *
- * @param criteriaSet criteria set containing source JWT for the JWKSet
- * @return the JWKSet parsed from the JWT payload
- * @throws ResolverException if the JWKSet could not be parsed or found
- */
- @Nonnull protected JWKSet parseJwkSet(@Nonnull final CriteriaSet criteriaSet) throws ResolverException {
- final SubjectEntityStatementCriterion subjectCriterion = criteriaSet.get(SubjectEntityStatementCriterion.class);
- if (subjectCriterion == null) {
- log.debug("No mandatory SubjectEntityStatementCriterion criteria supplied, resolver could not process");
- throw new ResolverException(
- "Credential criteria set did not contain an instance of SubjectEntityStatementCriterion");
- }
- final JWKSet jwks;
- final EntityStatement<?> subjectStatement = subjectCriterion.getValue();
- if (subjectStatement.getSubject().equals(
- subjectStatement.getIssuer())) {
- jwks = subjectStatement.getParsedPayload().getJwks();
- } else {
- throw new ResolverException(
- "Unexpected contents in the SubjectEntityStatementCriterion: subject does not match issuer");
- }
-
- if (jwks == null || jwks.isEmpty()) {
- throw new ResolverException("Could not parse mandatory jwks");
- }
- return jwks;
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultLocalTrustAnchorCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultLocalTrustAnchorCredentialResolver.java
deleted file mode 100644
index 4c9be9c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultLocalTrustAnchorCredentialResolver.java
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-
-import com.nimbusds.jose.jwk.JWK;
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
-import net.shibboleth.oidc.metadata.cache.MetadataCache;
-import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
-import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
-import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-
-/**
- * Default resolver for trusted trust anchor key resolution. A configurable {@link MetadataCache} is used for fetching
- * the trusted/local public credentials for the entity referred via {@link SubjectEntityStatementCriterion}.
- */
-public class DefaultLocalTrustAnchorCredentialResolver extends BasicJOSEObjectCredentialResolver {
-
- /** Logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultLocalTrustAnchorCredentialResolver.class);
-
- /** Cache containing local copies of trusted trust anchor keys. */
- @Nonnull private MetadataCache<Map<String, LocalKeyContainer>> localTrustAnchorsCache;
-
- /**
- * Constructor.
- *
- * @param cache cache containing local copies of trusted trust anchor keys
- */
- public DefaultLocalTrustAnchorCredentialResolver(
- @Nonnull @ParameterName(name="cache") final MetadataCache<Map<String, LocalKeyContainer>> cache) {
- localTrustAnchorsCache = Constraint.isNotNull(cache, "Local Trust Anchors cache cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
- if (criteriaSet == null) {
- throw new ResolverException("No criteria supplied");
- }
- final SubjectEntityStatementCriterion subjectCriterion = criteriaSet.get(SubjectEntityStatementCriterion.class);
- if (subjectCriterion == null) {
- log.debug("No SubjectEntityStatementCriterion criteria supplied, resolver could not process");
- throw new ResolverException(
- "Credential criteria set did not contain an instance of SubjectEntityStatementCriterion");
- }
- final String entityId = subjectCriterion.getValue().getIssuer();
- log.debug("Attempting to find trusted keys for {}", entityId);
-
- final List<Map<String, LocalKeyContainer>> keyContainers;
- try {
- keyContainers = localTrustAnchorsCache.get(criteriaSet);
- } catch (final MetadataCacheException e) {
- throw new ResolverException("Could not resolve local trust anchor keys from the cache", e);
- }
- if (keyContainers.isEmpty() || !keyContainers.get(0).containsKey(entityId)) {
- log.debug("No keys found for {}", entityId);
- return CollectionSupport.emptyList();
- }
- final LocalKeyContainer keyContainer = keyContainers.get(0).get(entityId);
- if (keyContainer == null || keyContainer.getJWKSet() == null) {
- log.debug("No JWKSet found for {}", entityId);
- return CollectionSupport.emptyList();
- }
- final JWKSet jwkSet = keyContainer.getJWKSet();
- final List<Credential> credentials = new ArrayList<>();
- assert jwkSet != null;
- for (final JWK jwk : jwkSet.getKeys()) {
- if (jwk != null) {
- final Credential cred = buildJWKCredential(jwk, null);
- if (cred != null) {
- credentials.add(cred);
- }
- }
- }
- log.debug("Returning credentials {} for {}", credentials, entityId);
- return credentials;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadJOSEObjectCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadJOSEObjectCredentialResolver.java
deleted file mode 100644
index 86956ad..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadJOSEObjectCredentialResolver.java
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential;
-
-import java.text.ParseException;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-
-import com.nimbusds.jose.JOSEObject;
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
-import net.shibboleth.oidc.security.jose.criterion.JOSEObjectCriterion;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-
-/**
- * Resolves credentials from the jwks-claim located in the signed JWT (entity statement) payload. The JWT is fetched
- * via {@link JOSEObjectCriterion}.
- */
-public class DefaultPayloadJOSEObjectCredentialResolver extends BasicJOSEObjectCredentialResolver {
-
- /** Logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultPayloadJOSEObjectCredentialResolver.class);
-
- /** {@inheritDoc} */
- @Override
- protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
- if (criteriaSet == null || !criteriaSet.contains(JOSEObjectCriterion.class)) {
- throw new ResolverException("CriteriaSet does not contain JOSEObjectCriterion");
- }
-
- final JOSEObjectCriterion joseObjectCriteria = criteriaSet.get(JOSEObjectCriterion.class);
- assert joseObjectCriteria != null;
- final JOSEObject joseObject = joseObjectCriteria.getJOSEObject();
- if (joseObject == null) {
- throw new ResolverException("JOSEObjectCriterion did not contain an instance of JOSEObject");
- }
- try {
- final SignedJWT jwt = SignedJWT.parse(joseObject.serialize());
- final Map<String, Object> rawJwks = jwt.getJWTClaimsSet().getJSONObjectClaim("jwks");
- if (rawJwks == null || rawJwks.isEmpty()) {
- log.debug("No jwks found from the payload");
- return CollectionSupport.emptyList();
- }
- final JWKSet jwks = JWKSet.parse(rawJwks);
- final List<Credential> result = jwks.getKeys().stream()
- .filter(Objects::nonNull)
- .filter(jwk -> jwk.getAlgorithm() != null ?
- jwk.getAlgorithm().equals(jwt.getHeader().getAlgorithm()) : true)
- .map(jwk -> jwk != null ? buildJWKCredential(jwk, null) : null)
- .filter(Objects::nonNull)
- .map(Credential.class::cast)
- .toList();
- assert result != null;
- return result;
- } catch (final ParseException e) {
- throw new ResolverException("Could not parse JWKSet from JOSEObject", e);
- }
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java
deleted file mode 100644
index 8caead7..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultPayloadSignatureValidationCredentialResolver.java
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential;
-
-import java.text.ParseException;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-
-import com.nimbusds.jose.jwk.JWKSet;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SignatureValidationKeyContainerJwtCriterion;
-import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-
-/**
- * Resolves credentials from the jwks-claim located in the signed JWT (entity statement) payload. The JWT is fetched
- * via {@link SignatureValidationKeyContainerJwtCriterion}.
- */
-public class DefaultPayloadSignatureValidationCredentialResolver extends BasicJOSEObjectCredentialResolver {
-
- /** Logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(DefaultPayloadSignatureValidationCredentialResolver.class);
-
- /** {@inheritDoc} */
- @Override
- protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
- if (criteriaSet == null || !criteriaSet.contains(SignatureValidationKeyContainerJwtCriterion.class)) {
- throw new ResolverException("CriteriaSet does not contain SignatureValidationKeyContainerJwtCriterion");
- }
-
- final SignatureValidationKeyContainerJwtCriterion keyContainer =
- criteriaSet.get(SignatureValidationKeyContainerJwtCriterion.class);
- assert keyContainer != null;
- final SignedJWT jwt = keyContainer.getJwt();
- if (jwt == null) {
- throw new ResolverException(
- "SignatureValidationKeyContainerJwtCriterion did not contain an instance of SignedJWT");
- }
- try {
- final Map<String, Object> rawJwks = jwt.getJWTClaimsSet().getJSONObjectClaim("jwks");
- if (rawJwks == null || rawJwks.isEmpty()) {
- log.debug("No jwks found from the payload");
- return CollectionSupport.emptyList();
- }
- final JWKSet jwks = JWKSet.parse(rawJwks);
- final List<Credential> result = jwks.getKeys().stream()
- .map(jwk -> jwk != null ? buildJWKCredential(jwk, null) : null)
- .filter(Objects::nonNull)
- .map(Credential.class::cast)
- .toList();
- assert result != null;
- return result;
- } catch (final ParseException e) {
- throw new ResolverException("Could not parse JWKSet from JOSEObject", e);
- }
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultSubordinateStatementCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultSubordinateStatementCredentialResolver.java
deleted file mode 100644
index 4c70222..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultSubordinateStatementCredentialResolver.java
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential;
-
-import java.util.List;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.BaseExpirableSubjectPayload;
-import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-
-/**
- * Resolves credentials from the jwks-claim located in the signed JWT (issuer of a subordinate statement) payload.
- * First, a JWT is fetched via {@link SubjectEntityStatementCriterion}. Its issuer must match with the entity
- * statement fetched via {@link IssuerEntityStatementCriterion}. The issuer must be a self-signed statement.
- */
-public class DefaultSubordinateStatementCredentialResolver extends BasicJOSEObjectCredentialResolver {
-
- /** Logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultSubordinateStatementCredentialResolver.class);
-
- /** {@inheritDoc} */
- @Override
- protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
- if (criteriaSet == null) {
- throw new ResolverException("No criteria set supplied");
- }
-
- final List<Credential> result = parseJwkSet(criteriaSet).getKeys().stream()
- .filter(Objects::nonNull)
- .map(jwk -> jwk != null ? buildJWKCredential(jwk, null) : null)
- .filter(Objects::nonNull)
- .map(Credential.class::cast)
- .toList();
- assert result != null;
- return result;
- }
-
- /**
- * Parses the JWKSet from the given criteria set.
- *
- * @param criteriaSet criteria set containing source JWT for the JWKSet
- * @return the JWKSet parsed from the JWT payload
- * @throws ResolverException if the JWKSet could not be parsed or found
- */
- @Nonnull protected JWKSet parseJwkSet(@Nonnull final CriteriaSet criteriaSet) throws ResolverException {
- final BaseExpirableSubjectPayload subjectPayload = getSubjectStatementPayload(criteriaSet);
- if (subjectPayload == null) {
- log.debug("No mandatory criteria supplied for resolving subject, resolver could not process");
- throw new ResolverException(
- "Credential criteria set did not contain criterion to resolve subject");
- }
- final JWKSet jwks;
- if (subjectPayload.getSubject().equals(subjectPayload.getIssuer())) {
- throw new ResolverException(
- "Unexpected contents in the subject statement: subject matches issuer");
- } else {
- final IssuerEntityStatementCriterion issuerCriterion =
- criteriaSet.get(IssuerEntityStatementCriterion.class);
- if (issuerCriterion == null) {
- log.debug("No mandatory IssuerEntityStatementCriterion supplied, resolver could not process");
- throw new ResolverException(
- "Credential criteria set did not contain an instance of IssuerEntityStatementCriterion");
- }
- final EntityStatement<?> issuerStatement = issuerCriterion.getValue();
- if (!issuerStatement.getSubject().equals(subjectPayload.getIssuer())) {
- throw new ResolverException("Credential criteria do not match for subject and issuer");
- }
- if (!issuerStatement.getSubject().equals(issuerStatement.getIssuer())) {
- throw new ResolverException("Issuer entity statement is not self signed");
- }
- jwks = issuerStatement.getParsedPayload().getJwks();
- }
-
- if (jwks == null || jwks.isEmpty()) {
- throw new ResolverException("Could not parse mandatory jwks");
- }
- return jwks;
- }
-
- private BaseExpirableSubjectPayload getSubjectStatementPayload(
- @Nonnull final CriteriaSet criteriaSet) {
- final SubjectEntityStatementCriterion entityStatementCriterion =
- criteriaSet.get(SubjectEntityStatementCriterion.class);
- if (entityStatementCriterion == null) {
- final SubjectStatementCriterion subjectCriterion = criteriaSet.get(SubjectStatementCriterion.class);
- if (subjectCriterion == null) {
- return null;
- }
- return subjectCriterion.getValue().getParsedPayload() instanceof BaseExpirableSubjectPayload payload
- ? payload : null;
- }
- return entityStatementCriterion.getValue().getParsedPayload();
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkOwnerCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkOwnerCredentialResolver.java
deleted file mode 100644
index 763ba7c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkOwnerCredentialResolver.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-
-import com.nimbusds.jose.jwk.JWK;
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.TrustMarkOwnersCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.TrustMarkOwner;
-import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-
-/**
- * Default resolver for trust anchor owner key resolution. A {@link TrustMarkOwnersCriterion} is used for fetching the
- * credentials for the trust mark owner fetched via {@link SubjectEntityIDCriterion}.
- */
-public class DefaultTrustMarkOwnerCredentialResolver extends BasicJOSEObjectCredentialResolver {
-
- /** Logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultTrustMarkOwnerCredentialResolver.class);
-
- /** {@inheritDoc} */
- @Override
- protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
- if (criteriaSet == null) {
- throw new ResolverException("No criteria supplied");
- }
- final TrustMarkOwnersCriterion ownersCriterion = criteriaSet.get(TrustMarkOwnersCriterion.class);
- if (ownersCriterion == null) {
- log.debug("No TrustMarkOwnersCriterion criteria supplised, resolver could not process");
- throw new ResolverException(
- "Credential criteria set did not contain an instance of TrustMarkOwnersCriterion");
- }
- final SubjectEntityIDCriterion subjectCriterion = criteriaSet.get(SubjectEntityIDCriterion.class);
- if (subjectCriterion == null) {
- log.debug("No SubjectEntityIDCriterion criteria supplied, resolver could not process");
- throw new ResolverException(
- "Credential criteria set did not contain an instance of SubjectEntityIDCriterion");
- }
- final String entityId = subjectCriterion.getValue();
- final Map<String, TrustMarkOwner> owners = ownersCriterion.getValue();
- if (owners.isEmpty() || owners.get(entityId) == null) {
- log.debug("No trusted owners entry found for {}", entityId);
- return CollectionSupport.emptyList();
- }
- final TrustMarkOwner ownerConfiguration = owners.get(entityId);
- final JWKSet jwkSet = ownerConfiguration.getJwks();
- if (jwkSet != null && !jwkSet.isEmpty()) {
- final List<Credential> credentials = new ArrayList<>();
- for (final JWK jwk : jwkSet.getKeys()) {
- if (jwk != null) {
- final Credential cred = buildJWKCredential(jwk, null);
- if (cred != null) {
- credentials.add(cred);
- }
- }
- }
- log.debug("Returning credentials {} for {}", credentials, entityId);
- return credentials;
- }
- log.debug("Could not find jwks from {}", ownerConfiguration);
- return CollectionSupport.emptyList();
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkStatusCredentialResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkStatusCredentialResolver.java
deleted file mode 100644
index ce4fdd1..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/credential/DefaultTrustMarkStatusCredentialResolver.java
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential;
-
-import java.util.List;
-import java.util.Objects;
-import java.util.Optional;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.credential.Credential;
-import org.slf4j.Logger;
-
-import com.nimbusds.jose.jwk.JWKSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.BasePayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectStatementCriterion;
-import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-import net.shibboleth.shared.resolver.ResolverException;
-
-/**
- * Resolves credentials from the jwks-claim located in the signed JWT (issuer of a trust mark status) payload.
- * First, a JWT is fetched via {@link SubjectStatementCriterion}. Its issuer must match with the entity
- * statement fetched via {@link IssuerEntityStatementCriterion}.
- */
-public class DefaultTrustMarkStatusCredentialResolver extends BasicJOSEObjectCredentialResolver {
-
- /** Logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultTrustMarkStatusCredentialResolver.class);
-
- /** {@inheritDoc} */
- @Override
- protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
- if (criteriaSet == null) {
- throw new ResolverException("No criteria set supplied");
- }
-
- final List<Credential> result = parseJwkSet(criteriaSet).getKeys().stream()
- .filter(Objects::nonNull)
- .map(jwk -> jwk != null ? buildJWKCredential(jwk, null) : null)
- .filter(Objects::nonNull)
- .map(Credential.class::cast)
- .toList();
- assert result != null;
- return result;
- }
-
- /**
- * Parses the JWKSet from the given criteria set.
- *
- * @param criteriaSet criteria set containing source JWT for the JWKSet
- * @return the JWKSet parsed from the JWT payload
- * @throws ResolverException if the JWKSet could not be parsed or found
- */
- @Nonnull protected JWKSet parseJwkSet(@Nonnull final CriteriaSet criteriaSet) throws ResolverException {
- final BasePayload subjectPayload = Optional.ofNullable(criteriaSet.get(SubjectStatementCriterion.class))
- .map(criterion -> criterion.getValue().getParsedPayload()).orElse(null);
- if (subjectPayload == null) {
- log.debug("No mandatory criteria supplied for resolving subject, resolver could not process");
- throw new ResolverException(
- "Credential criteria set did not contain criterion to resolve subject");
- }
- final IssuerEntityStatementCriterion issuerCriterion =
- criteriaSet.get(IssuerEntityStatementCriterion.class);
- if (issuerCriterion == null) {
- log.debug("No mandatory IssuerEntityStatementCriterion supplied, resolver could not process");
- throw new ResolverException(
- "Credential criteria set did not contain an instance of IssuerEntityStatementCriterion");
- }
- final EntityStatement<?> issuerStatement = issuerCriterion.getValue();
- if (!issuerStatement.getSubject().equals(subjectPayload.getIssuer())) {
- throw new ResolverException("Credential criteria do not match for subject and issuer");
- }
- if (!issuerStatement.getSubject().equals(issuerStatement.getIssuer())) {
- throw new ResolverException("Issuer entity statement is not self signed");
- }
- final JWKSet jwks = issuerStatement.getParsedPayload().getJwks();
-
- if (jwks == null || jwks.isEmpty()) {
- throw new ResolverException("Could not parse mandatory jwks");
- }
- return jwks;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jose/impl/EndpointAuthenticationSignatureSigningParametersResolver.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jose/impl/EndpointAuthenticationSignatureSigningParametersResolver.java
deleted file mode 100644
index 0630c0b..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jose/impl/EndpointAuthenticationSignatureSigningParametersResolver.java
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.jose.impl;
-
-import java.util.List;
-import java.util.Optional;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion;
-import net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver;
-import net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver;
-import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.primitive.StringSupport;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
-/**
- * An implementation of an {@link SignatureSigningParametersResolver} that extends the {@link
- * BasicSignatureSigningParametersResolver} functionality by adding a configurable lookup strategy for fetching
- * the desired algorithm value from {@link EntityStatement}. It is expected to be found from the criteria set.
- */
-public class EndpointAuthenticationSignatureSigningParametersResolver extends BasicSignatureSigningParametersResolver
- implements SignatureSigningParametersResolver {
-
- /** Class logger.*/
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(EndpointAuthenticationSignatureSigningParametersResolver.class);
-
- /** The default algorithm value used if lookup strategy returned null. */
- @Nullable private final String defaultAlgorithmValue;
-
- /**
- * Constructor.
- *
- * @param defaultValue the default algorithm value used if lookup strategy returned null
- */
- public EndpointAuthenticationSignatureSigningParametersResolver(
- @Nullable @ParameterName(name = "defaultAlgorithmValue") final String defaultValue) {
- defaultAlgorithmValue = defaultValue;
- }
-
-
- /**
- * Get the effective list of signature algorithm URIs to consider, including application of
- * include/exclude policy.
- *
- * @param criteria the input criteria being evaluated
- * @param includeExcludePredicate the include/exclude predicate to use
- * @return the list of effective algorithm URIs
- */
- @Override
- @Nonnull protected List<String> getEffectiveSignatureAlgorithms(@Nonnull final CriteriaSet criteria,
- @Nonnull final Predicate<String> includeExcludePredicate) {
- final List<String> accumulator = super.getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
- final List<String> algorithms =
- Optional.ofNullable(criteria.get(FederationEndpointEntityStatementCriterion.class))
- .map(criterion -> criterion.getValue())
- .map(statement -> statement.getParsedPayload().getMetadata())
- .map(metadata -> metadata.getFederationEntityMetadata())
- .map(entityMetadata -> entityMetadata.get("endpoint_auth_signing_alg_values_supported"))
- .filter(algs -> algs instanceof List<?>)
- .map(algs -> (List<?>) algs)
- .map(algs -> algs.stream().filter(String.class::isInstance).map(String.class::cast).toList())
- .orElse(null);
- log.trace("Resolved algorithms via criteria set: {}", algorithms);
- if (algorithms == null || algorithms.isEmpty()) {
- if (StringSupport.trimOrNull(defaultAlgorithmValue) != null) {
- log.debug("No algorithms resolved via criteria set, using default");
- assert defaultAlgorithmValue != null;
- return convertIntoListIfEnabled(defaultAlgorithmValue, accumulator);
- }
- log.error("No algorithms resolved via criteria set");
- return CollectionSupport.emptyList();
- }
-
- final List<String> result = algorithms.stream().filter(algorithm -> accumulator.contains(algorithm)).toList();
- assert result != null;
- return result;
- }
-
- /**
- * Returns the given algorithm in a {@link List} if it was enabled in the list of enabled algorithms. An empty
- * list is returned if the algorithm was not enabled.
- *
- * @param algorithm the algorithm to be checked against the list
- * @param enabledAlgorithms the list of enabled algorithms
- * @return the given algorithm as list if it was enabled, or an empty list if not
- */
- @Nonnull protected List<String> convertIntoListIfEnabled(@Nonnull final String algorithm,
- @Nonnull final List<String> enabledAlgorithms) {
- if (enabledAlgorithms.contains(algorithm)) {
- return CollectionSupport.listOf(algorithm);
- } else {
- log.warn("The algorithm {} is not enabled, returning empty list", algorithm);
- return CollectionSupport.emptyList();
- }
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/ConstraintsSyntaxClaimsValidator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/ConstraintsSyntaxClaimsValidator.java
deleted file mode 100644
index 3e225bb..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/ConstraintsSyntaxClaimsValidator.java
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl;
-
-import java.text.ParseException;
-import java.util.List;
-import java.util.Map;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.JWTValidationException;
-
-/**
- * A {@link ClaimsValidator} for validating the syntax for standard constraints.
- */
-public class ConstraintsSyntaxClaimsValidator extends AbstractClaimsValidator {
-
- /** Generic prefix to be used with the {@link JWTValidationException}. */
- public static final String ERROR_PREFIX = "Unexpected contents for constraints: ";
-
- /** {@inheritDoc} */
- protected void doValidate(@Nonnull final JWTClaimsSet claims,
- @Nonnull final ProfileRequestContext context) throws JWTValidationException {
- try {
- final Map<String, Object> constraints = claims.getJSONObjectClaim("constraints");
- if (constraints == null || constraints.isEmpty()) {
- return;
- }
- if (constraints.containsKey("max_path_length")) {
- if (!(constraints.get("max_path_length") instanceof Number)) {
- throw new JWTValidationException(ERROR_PREFIX + "max_path_length is not a number");
- }
- }
- if (constraints.containsKey("naming_constraints")) {
- verifyNamingConstraints(constraints.get("naming_constraints"));
- }
- if (constraints.containsKey("allowed_entity_types")) {
- if (constraints.get("allowed_entity_types") instanceof List list) {
- for (final Object item : list) {
- if (!(item instanceof String)) {
- throw new JWTValidationException(ERROR_PREFIX
- + "allowed_entity_types value is not a list of strings");
- }
- }
- } else {
- throw new JWTValidationException("allowed_entity_types is not a list");
- }
- }
- } catch (final ParseException e) {
- throw new JWTValidationException(ERROR_PREFIX + "could not parse a map", e);
- }
- }
-
- /**
- * Verifies the 'naming_constraints' syntax.
- *
- * @param value the naming_constraints value
- * @throws JWTValidationException if the value syntax is invalid
- */
- protected void verifyNamingConstraints(@Nullable final Object value) throws JWTValidationException {
- final String errorPrefix = ERROR_PREFIX + "naming_constraints ";
- if (value instanceof Map<?,?> map) {
- for (final Object key : map.keySet()) {
- if (!(key instanceof String)) {
- throw new JWTValidationException(errorPrefix + "key is not a string");
- }
- if (map.get(key) instanceof List<?> list) {
- for (final Object item : list) {
- if (!(item instanceof String)) {
- throw new JWTValidationException(errorPrefix + "value is not a list of strings");
- }
- }
- } else {
- throw new JWTValidationException(errorPrefix + "value is not a list");
- }
- }
- } else {
- throw new JWTValidationException(errorPrefix + "is not a map");
- }
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/CritClaimsValidator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/CritClaimsValidator.java
deleted file mode 100644
index 4f8e692..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/CritClaimsValidator.java
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl;
-
-import java.text.ParseException;
-import java.util.Collection;
-import java.util.List;
-import java.util.Optional;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.JWTValidationException;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.primitive.NonnullSupplier;
-
-/**
- * A {@link ClaimsValidator} for validating that crit is not an empty array, does not contain standard claim names and
- * only contain values that are configured as recognized.
- */
- at ThreadSafeAfterInit
-public class CritClaimsValidator extends AbstractClaimsValidator {
-
- /** The list of standard operators that cannot be included in the metadata_policy_crit array. */
- @Nonnull public static final List<String> STANDARD_CLAIMS = CollectionSupport.listOf(
- "iss", "sub", "iat", "exp", "jwks", "metadata", "crit", "authority_hints", "trust_anchor_hints",
- "trust_marks", "trust_mark_issuers", "trust_mark_owners", "constraints", "metadata_policy",
- "metadata_policy_crit", "source_endpoint", "aud", "trust_anchor");
-
- /** The collection of recognized claims. */
- @Nonnull private Collection<String> recognizedClaims;
-
- public CritClaimsValidator() {
- recognizedClaims = CollectionSupport.emptyList();
- }
-
- /**
- * Set the collection of recognized claims
- *
- * @param claims recognized claims
- */
- public void setRecognizedClaims(@Nullable final Collection<String> claims) {
- checkSetterPreconditions();
- final Collection<String> list =
- Optional.ofNullable(claims).orElseGet(NonnullSupplier.of(CollectionSupport.emptyList()));
- assert list != null;
- recognizedClaims = list;
- }
-
- /** {@inheritDoc} */
- protected void doValidate(@Nonnull final JWTClaimsSet claims,
- @Nonnull final ProfileRequestContext context) throws JWTValidationException {
- final List<String> values;
- try {
- values = claims.getStringListClaim("crit");
- } catch (final ParseException e) {
- throw new JWTValidationException("Could not parse crit into a list of strings");
- }
- if (values != null) {
- if (values.isEmpty()) {
- throw new JWTValidationException("Empty array is not allowed for crit");
- }
- for (final String value : values) {
- if (values.indexOf(value) != values.lastIndexOf(value)) {
- throw new JWTValidationException(
- "Claim " + value + " is included more than once in crit");
- }
- if (STANDARD_CLAIMS.contains(value)) {
- throw new JWTValidationException(
- "Claim " + value + " is standard claim name and is not allowed in crit");
- }
- if (!recognizedClaims.contains(value)) {
- throw new JWTValidationException( "Claim " + value + " is not recognized for crit");
- }
- }
- }
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/DefaultMetadataPolicyOperatorsLookupStrategy.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/DefaultMetadataPolicyOperatorsLookupStrategy.java
deleted file mode 100644
index 8788bdd..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/DefaultMetadataPolicyOperatorsLookupStrategy.java
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl;
-
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyOperator;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Default lookup strategy to resolve list of supported metadata policy operators.
- */
-public class DefaultMetadataPolicyOperatorsLookupStrategy extends AbstractIdentifiableInitializableComponent
- implements Function<ProfileRequestContext, List<FederationMetadataPolicyOperator>> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DefaultMetadataPolicyOperatorsLookupStrategy.class);
-
- /** Map of supported operators by inbound message class name. */
- @NonnullAfterInit private Map<String, List<FederationMetadataPolicyOperator>> supportedOperators;
-
- /** List of default supported operators if inbound message class name was not mapped. */
- @NonnullAfterInit private List<FederationMetadataPolicyOperator> defaultSupportedOperators;
-
- /**
- * Set the map of supported operators by inbound message class name.
- *
- * @param operators map of supported operators
- */
- public void setSupportedOperators(@Nonnull final Map<String, List<FederationMetadataPolicyOperator>> operators) {
- checkSetterPreconditions();
- supportedOperators = Constraint.isNotNull(operators, "Map of supported operators cannot be null");
- }
-
- /**
- * Set the list of default supported operators if inbound message class name was not mapped.
- *
- * @param operators default list of supported operators
- */
- public void setDefaultSupportedOperators(@Nonnull List<FederationMetadataPolicyOperator> operators) {
- checkSetterPreconditions();
- defaultSupportedOperators =
- Constraint.isNotNull(operators, "Default list of supported operators cannot be null");
- }
-
- /** {@inheritDoc} */
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (supportedOperators == null) {
- throw new ComponentInitializationException("Map of supported operators cannot be null");
- }
- if (defaultSupportedOperators == null) {
- throw new ComponentInitializationException("Default list of supported operators cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable
- public List<FederationMetadataPolicyOperator> apply(@Nullable final ProfileRequestContext profileRequestContext) {
- checkComponentActive();
- if (profileRequestContext == null || profileRequestContext.getInboundMessageContext() == null
- || profileRequestContext.ensureInboundMessageContext().getMessage() == null) {
- log.warn("No inbound message resolved, returning default list of supported operators");
- } else {
- final Object message = profileRequestContext.ensureInboundMessageContext().getMessage();
- assert message != null;
- final String messageClassName = message.getClass().getCanonicalName();
- if (supportedOperators.containsKey(messageClassName)) {
- log.debug("Found message {} specific list of supported operators {}", messageClassName,
- supportedOperators.get(messageClassName));
- return supportedOperators.get(messageClassName);
- }
- log.trace("No messsage class {} specific list found, returning default list of supported operators",
- messageClassName);
- }
- return defaultSupportedOperators;
- }
-
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/MetadataPolicyCritClaimsValidator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/MetadataPolicyCritClaimsValidator.java
deleted file mode 100644
index 484917c..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/MetadataPolicyCritClaimsValidator.java
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl;
-
-import java.text.ParseException;
-import java.util.List;
-import java.util.Optional;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyOperator;
-import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.JWTValidationException;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.logic.Constraint;
-
-/**
- * A {@link ClaimsValidator} for validating that the metadata_policy_crit is not an empty array, does not contain
- * standard operators and all the values are recognized by the resolved list of supported metadata policy operators.
- */
- at ThreadSafeAfterInit
-public class MetadataPolicyCritClaimsValidator extends AbstractClaimsValidator {
-
- /** The list of standard operators that cannot be included in the metadata_policy_crit array. */
- public static final List<String> STANDARD_OPERATORS = CollectionSupport.listOf(
- "value", "add", "default", "one_of", "subset_of", "superset_of", "essential");
-
- /** The lookup strategy for the list of supported metadata policy operators . */
- @NonnullAfterInit private
- Function<ProfileRequestContext, List<FederationMetadataPolicyOperator>> supportedOperatorsLookupStrategy;
-
- /**
- * Set the lookup strategy for the list of supported metadata policy operators.
- *
- * @param strategy lookup strategy
- */
- public void setSupportedOperatorsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, List<FederationMetadataPolicyOperator>> strategy) {
- checkSetterPreconditions();
- supportedOperatorsLookupStrategy =
- Constraint.isNotNull(strategy, "Supported metadata policy operators lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (supportedOperatorsLookupStrategy == null) {
- throw new ComponentInitializationException(
- "Supported metadata policy operators lookup strategy cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- protected void doValidate(@Nonnull final JWTClaimsSet claims,
- @Nonnull final ProfileRequestContext context) throws JWTValidationException {
- final List<String> values;
- try {
- values = claims.getStringListClaim("metadata_policy_crit");
- } catch (final ParseException e) {
- throw new JWTValidationException("Could not parse metadata_policy_crit into a list of strings");
- }
- final List<String> supportedValues = Optional.ofNullable(supportedOperatorsLookupStrategy.apply(context))
- .orElse(CollectionSupport.emptyList())
- .stream().map(operator -> operator.getOperatorName()).toList();
- if (values != null) {
- if (values.isEmpty()) {
- throw new JWTValidationException("Empty array is not allowed for metadata_policy_crit");
- }
- for (final String value : values) {
- if (values.indexOf(value) != values.lastIndexOf(value)) {
- throw new JWTValidationException(
- "Claim " + value + " is included more than once in metadata_policy_crit");
- }
- if (STANDARD_OPERATORS.contains(value)) {
- throw new JWTValidationException(
- "Claim " + value + " is standard operator and is not allowed in metadata_policy_crit");
- }
- if (!supportedValues.contains(value)) {
- throw new JWTValidationException( "Claim " + value + " is not recognized in metadata_policy_crit");
- }
- }
- }
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/NonEmptyStringArrayClaimsValidator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/NonEmptyStringArrayClaimsValidator.java
deleted file mode 100644
index ea100a8..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/NonEmptyStringArrayClaimsValidator.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl;
-
-import java.text.ParseException;
-import java.util.Collection;
-import java.util.List;
-import java.util.Set;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.JWTValidationException;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/**
- * A {@link ClaimsValidator} for validating that the configured claims are non-empty string arrays if present.
- */
- at ThreadSafeAfterInit
-public class NonEmptyStringArrayClaimsValidator extends AbstractClaimsValidator {
-
- /** The names of the JWT claims that must be non-empty string arrays if they exist, empty set if none. */
- @Nonnull @NonnullElements private Set<String> nonEmptyArrayClaims;
-
- /**
- * Constructor.
- */
- public NonEmptyStringArrayClaimsValidator() {
- nonEmptyArrayClaims = CollectionSupport.emptySet();
- }
-
- /**
- * Set the non-empty string array claims.
- *
- * @param claims the non-empty string array claims.
- */
- public void setNonEmptyArrayClaims(@Nullable final Collection<String> claims) {
- ifInitializedThrowUnmodifiabledComponentException();
-
- if (claims !=null) {
- nonEmptyArrayClaims = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(claims));
- } else {
- nonEmptyArrayClaims = CollectionSupport.emptySet();
- }
- }
-
- /** {@inheritDoc} */
- protected void doValidate(@Nonnull final JWTClaimsSet claims,
- @Nonnull final ProfileRequestContext context) throws JWTValidationException {
-
- for (final String claim : nonEmptyArrayClaims) {
- if (claims.getClaims().containsKey(claim)) {
- final List<String> values;
- try {
- values = claims.getStringListClaim(claim);
- } catch (final ParseException e) {
- throw new JWTValidationException("Could not parse " + claim + " into a list of strings");
- }
- if (values != null) {
- if (values.isEmpty()) {
- throw new JWTValidationException("Empty array is not allowed for " + claim);
- }
- }
- }
- }
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/TrustMarkOwnersClaimsValidator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/TrustMarkOwnersClaimsValidator.java
deleted file mode 100644
index 1b067fc..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/TrustMarkOwnersClaimsValidator.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl;
-
-import java.text.ParseException;
-import java.util.Map;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.jwt.JWTClaimsSet;
-
-import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.JWTValidationException;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-
-/**
- * A {@link ClaimsValidator} for validating the syntax of the optional trust_mark_owners claim. The value must be a
- * String-keyed map of maps with mandatory sub and jwks claims.
- */
- at ThreadSafeAfterInit
-public class TrustMarkOwnersClaimsValidator extends AbstractClaimsValidator {
-
- /** {@inheritDoc} */
- protected void doValidate(@Nonnull final JWTClaimsSet claims,
- @Nonnull final ProfileRequestContext context) throws JWTValidationException {
- try {
- final Map<String,Object> trustMarkOwners = claims.getJSONObjectClaim("trust_mark_owners");
- if (trustMarkOwners != null) {
- for (final Object key : trustMarkOwners.keySet()) {
- if (key instanceof String string) {
- final Object raw = trustMarkOwners.get(string);
- if (raw instanceof Map<?, ?> map) {
- final Map<String, Object> trustMarkOwner = map.keySet().stream()
- .filter(String.class::isInstance)
- .map(String.class::cast)
- .filter(k -> map.get(k) != null)
- .collect(Collectors.toMap(k -> k, k -> map.get(k)));
- if (trustMarkOwner.get("sub") instanceof String subString) {
- if (subString.isEmpty()) {
- throw new JWTValidationException("Unexpected contents for trust_mark_owners item: "
- + "Subject is empty");
- }
- } else {
- throw new JWTValidationException("Unexpected contents for trust_mark_owners item: "
- + "Subject is not a string");
- }
- if (trustMarkOwner.get("jwks") == null) {
- throw new JWTValidationException("Unexpected contents for trust_mark_owners item: "
- + "Value for 'jwks' is missing");
- }
- } else {
- throw new JWTValidationException("Unexpected contents for trust_mark_owners item: "
- + "Value is not a map");
- }
- } else {
- throw new JWTValidationException("Unexpected contents for trust_mark_owners item: "
- + "Key is not a string");
- }
- }
- }
- } catch (final ParseException e) {
- throw new JWTValidationException("Unexpected contents for trust_mark_owners: could not parse a map", e);
- }
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/TrustMarksClaimsValidator.java b/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/TrustMarksClaimsValidator.java
deleted file mode 100644
index 70e9dff..0000000
--- a/idp-oidfed-op-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oidfed/security/jwt/claims/impl/TrustMarksClaimsValidator.java
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl;
-
-import java.text.ParseException;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.nimbusds.jwt.JWTClaimsSet;
-import com.nimbusds.jwt.SignedJWT;
-
-import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.ClaimsValidator;
-import net.shibboleth.oidc.jwt.claims.JWTValidationException;
-import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
-
-/**
- * A {@link ClaimsValidator} for validating the syntax of the optional trust_marks claim. Each item ie the array must
- * contain a match between the trust_mark_type claim and the corresponding claim inside the trust_mark JWT payload.
- */
- at ThreadSafeAfterInit
-public class TrustMarksClaimsValidator extends AbstractClaimsValidator {
-
- /** {@inheritDoc} */
- protected void doValidate(@Nonnull final JWTClaimsSet claims,
- @Nonnull final ProfileRequestContext context) throws JWTValidationException {
- try {
- final List<Object> trustMarks = claims.getListClaim("trust_marks");
- if (trustMarks != null) {
- for (final Object raw : trustMarks) {
- if (raw instanceof Map<?, ?> map) {
- final Map<String, String> trustMark = map.keySet().stream()
- .filter(String.class::isInstance)
- .map(String.class::cast)
- .filter(key -> map.get(key) instanceof String)
- .collect(Collectors.toMap(key -> key, key -> (String) map.get(key)));
- if (trustMark.isEmpty()) {
- throw new JWTValidationException("Unexpected contents for trust_marks array item: "
- + "Could not parse a map of Strings");
- }
- validateContent(trustMark);
- } else {
- throw new JWTValidationException("Unexpected contents for trust_marks array item: "
- + "Could not parse a map of strings");
- }
- }
- }
- } catch (final ParseException e) {
- throw new JWTValidationException("Unexpected contents for trust_marks: could not parse an array", e);
- }
- }
-
- /**
- * Verifies that the given trust mark item meets the syntax requirements: the trust_mark content must be a signed
- * JWT with a matching value for the trust_mark_type claim.
- *
- * @param trustMark trust mark JSON object as a map
- * @throws JWTValidationException if the syntax validation fails
- */
- protected void validateContent(@Nonnull final Map<String, String> trustMark) throws JWTValidationException {
- final String trustMarkType = trustMark.get("trust_mark_type");
- if (trustMarkType == null) {
- throw new JWTValidationException("Unexpected contents for trust_marks array item: "
- + "trust_mark_type is null");
- }
- final SignedJWT trustMarkJwt = Optional.ofNullable(trustMark.get("trust_mark"))
- .map(value -> {
- try {
- return SignedJWT.parse(value);
- } catch (final ParseException e) {
- return null;
- }
- })
- .orElse(null);
- if (trustMarkJwt == null) {
- throw new JWTValidationException("Unexpected contents for trust_marks array item: "
- + "trust_mark cannot be parsed into JWT");
- }
- try {
- final String trustMarkTypeJwt = trustMarkJwt.getJWTClaimsSet().getStringClaim("trust_mark_type");
- if (!trustMarkType.equals(trustMarkTypeJwt)) {
- throw new JWTValidationException("Unexpected contents for trust_marks array item: "
- + "trust_mark_type " + trustMarkType + " does not match the JWT claim " + trustMarkTypeJwt);
- }
- } catch (final ParseException e) {
- throw new JWTValidationException("Unexpected contents for trust_marks array item: "
- + "Could not parse trust_mark_type from JWT for trust_mark_type " + trustMarkType, e);
- }
-
- }
-}
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index b43cf42..ef1a80e 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -49,959 +49,6 @@
</property>
</bean>
- <bean id="shibboleth.oidfed.EntityConfigurationMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultEntityConfigurationMetadataCache" parent="shibboleth.oidfed.EntityConfigurationMetadataCacheBuilderSpec"
- p:cleanupTaskInterval="%{idp.oidfed.cache.entityConfiguration.cleanupTaskInterval:PT5M}"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.SubordinateEntityStatementMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultSubordinateEntityStarementMetadataCache" parent="shibboleth.oidfed.SubordinateEntityStatementMetadataCacheBuilderSpec"
- p:cleanupTaskInterval="%{idp.oidfed.cache.subordinateStatement.cleanupTaskInterval:PT5M}"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.TrustChainMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultTrustChainMetadataCache" parent="shibboleth.oidfed.TrustChainMetadataCacheBuilderSpec"
- p:cleanupTaskInterval="%{idp.oidfed.cache.trustChain.cleanupTaskInterval:PT5M}"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.ResolveEntityTrustChainMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultResolveEntityTrustChainMetadataCache" parent="shibboleth.oidfed.ResolveEntityTrustChainMetadataCacheBuilderSpec"
- p:cleanupTaskInterval="%{idp.oidfed.cache.resolveEntity.cleanupTaskInterval:PT5M}"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.LocalTrustAnchorsMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultLocalTrustAnchorsMetadataCache" parent="shibboleth.oidfed.LocalTrustAnchorsMetadataCacheBuilderSpec"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.SignedKeysetMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultSignedKeysetMetadataCache" parent="shibboleth.oidfed.SignedKeysetMetadataCacheBuilderSpec"
- p:cleanupTaskInterval="%{idp.oidfed.cache.signedKeyset.cleanupTaskInterval:PT5M}"/>
- </constructor-arg>
- </bean>
-
- <bean id="DefaultResponseContainerExpirationTimeStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultResponseContainerExpirationTimeStrategy"/>
-
- <bean id="shibboleth.oidfed.EntityConfigurationMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:criteriaToIdentifierStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
- p:minCacheDuration="%{idp.oidfed.cache.entityConfiguration.minRefreshDelay:PT1M}"
- p:maxCacheDuration="%{idp.oidfed.cache.entityConfiguration.maxRefreshDelay:PT30M}"
- p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
- </property>
- <property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.DefaultEntityConfigurationFetchingStrategy"
- p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
- <property name="criteriaToValidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.entityConfiguration.validContainerLifetime:PT5M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToInvalidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.entityConfiguration.invalidContainerLifetime:PT1M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToExceptionContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.entityConfiguration.exceptionContainerLifetime:PT0S}" />
- </constructor-arg>
- </bean>
- </property>
- </bean>
- </property>
- <property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.entityConfiguration.customFilterStrategies:}'.trim())}">
- <property name="validationConditions">
- <util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
- p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine">
- <property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.DefaultEntityConfigurationCriteriaSetLookupFunction"/>
- </property>
- </bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
- p:claimsValidator-ref="%{idp.oidfed.entityConfiguration.claimsValidator:shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator}"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
- </property>
- <property name="containerIdValidationStrategy">
- <bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
- </property>
- </bean>
- </util:list>
- </property>
- </bean>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultEntityConfigurationClaimsValidator"
- class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator">
- <property name="claimValidators">
- <util:list value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}"
- p:messageLifetime="%{idp.oidfed.cache.entityConfiguration.maxJwtLifetime:PT24H}"
- p:requiredRule="true" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="iss" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="sub" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="jwks" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="metadata_policy" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="metadata_policy_crit" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="constraints" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="source_endpoint" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="aud" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.CritClaimsValidator"
- p:recognizedClaims="%{idp.oidfed.cache.entityConfiguration.critClaims:%{idp.oidfed.cache.default.critClaims:}}" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.TrustMarksClaimsValidator" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.NonEmptyStringArrayClaimsValidator"
- p:nonEmptyArrayClaims="authority_hints,trust_anchor_hints" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.TrustMarkOwnersClaimsValidator" />
- </util:list>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine"
- class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
- <constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultEntityConfigurationCredentialResolver" />
- </constructor-arg>
- <constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine"
- class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
- <constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultSubordinateStatementCredentialResolver" />
- </constructor-arg>
- <constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
- parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion))?.getValue()"/>
-
- <bean id="shibboleth.oidfed.SubordinateEntityStatementMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:minCacheDuration="%{idp.oidfed.cache.subordinateStatement.minRefreshDelay:PT1M}"
- p:maxCacheDuration="%{idp.oidfed.cache.subordinateStatement.maxRefreshDelay:PT30M}"
- p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
- </property>
- <property name="criteriaToIdentifierStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate.DefaultSubordinateStatementCriteriaToIdentifierStrategy"
- p:criteriaToSubjectEntityIdStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy">
- <property name="criteriaToIssuerEntityIdStrategy">
- <bean parent="shibboleth.Functions.Expression"
- c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion))?.getValue()"/>
- </property>
- </bean>
- </property>
- <property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.subordinateStatement.customFilterStrategies:}'.trim())}">
- <property name="validationConditions">
- <util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
- p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
- <property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementValidationCriteriaSetLookupFunction"
- p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"/>
- </property>
- </bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
- p:claimsValidator-ref="%{idp.oidfed.subordinateStatement.claimsValidator:shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator}"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
- </property>
- <property name="containerIdValidationStrategy">
- <bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
- </property>
- </bean>
- </util:list>
- </property>
- </bean>
- </property>
- <property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate.DefaultSubordinateStatementFetchingStrategy"
- p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"
- p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache">
- <property name="criteriaToValidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.subordinateStatement.validContainerLifetime:PT5M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToInvalidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.subordinateStatement.invalidContainerLifetime:PT1M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToExceptionContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.subordinateStatement.exceptionContainerLifetime:PT0S}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="clientAuthenticationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
- p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
- <property name="supportedAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_fetch_endpoint_auth_methods')" />
- </property>
- </bean>
- </property>
- </bean>
- </property>
- </bean>
-
- <util:list id="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultPrivateKeyJwtClientAuthenticationFunction"
- p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}">
- <property name="typeHeaderLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#null" />
- </property>
- <property name="audienceLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getSubject()" />
- </property>
- <property name="issuerLookupStrategy">
- <bean parent="shibboleth.Functions.Constant"
- c:target-ref="shibboleth.oidc.issuer" />
- </property>
- <property name="securityConfigurationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultAuthenticationSecurityConfigurationLookupFunction"
- p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyResolverService" />
- </property>
- <property name="signatureSigningParametersResolver">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jose.impl.EndpointAuthenticationSignatureSigningParametersResolver">
- <constructor-arg index="0" value="%{idp.oidfed.cache.clientauthentication.jwt.defaultalg:RS256}" />
- </bean>
- </property>
- </bean>
- </util:list>
-
-
- <bean id="shibboleth.oidfed.DefaultSubordinateStatementClaimsValidator"
- class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator">
- <property name="claimValidators">
- <util:list value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}"
- p:messageLifetime="%{idp.oidfed.cache.subordinateStatement.maxJwtLifetime:PT24H}"
- p:requiredRule="true" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="iss" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="sub" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="jwks" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.CritClaimsValidator"
- p:recognizedClaims="%{idp.oidfed.cache.subordinateStatement.critClaims:%{idp.oidfed.cache.default.critClaims:}}" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.MetadataPolicyCritClaimsValidator">
- <property name="supportedOperatorsLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.DefaultMetadataPolicyOperatorsLookupStrategy"
- p:defaultSupportedOperators-ref="#{'%{idp.oidfed.authorize.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}">
- <property name="supportedOperators">
- <util:map>
- <entry key="net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityRequest" value-ref="#{'%{idp.oidfed.resolve-entity.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}" />
- <entry key="net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationRequest" value-ref="#{'%{idp.oidfed.register.MetadataPolicyOperators:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}" />
- </util:map>
- </property>
- </bean>
- </property>
- </bean>
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="authority_hints" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="trust_anchor_hints" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="trust_marks" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="trust_mark_issuers" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="trust_mark_owners" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
- p:prohibitedClaims="aud" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.ConstraintsSyntaxClaimsValidator"/>
- </util:list>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.TrustChainMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:criteriaToIdentifierStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
- p:minCacheDuration="%{idp.oidfed.trustChain.minRefreshDelay:PT1M}"
- p:maxCacheDuration="%{idp.oidfed.trustChain.maxRefreshDelay:PT30M}"
- p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
- </property>
- <property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.DefaultTrustChainSignatureValidationFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.trustChain.customFilterStrategies:}'.trim())}">
- <property name="trustEngine">
- <bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
- <constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadSignatureValidationCredentialResolver" />
- </constructor-arg>
- <constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
- </constructor-arg>
- </bean>
- </property>
- <property name="entityStatementSignatureValidationFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy">
- <property name="trustEngine">
- <bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
- <constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultLocalTrustAnchorCredentialResolver"
- c:cache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache" />
- </constructor-arg>
- <constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
- </constructor-arg>
- </bean>
- </property>
- </bean>
- </property>
- </bean>
- </property>
- <property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.DefaultTrustChainFetchingStrategy"
- p:criteriaToSubjectEntityIdStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
- p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"
- p:subordinateStatementCache-ref="shibboleth.oidfed.SubordinateEntityStatementMetadataCache"
- p:localTrustAnchorsCache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache">
- <property name="criteriaToValidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.trustChain.validContainerLifetime:PT5M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToInvalidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.trustChain.invalidContainerLifetime:PT1M}" />
- </constructor-arg>
- </bean>
- </property>
- </bean>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.ResolveEntityTrustChainMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:minCacheDuration="%{idp.oidfed.cache.resolveEntity.minRefreshDelay:PT1M}"
- p:maxCacheDuration="%{idp.oidfed.cache.resolveEntity.maxRefreshDelay:PT30M}"
- p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
- <property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver.ResolveEntityCacheIdentifierCriterion))?.getIdentifier()"/>
- </property>
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
- </property>
- <property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.resolveEntity.customFilterStrategies:}'.trim())}">
- <property name="validationConditions">
- <util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
- p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
- <property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementValidationCriteriaSetLookupFunction"
- p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"/>
- </property>
- </bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
- p:claimsValidator-ref="%{idp.oidfed.remoteResolver.claimsValidator:shibboleth.oidfed.DefaultResolveEntityResponseClaimsValidator}"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean parent="shibboleth.BiConditions.Expression" c:expression="true"/>
- </property>
- <property name="containerIdValidationStrategy">
- <bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
- </property>
- </bean>
- </util:list>
- </property>
- </bean>
- </property>
- <property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.resolver.DefaultResolveEntityTrustChainFetchingStrategy"
- p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
- <property name="criteriaToValidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.resolveEntity.validContainerLifetime:PT5M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToInvalidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.resolveEntity.invalidContainerLifetime:PT1M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToExceptionContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.resolveEntity.exceptionContainerLifetime:PT0S}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="clientAuthenticationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
- p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
- <property name="supportedAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_resolve_entity_endpoint_auth_methods')" />
- </property>
- </bean>
- </property>
- </bean>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultResolveEntityResponseClaimsValidator"
- class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator">
- <property name="claimValidators">
- <util:list value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}"
- p:messageLifetime="%{idp.oidfed.cache.resolveEntity.maxJwtLifetime:PT24H}"
- p:requiredRule="true" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="iss" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="sub" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="metadata" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="trust_chain" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.TrustMarksClaimsValidator" />
- </util:list>
- </property>
- </bean>
-
- <util:map id="shibboleth.oidfed.DefaultFederationPolicyConstraints"
- value-type="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.FederationPolicyConstraint">
- <entry key="max_path_length">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl.DefaultMaxPathLengthConstraint" />
- </entry>
- <entry key="naming_constraints">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl.DefaultNamingConstraintsConstraint" />
- </entry>
- <entry key="allowed_entity_types">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.constraints.impl.DefaultAllowedEntityTypesConstraint"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"/>
- </entry>
- </util:map>
-
- <bean id="shibboleth.oidfed.DefaultLocalTrustAnchorsFilename" class="java.lang.String" factory-method="valueOf">
- <constructor-arg value="%{idp.oidfed.LocalTrustAnchorsFile:%{idp.home}/conf/oidfed/oidfed-trust-anchors.json}" />
- </bean>
-
- <bean id="shibboleth.oidfed.LocalTrustAnchorsMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.BatchMetadataCacheBuilderSpec"
- p:criteriaToIdentifierStrategy-ref="shibboleth.oidfed.LocalTrustAnchorsDefaultIdentifierStrategy"
- p:identifierExtractionStrategy-ref="shibboleth.oidfed.LocalTrustAnchorsDefaultIdentifierStrategy"
- p:metadataValidPredicate="#{getObject('shibboleth.oidfed.LocalTrustAnchorsValidator') ?: getObject('shibboleth.oidfed.DefaultLocalTrustAnchorsValidator')}">
- <property name="loadingStrategy">
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultResourceLoadingStrategy">
- <constructor-arg name="metadata">
- <bean class="org.springframework.core.io.Resource"
- factory-bean="PreferFileSystemResourceLoader" factory-method="getResource">
- <constructor-arg>
- <ref bean="shibboleth.oidfed.DefaultLocalTrustAnchorsFilename" />
- </constructor-arg>
- </bean>
- </constructor-arg>
- </bean>
- </property>
- <property name="parsingStrategy">
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultJSONMapParsingStrategy"
- c:mapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper"
- c:valueClass="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer"/>
- </property>
- <property name="sourceMetadataExpiryStrategy">
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultSourceMetadataExpirationTimeStrategy"
- c:duration="PT10M"/>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.TrustMarkStatusMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultTrustMarkStatusMetadataCache" parent="shibboleth.oidfed.TrustMarkStatusMetadataCacheBuilderSpec"
- p:cleanupTaskInterval="PT30S"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.TrustMarkStatusMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:minCacheDuration="%{idp.oidfed.cache.trustMarkStatus.maxRefreshDelay:PT60S}"
- p:maxCacheDuration="%{idp.oidfed.cache.trustMarkStatus.maxRefreshDelay:PT30M}"
- p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
- </property>
- <property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkStatusIdentifierCriterion))?.getIdentifier()"/>
- </property>
- <property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.trustMarkStatus.customFilterStrategies:}'.trim())}">
- <property name="validationConditions">
- <util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition">
- <property name="trustEngine">
- <bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
- <constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultTrustMarkStatusCredentialResolver" />
- </constructor-arg>
- <constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.DefaultTrustMarkValidationCriteriaSetLookupFunction"
- p:trustChainCache-ref="shibboleth.oidfed.TrustChainMetadataCache"/>
- </property>
- </bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
- p:claimsValidator-ref="%{idp.oidfed.trustMarkStatus.claimsValidator:shibboleth.oidfed.DefaultTrustMarkStatusClaimsValidator}"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean parent="shibboleth.BiConditions.Expression" c:expression="true"/>
- </property>
- <property name="containerIdValidationStrategy">
- <bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getIssuer())"/>
- </property>
- </bean>
- </util:list>
- </property>
- </bean>
- </property>
- <property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.DefaultTrustMarkStatusFetchingStrategy"
- p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
- <property name="criteriaToValidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.trustMarkStatus.validContainerLifetime:PT5M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToInvalidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.trustMarkStatus.invalidContainerLifetime:PT1M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToExceptionContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.trustMarkStatus.exceptionContainerLifetime:PT0S}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="clientAuthenticationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
- p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
- <property name="supportedAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue()?.getParsedPayload()?.getMetadata()?.getFederationEntityMetadata()?.get('federation_trust_mark_status_endpoint_auth_methods')" />
- </property>
- </bean>
- </property>
- </bean>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultTrustMarkStatusClaimsValidator"
- class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator">
- <property name="claimValidators">
- <util:list value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}"
- p:messageLifetime="%{idp.oidfed.cache.trustMarkStatus.maxJwtLifetime:PT24H}"
- p:requiredRule="true" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="iss" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="trust_mark" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="status" />
- </util:list>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.TrustMarkMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultTrustMarkMetadataCache" parent="shibboleth.oidfed.TrustMarkMetadataCacheBuilderSpec"
- p:cleanupTaskInterval="PT30S"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.TrustMarkMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:minCacheDuration="%{idp.oidfed.cache.trustMark.minRefreshDelay:PT1H}"
- p:maxCacheDuration="%{idp.oidfed.cache.trustMark.maxRefreshDelay:PT24H}"
- p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.getIdentifier()"/>
- </property>
- <property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.TrustMarkIdentifierCriterion))?.getIdentifier()"/>
- </property>
- <property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.trustMark.customFilterStrategies:}'.trim())}">
- <property name="validationConditions">
- <util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
- p:trustEngine-ref="shibboleth.oidfed.DefaultSubordinateStatementTrustEngine">
- <property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.DefaultTrustMarkValidationCriteriaSetLookupFunction"
- p:trustChainCache-ref="shibboleth.oidfed.TrustChainMetadataCache"/>
- </property>
- </bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
- p:claimsValidator-ref="%{idp.oidfed.trustMark.claimsValidator:shibboleth.oidfed.DefaultTrustMarkClaimsValidator}"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean parent="shibboleth.BiConditions.Expression" c:expression="true"/>
- </property>
- <property name="containerIdValidationStrategy">
- <bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
- </property>
- </bean>
- </util:list>
- </property>
- </bean>
- </property>
- <property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.DefaultTrustMarkFetchingStrategy"
- p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
- <property name="criteriaToValidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.trustMark.validContainerLifetime:PT5M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToInvalidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.trustMark.invalidContainerLifetime:PT1M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToExceptionContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.trustMark.exceptionContainerLifetime:PT0S}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="clientAuthenticationLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultClientAuthenticationLookupFunction"
- p:clientAuthenticationDecoratorsLookupStrategy-ref="shibboleth.oidfed.cache.DefaultEndpointAuthenticationFunctions">
- <property name="supportedAuthenticationMethodsLookupStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.FederationEndpointEntityStatementCriterion))?.getValue().getParsedPayload().getMetadata()?.getFederationEntityMetadata()?.get('federation_trust_mark_endpoint_auth_methods')" />
- </property>
- </bean>
- </property>
- </bean>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultTrustMarkClaimsValidator"
- class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator">
- <property name="claimValidators">
- <util:list value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}"
- p:messageLifetime="%{idp.oidfed.maxTrustMarkifetime:P365D}"
- p:requiredRule="true" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="iss" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="sub" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="trust_mark_type" />
- </util:list>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultDelegatedTrustMarkTrustEngine"
- class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
- <constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultTrustMarkOwnerCredentialResolver" />
- </constructor-arg>
- <constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.SignedKeysetMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:minCacheDuration="%{idp.oidfed.cache.signedKeyset.minRefreshDelay:PT1M}"
- p:maxCacheDuration="%{idp.oidfed.cache.signedKeyset.maxRefreshDelay:PT30M}"
- p:metadataExpirationTimeStrategy-ref="DefaultResponseContainerExpirationTimeStrategy">
- <property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion))?.getValue().getSubject() + ':' + #input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.SubjectSignedKeysetUriCriterion))?.getValue()"/>
- </property>
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId() + ':' + #input?.getIdentifier().getUri()"/>
- </property>
- <property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.DefaultSignedKeysetFetchingStrategy"
- p:httpClient="#{getObject('shibboleth.oidfed.HttpClient') ?: getObject('shibboleth.InternalHttpClient')}"
- p:httpClientSecurityParameters="#{getObject('shibboleth.oidfed.NonBrowser.HttpClientSecurityParameters')}"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
- <property name="criteriaToValidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.signedKeyset.validContainerLifetime:PT5M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToInvalidContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.signedKeyset.invalidContainerLifetime:PT1M}" />
- </constructor-arg>
- </bean>
- </property>
- <property name="criteriaToExceptionContainerLifetimeStrategy">
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg>
- <bean class="java.time.Duration" factory-method="parse" c:_0="%{idp.oidfed.cache.signedKeyset.exceptionContainerLifetime:PT0S}" />
- </constructor-arg>
- </bean>
- </property>
- </bean>
- </property>
- <property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
- p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.signedKeyset.customFilterStrategies:}'.trim())}">
- <property name="validationConditions">
- <util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
- p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine">
- <property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.DefaultSignedKeysetCriteriaSetLookupFunction"/>
- </property>
- </bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
- p:claimsValidator-ref="%{idp.oidfed.signedKeyset.claimsValidator:shibboleth.oidfed.DefaultSignedKeysetClaimsValidator}"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
- <property name="headerValidator">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
- p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
- </property>
- <property name="containerIdValidationStrategy">
- <bean parent="shibboleth.BiConditions.Expression" c:expression="#input1?.getEntityId()?.equals(#input2?.getParsedPayload()?.getSubject())"/>
- </property>
- </bean>
- </util:list>
- </property>
- </bean>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultSignedKeysetClaimsValidator"
- class="net.shibboleth.oidc.security.jwt.claims.impl.ChainingJWTClaimsValidator">
- <property name="claimValidators">
- <util:list value-type="net.shibboleth.oidc.jwt.claims.ClaimsValidator">
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.IssuedAtClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}"
- p:messageLifetime="%{idp.oidfed.cache.entityConfiguration.maxJwtLifetime:PT24H}"
- p:requiredRule="true" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="iss" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="sub" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
- p:requiredClaims="keys" />
- <bean class="net.shibboleth.oidc.security.jwt.claims.impl.ExpiryClaimsValidator"
- p:clockSkew="%{idp.policy.clockSkew:PT1M}" />
- </util:list>
- </property>
- </bean>
-
- <bean id="PreferFileSystemResourceLoader"
- class="net.shibboleth.shared.spring.resource.PreferFileSystemResourceLoader"/>
-
- <bean id="shibboleth.oidfed.DefaultLocalTrustAnchorsValidator"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultLocalTrustAnchorsValidator"/>
-
- <bean id="shibboleth.oidfed.LocalTrustAnchorsDefaultIdentifierStrategy"
- parent="shibboleth.Functions.Constant" c:target="#{getObject('shibboleth.oidfed.DefaultLocalTrustAnchorsFilename') ?: 'undefined'}" />
-
-
- <bean id="shibboleth.oidfed.JWTPayloadJSONObjectMapper" parent="shibboleth.oidc.JSONObjectMapper" />
- <bean id="shibboleth.oidfed.policy.JSONSimpleModule" class="com.fasterxml.jackson.databind.module.SimpleModule"/>
- <bean id="shibboleth.oidfed.JacksonSimpleTypeResolver" class="com.fasterxml.jackson.databind.module.SimpleAbstractTypeResolver"/>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
- <property name="targetObject" ref="shibboleth.oidfed.policy.JSONSimpleModule" />
- <property name="targetMethod" value="addDeserializer" />
- <property name="arguments">
- <list>
- <value>#{ T(net.shibboleth.oidc.metadata.policy.MetadataPolicy)}</value>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyDeserializer"
- c:_0="%{idp.oidfed.policy.arraysAsSpaceSeparatedList:scope}"/>
- </list>
- </property>
- </bean>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
- <property name="targetObject" ref="shibboleth.oidfed.policy.JSONSimpleModule" />
- <property name="targetMethod" value="addDeserializer" />
- <property name="arguments">
- <list>
- <value>#{ T(com.nimbusds.jose.jwk.JWKSet)}</value>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.JWKSetDeserializer"/>
- </list>
- </property>
- </bean>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
- <property name="targetObject" ref="shibboleth.oidfed.policy.JSONSimpleModule" />
- <property name="targetMethod" value="addDeserializer" />
- <property name="arguments">
- <list>
- <value>#{ T(com.nimbusds.jose.jwk.JWK)}</value>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.JWKDeserializer"/>
- </list>
- </property>
- </bean>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
- <property name="targetObject" ref="shibboleth.oidfed.policy.JSONSimpleModule" />
- <property name="targetMethod" value="addDeserializer" />
- <property name="arguments">
- <list>
- <value>#{ T(java.time.Instant)}</value>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.InstantDeserializer"/>
- </list>
- </property>
- </bean>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
- <property name="targetObject" ref="shibboleth.oidfed.JacksonSimpleTypeResolver" />
- <property name="targetMethod" value="addMapping" />
- <property name="arguments">
- <list>
- <value>#{ T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata)}</value>
- <value>#{ T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl.MetadataImpl)}</value>
- </list>
- </property>
- </bean>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
- <property name="targetObject" ref="shibboleth.oidfed.JacksonSimpleTypeResolver" />
- <property name="targetMethod" value="addMapping" />
- <property name="arguments">
- <list>
- <value>#{ T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.TrustMarkOwner)}</value>
- <value>#{ T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl.TrustMarkOwnerImpl)}</value>
- </list>
- </property>
- </bean>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
- <property name="targetObject" ref="shibboleth.oidfed.policy.JSONSimpleModule" />
- <property name="targetMethod" value="setAbstractTypes" />
- <property name="arguments">
- <list>
- <ref bean="shibboleth.oidfed.JacksonSimpleTypeResolver" />
- </list>
- </property>
- </bean>
-
- <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
- <property name="targetObject" ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
- <property name="targetMethod" value="registerModule" />
- <property name="arguments">
- <list>
- <ref bean="shibboleth.oidfed.policy.JSONSimpleModule" />
- </list>
- </property>
- </bean>
-
- <util:list id="shibboleth.oidfed.StandardMetadataPolicyOperators">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyValueOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyAddOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyDefaultOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyOneOfOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicySubsetOfOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicySupersetOfOperator"/>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEssentialOperator"/>
- </util:list>
-
<bean p:id="oidc/metadata-lookup-ext/oidfed" parent="shibboleth.oidc.MetadataLookupExtensionFlow" />
<bean id="shibboleth.oidc.DefaultResolveEntityApiMappedErrors"
@@ -1017,19 +64,19 @@
</entry>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_TRUST_ANCHOR"/>
+ <util:constant static-field="net.shibboleth.oidfed.profile.OidFederationEventIds.INVALID_TRUST_ANCHOR"/>
</key>
<bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_trust_anchor" c:_1="Trust anchor in the request is invalid" c:_2="404" />
</entry>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_SUBJECT"/>
+ <util:constant static-field="net.shibboleth.oidfed.profile.OidFederationEventIds.INVALID_SUBJECT"/>
</key>
<bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_subject" c:_1="Subject in the request is invalid" c:_2="404" />
</entry>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_METADATA"/>
+ <util:constant static-field="net.shibboleth.oidfed.profile.OidFederationEventIds.INVALID_METADATA"/>
</key>
<bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_metadata" c:_1="Metadata is invalid or not found for the requested entity types" c:_2="400" />
</entry>
@@ -1044,7 +91,7 @@
<map value-type="com.nimbusds.oauth2.sdk.ErrorObject">
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.NO_TRUST_CHAINS_RESOLVED"/>
+ <util:constant static-field="net.shibboleth.oidfed.profile.OidFederationEventIds.NO_TRUST_CHAINS_RESOLVED"/>
</key>
<bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_client" c:_1="No acceptable trust chains could be resolved for the client" c:_2="401" />
</entry>
@@ -1167,7 +214,7 @@
<entry key="#{T(net.shibboleth.oidc.profile.config.OIDCUserInfoConfiguration).PROFILE_ID}">
<ref bean="shibboleth.oidfed.userinfo.DefaultAutomaticRegistrationCondition"/>
</entry>
- <entry key="#{T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationResolveEntityProfileConfiguration).PROFILE_ID}">
+ <entry key="#{T(net.shibboleth.oidfed.profile.config.OIDFederationResolveEntityProfileConfiguration).PROFILE_ID}">
<ref bean="shibboleth.oidfed.resolve-entity.DefaultAutomaticRegistrationCondition"/>
</entry>
</util:map>
@@ -1320,7 +367,7 @@
<bean parent="shibboleth.oidc.PushedAuthorizationErrorMapping">
<property name="eventId">
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_METADATA_POLICY"/>
+ <util:constant static-field="net.shibboleth.oidfed.profile.OidFederationEventIds.INVALID_METADATA_POLICY"/>
</property>
<property name="errorObject">
<bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_metadata" c:_1="Merged metadata policy is invalid" c:_2="400" />
@@ -1329,7 +376,7 @@
<bean parent="shibboleth.oidc.PushedAuthorizationErrorMapping">
<property name="eventId">
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.INVALID_METADATA_AGAINST_POLICY"/>
+ <util:constant static-field="net.shibboleth.oidfed.profile.OidFederationEventIds.INVALID_METADATA_AGAINST_POLICY"/>
</property>
<property name="errorObject">
<bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_metadata" c:_1="Requested metadata is not compliant with the merged policy" c:_2="400" />
@@ -1338,7 +385,7 @@
<bean parent="shibboleth.oidc.PushedAuthorizationErrorMapping">
<property name="eventId">
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.OidFederationEventIds.NO_TRUST_CHAINS_RESOLVED"/>
+ <util:constant static-field="net.shibboleth.oidfed.profile.OidFederationEventIds.NO_TRUST_CHAINS_RESOLVED"/>
</property>
<property name="errorObject">
<bean class="com.nimbusds.oauth2.sdk.ErrorObject" c:_0="invalid_client" c:_1="No acceptable trust chains could be resolved for the client" c:_2="401" />
@@ -1384,13 +431,13 @@
p:prohibitedClaims="constraints" />
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.ProhibitedClaimsValidator"
p:prohibitedClaims="source_endpoint" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.CritClaimsValidator"
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.CritClaimsValidator"
p:recognizedClaims="%{idp.oidfed.cache.explicitRegistration.critClaims:%{idp.oidfed.cache.default.critClaims:}}" />
<bean class="net.shibboleth.oidc.security.jwt.claims.impl.RequiredClaimsValidator"
p:requiredClaims="authority_hints" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.NonEmptyStringArrayClaimsValidator"
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.NonEmptyStringArrayClaimsValidator"
p:nonEmptyArrayClaims="authority_hints,trust_anchor_hints" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.jwt.claims.impl.TrustMarksClaimsValidator" />
+ <bean class="net.shibboleth.oidfed.security.jwt.claims.impl.TrustMarksClaimsValidator" />
</util:list>
</property>
</bean>
@@ -1399,6 +446,10 @@
<bean id="shibboleth.oidfed.resolver.PotentialFlows" class="org.springframework.beans.factory.config.ListFactoryBean"
p:sourceList="#{getObject('shibboleth.AuthenticationFlowDescriptorManager').getComponents().?[id matches 'authn/(' + '%{idp.oidfed.resolve-entity.authn.flows:OAuth2Client}'.trim() + ')']}" />
+ <bean id="ProviderMetadataEntityConfigurationMetadataDecorator"
+ class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.ProviderMetadataEntityConfigurationMetadataDecorator"
+ p:metadataResolver-ref="#{'%{idp.oidfed.configuration.op.resolver:shibboleth.oidfed.DefaultOpenIdConfigurationResolver}'.trim()}"/>
+
<import resource="${idp.home}/conf/oidfed/oidfed-trustchain-resolver.xml"/>
</beans>
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
index 0181ddc..297992a 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/metadata-lookup-ext/oidfed/metadata-lookup-ext-oidfed-beans.xml
@@ -43,37 +43,37 @@
<bean id="FetchThroughProvidedTrustChainMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.FetchThroughMetadataCacheBuilderSpec">
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion))?.getValue()?.getEntityId()" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion))?.getValue()?.getEntityId()" />
</property>
<property name="identifierExtractionStrategy">
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
</property>
<property name="fetchStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion))?.getValue()" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion))?.getValue()" />
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.DefaultTrustChainSignatureValidationFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.trustchain.DefaultTrustChainSignatureValidationFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.providedTrustChain.customFilterStrategies:}'.trim())}">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadSignatureValidationCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadSignatureValidationCredentialResolver" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
</property>
<property name="entityStatementSignatureValidationFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy">
+ <bean class="net.shibboleth.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultLocalTrustAnchorCredentialResolver"
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultLocalTrustAnchorCredentialResolver"
c:cache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
</property>
@@ -119,7 +119,7 @@
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultMetadataValidationCondition" />
<bean id="DefaultMetadataPolicyEnforcer"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
+ class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
p:metadataPolicyOperators-ref="#{'%{idp.oidfed.authorize.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="DefaultTrustChainMetadataPolicyMergingStrategy"
@@ -128,7 +128,7 @@
p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.authorize.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
<bean id="MetadataPolicMergingyStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
+ class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
p:metadataPolicyOperators-ref="#{'%{idp.oidfed.authorize.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="DefaultLocalMetadataPolicyStrategy"
@@ -166,7 +166,7 @@
<bean id="SelectAutomaticRegistrationProfileConfiguration"
class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration" scope="prototype"
p:relyingPartyContextLookupStrategy-ref="AutomaticRegistrationRelyingPartyCreationStrategy"
- p:profileId="#{T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationAutomaticRegistrationProfileConfiguration).PROFILE_ID}" />
+ p:profileId="#{T(net.shibboleth.oidfed.profile.config.OIDFederationAutomaticRegistrationProfileConfiguration).PROFILE_ID}" />
<bean id="SelectTrustChain" class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.SelectTrustChain"
scope="prototype"/>
@@ -198,7 +198,7 @@
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.ValidateAutomaticRegistrationProfileConfiguration"
scope="prototype">
<property name="localMetadataPolicyLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.LocalMetadataPolicyLookupFunction"
+ <bean class="net.shibboleth.oidfed.profile.config.navigate.LocalMetadataPolicyLookupFunction"
p:relyingPartyContextLookupStrategy-ref="AutomaticRegistrationRelyingPartyCreationStrategy"/>
</property>
<property name="localMetadataPolicyMergingStrategy">
@@ -206,15 +206,15 @@
p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.authorize.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"/>
</property>
<property name="mandatoryTrustMarksLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.MandatoryTrustMarksLookupFunction"
+ <bean class="net.shibboleth.oidfed.profile.config.navigate.MandatoryTrustMarksLookupFunction"
p:relyingPartyContextLookupStrategy-ref="AutomaticRegistrationRelyingPartyCreationStrategy"/>
</property>
<property name="claimsSetDecorationTypeLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.ClaimsSetDecorationTypeLookupFunction"
+ <bean class="net.shibboleth.oidfed.profile.config.navigate.ClaimsSetDecorationTypeLookupFunction"
p:relyingPartyContextLookupStrategy-ref="AutomaticRegistrationRelyingPartyCreationStrategy"/>
</property>
<property name="providedChainClaimsSetDecorationTypeLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.ProvidedChainClaimsSetDecorationTypeLookupFunction"
+ <bean class="net.shibboleth.oidfed.profile.config.navigate.ProvidedChainClaimsSetDecorationTypeLookupFunction"
p:relyingPartyContextLookupStrategy-ref="AutomaticRegistrationRelyingPartyCreationStrategy"/>
</property>
</bean>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
deleted file mode 100644
index 5434b68..0000000
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-beans.xml
+++ /dev/null
@@ -1,165 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans" xmlns:c="http://www.springframework.org/schema/c"
- xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
- default-init-method="initialize" default-destroy-method="destroy">
-
- <bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationEntityConfigurationProfileConfiguration).PROFILE_ID}" />
-
- <bean id="shibboleth.oidc.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidfedconfig:OIDFED.Configuration}" />
-
- <util:constant id="shibboleth.metrics.ProfileCounter"
- static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationEntityConfigurationProfileConfiguration.PROFILE_COUNTER" />
-
- <bean id="shibboleth.oidfed.EntityConfigurationResponseMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultEntityConfigurationResponseMetadataCache" parent="shibboleth.oidfed.EntityConfigurationResponseMetadataCacheBuilderSpec"
- p:cleanupTaskInterval="PT30S"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.EntityConfigurationResponseMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.DynamicMetadataCacheBuilderSpec"
- p:minCacheDuration="%{idp.oidfed.entity-configuration.maxRefreshDelay:PT1S}"
- p:maxCacheDuration="%{idp.oidfed.entity-configuration.maxRefreshDelay:PT30S}">
- <property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
- </property>
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
- </property>
- <property name="metadataExpirationTimeStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
- </property>
- <property name="metadataFilterStrategy">
- <bean parent="shibboleth.BiFunctions.Expression" c:expression="#input1"/>
- </property>
- <property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityConfigurationResponseFetchingStrategy" />
- </property>
- </bean>
-
- <bean id="LookupCachedResponse"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.LookupCachedNimbusResponse"
- scope="prototype"
- p:responseCache-ref="shibboleth.oidfed.EntityConfigurationResponseMetadataCache" />
-
- <bean id="InitializeEntityStatementContext"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.InitializeEntityStatementContext"
- p:metadataResolver-ref="#{'%{idp.oidfed.configuration.resolver:shibboleth.oidfed.DefaultOpenIdConfigurationResolver}'.trim()}"
- p:metadataSkeletonLookupStrategy-ref="#{'%{idp.oidfed.configuration.EntityConfigurationMetadataSkeletonLookupStrategy:DefaultEntityConfigurationMetadataSkeletonLookupStrategy}'.trim()}"/>
-
- <bean id="DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
- p:metadataSkeletonCache-ref="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCache"/>
-
- <bean id="PopulateEntityStatementSignatureSigningParameters"
- class="net.shibboleth.oidc.profile.impl.PopulateJWTSignatureSigningParameters" scope="prototype"
- c:strategy-ref="shibboleth.MessageContextLookup.Outbound"
- p:securityParametersContextLookupStrategy-ref="EntityStatementSecurityParametersContextLookupStrategy">
- <property name="configurationLookupStrategy">
- <bean lazy-init="true"
- class="net.shibboleth.oidc.profile.config.navigate.JWTSignatureSigningConfigurationLookupFunction" />
- </property>
- <property name="signatureSigningParametersResolver">
- <bean class="net.shibboleth.oidc.security.jose.impl.ClientInformationSignatureSigningParametersResolver">
- <constructor-arg name="signatureAlgorithmLookupStrategy">
- <bean parent="shibboleth.Functions.Constant" c:target="" />
- </constructor-arg>
- <constructor-arg name="defaultAlgorithmValue" value="%{idp.oidfed.entity.sigalg:RS256}" />
- </bean>
- </property>
- </bean>
-
- <bean id="EntityStatementSecurityParametersContextLookupStrategy" parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.oidc.ChildLookupOrCreate.JWTSecurityParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
-
- <bean id="EntityStatementSecurityParametersCreationViaMessageContextStrategy" parent="shibboleth.Functions.Compose">
- <constructor-arg name="g" ref="EntityStatementSecurityParametersContextLookupStrategy" />
- <constructor-arg name="f">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input.getParent()" />
- </constructor-arg>
- </bean>
-
- <bean id="SelectOidcConfigurationProfileConfiguration"
- class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration" scope="prototype"
- p:profileId="#{T(net.shibboleth.oidc.profile.config.OIDCProviderInformationConfiguration).PROFILE_ID}" />
-
- <bean id="ConfigurationRelyingPartyCreationStrategy" parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookupOrCreate.RelyingPartyContext"
- c:f-ref="shibboleth.MessageContextLookup.Outbound" />
-
- <bean id="BuildEntityStatement"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.BuildEntityConfiguration" scope="prototype"
- p:identifierGeneratorLookupStrategy-ref="shibboleth.oidc.DefaultIdentifierGenerationStrategy"
- p:objectMapper-ref="#{'%{idp.oidc.logging.objectMapper:shibboleth.oidc.JSONObjectMapper}'.trim()}"/>
-
- <bean id="SignEntityStatement" class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor"
- scope="prototype" c:executionDirection="OUTBOUND ">
- <constructor-arg name="messageHandler">
- <bean id="SignEntityStatementHandler"
- class="net.shibboleth.oidc.security.impl.SignJWTHandler" scope="prototype" p:logName="Entity Statement"
- p:securityParametersLookupStrategy-ref="EntityStatementSecurityParametersCreationViaMessageContextStrategy"
- p:typeHeader="entity-statement+jwt">
- <property name="claimsToSignLookupStrategy">
- <bean
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.JWTClaimsSetFromEntityStatementLookupFunction" />
- </property>
- <property name="jwtUpdateConsumer">
- <bean
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.EntityStatementUpdateStrategy" />
- </property>
- </bean>
- </constructor-arg>
- </bean>
-
- <bean id="FormOutboundMessage" class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.FormOutboundFederationConfigurationResponse"
- scope="prototype" p:responseCache-ref="shibboleth.oidfed.EntityConfigurationResponseMetadataCache">
- </bean>
-
- <bean id="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCache" parent="shibboleth.oidc.CacheBuilder">
- <constructor-arg>
- <bean p:cacheId="DefaultEntityConfigurationMetadataSkeletonMetadataCache"
- parent="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCacheBuilderSpec"/>
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCacheBuilderSpec"
- class="net.shibboleth.oidc.metadata.cache.impl.BatchMetadataCacheBuilderSpec"
- p:metadataValidPredicate-ref="shibboleth.Conditions.TRUE">
- <property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
- </property>
- <property name="identifierExtractionStrategy">
- <bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
- </property>
- <property name="loadingStrategy">
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultResourceLoadingStrategy">
- <constructor-arg name="metadata">
- <bean class="org.springframework.core.io.Resource"
- factory-bean="PreferFileSystemResourceLoader" factory-method="getResource">
- <constructor-arg>
- <bean class="java.lang.String" factory-method="valueOf">
- <constructor-arg value="%{idp.oidfed.configuration.MetadataSkaletonFile:%{idp.home}/conf/oidfed/oidfed-entity-configuration-metadata.json}" />
- </bean>
- </constructor-arg>
- </bean>
- </constructor-arg>
- </bean>
- </property>
- <property name="parsingStrategy">
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultJSONMapParsingStrategy"
- c:valueClass="java.util.Map"/>
- </property>
- <property name="sourceMetadataExpiryStrategy">
- <bean class="net.shibboleth.oidc.metadata.cache.impl.DefaultSourceMetadataExpirationTimeStrategy"
- c:duration="%{idp.oidfed.configuration.MetadataSkaletonCacheLifetime:PT10M}"/>
- </property>
- </bean>
-
-</beans>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-flow.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-flow.xml
deleted file mode 100644
index f937952..0000000
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/entity-configuration/entity-configuration-flow.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<flow xmlns="http://www.springframework.org/schema/webflow"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="oidc/abstract-api-info">
-
- <action-state id="InitializeMandatoryContexts">
- <on-entry>
- <set name="flowScope.transitionAfterInboundIntercept" value="'LookupCachedResponse'" />
- </on-entry>
- </action-state>
-
- <action-state id="LookupCachedResponse">
- <evaluate expression="LookupCachedResponse" />
- <evaluate expression="'proceed'" />
- <transition on="CachedResponseFound" to="BuildResponseMessage" />
- <transition on="proceed" to="InitializeEntityStatementContext" />
- </action-state>
-
- <action-state id="InitializeEntityStatementContext">
- <evaluate expression="SelectOidcConfigurationProfileConfiguration" />
- <evaluate expression="InitializeEntityStatementContext"/>
- <evaluate expression="SelectProfileConfiguration" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="BuildEntityConfiguration" />
- </action-state>
-
- <action-state id="BuildEntityConfiguration">
- <evaluate expression="PopulateEntityStatementSignatureSigningParameters" />
- <evaluate expression="BuildEntityStatement" />
- <evaluate expression="SignEntityStatement" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="BuildResponseMessage"/>
- </action-state>
-
- <bean-import resource="entity-configuration-beans.xml" />
-
-</flow>
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
index aa2c5e6..e6d348f 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/register/register-beans.xml
@@ -11,7 +11,7 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationExplicitRegistrationProfileConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidfed.profile.config.OIDFederationExplicitRegistrationProfileConfiguration).PROFILE_ID}" />
<bean id="shibboleth.oidc.loggingId" class="java.lang.String"
c:_0="%{idp.service.logging.oidfeddynreg:OIDFED.Registration}" />
@@ -20,7 +20,7 @@
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.ExplicitClientRegistrationRequestClientIDLookupFunction" />
<util:constant id="shibboleth.metrics.ProfileCounter"
- static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationExplicitRegistrationProfileConfiguration.PROFILE_COUNTER" />
+ static-field="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationExplicitRegistrationProfileConfiguration.PROFILE_COUNTER" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
@@ -65,37 +65,37 @@
<bean id="FetchThroughProvidedTrustChainMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.FetchThroughMetadataCacheBuilderSpec">
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion))?.getValue()?.getEntityId()" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion))?.getValue()?.getEntityId()" />
</property>
<property name="identifierExtractionStrategy">
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
</property>
<property name="fetchStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion))?.getValue()" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.trustchain.ProvidedTrustChainContainerCriterion))?.getValue()" />
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.DefaultTrustChainSignatureValidationFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.trustchain.DefaultTrustChainSignatureValidationFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.explicitRegistration.trustChain.customFilterStrategies:}'.trim())}">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadSignatureValidationCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadSignatureValidationCredentialResolver" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
</property>
<property name="entityStatementSignatureValidationFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy">
+ <bean class="net.shibboleth.oidfed.metadata.cache.local.DefaultEntityStatementSignatureValidationFilterStrategy">
<property name="trustEngine">
<bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine">
<constructor-arg index="0">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultLocalTrustAnchorCredentialResolver"
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultLocalTrustAnchorCredentialResolver"
c:cache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache" />
</constructor-arg>
<constructor-arg index="1">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
+ <bean class="net.shibboleth.oidfed.security.credential.DefaultPayloadJOSEObjectCredentialResolver" />
</constructor-arg>
</bean>
</property>
@@ -126,30 +126,30 @@
<bean id="FetchThroughProvidedEntityConfigurationMetadataCacheBuilderSpec"
class="net.shibboleth.oidc.metadata.cache.impl.FetchThroughMetadataCacheBuilderSpec">
<property name="criteriaToIdentifierStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.ProvidedEntityConfigurationContainerCriterion))?.getValue()?.getEntityId()" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.configuration.ProvidedEntityConfigurationContainerCriterion))?.getValue()?.getEntityId()" />
</property>
<property name="identifierExtractionStrategy">
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
</property>
<property name="fetchStrategy">
- <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.ProvidedEntityConfigurationContainerCriterion))?.getValue()" />
+ <bean parent="shibboleth.Functions.Expression" c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.configuration.ProvidedEntityConfigurationContainerCriterion))?.getValue()" />
</property>
<property name="metadataFilterStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementMetadataFilterStrategy"
p:customFilterStrategies="#{getObject('%{idp.oidfed.cache.explicitRegistration.entityConfiguration.customFilterStrategies:}'.trim())}">
<property name="validationConditions">
<util:list value-type="java.util.function.BiPredicate">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementSignatureValidationCondition"
p:trustEngine-ref="shibboleth.oidfed.DefaultEntityConfigurationTrustEngine">
<property name="criteriaSetLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.DefaultEntityConfigurationCriteriaSetLookupFunction"/>
+ <bean class="net.shibboleth.oidfed.metadata.cache.configuration.DefaultEntityConfigurationCriteriaSetLookupFunction"/>
</property>
</bean>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultEntityStatementContentValidationCondition"
p:claimsValidator-ref="%{idp.oidfed.cache.explicitRegistrationRequest.claimsValidator:shibboleth.oidfed.DefaultExplicitRegistrationRequestClaimsValidator}"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier">
<property name="headerValidator">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
+ <bean class="net.shibboleth.oidfed.metadata.cache.DefaultTrustChainHeaderValidationCondition"
p:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper" />
</property>
<property name="containerIdValidationStrategy">
@@ -207,7 +207,7 @@
<bean parent="shibboleth.Functions.Expression" c:expression="#input?.getEntityId()"/>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.DefaultTrustChainFetchingStrategy"
+ <bean class="net.shibboleth.oidfed.metadata.cache.trustchain.DefaultTrustChainFetchingStrategy"
p:criteriaToSubjectEntityIdStrategy-ref="shibboleth.oidfed.DefaultSubjectEntityIDCriteriaToIdentifierStrategy"
p:entityConfigurationCache-ref="shibboleth.oidfed.EntityConfigurationMetadataCache"
p:subordinateStatementCache-ref="shibboleth.oidfed.SubordinateEntityStatementMetadataCache"
@@ -224,7 +224,7 @@
</bean>
<bean id="DefaultMetadataPolicyEnforcer"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
+ class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
p:metadataPolicyOperators-ref="#{'%{idp.oidfed.register.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="DefaultTrustChainMetadataPolicyMergingStrategy"
@@ -233,7 +233,7 @@
p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.register.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
<bean id="MetadataPolicMergingyStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
+ class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
p:metadataPolicyOperators-ref="#{'%{idp.oidfed.register.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="DefaultLocalMetadataPolicyStrategy"
@@ -293,7 +293,7 @@
<bean id="SelectExplicitRegistrationProfileConfiguration"
class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration" scope="prototype"
p:relyingPartyContextLookupStrategy-ref="ExplicitRegistrationRelyingPartyCreationStrategy"
- p:profileId="#{T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationExplicitRegistrationProfileConfiguration).PROFILE_ID}" />
+ p:profileId="#{T(net.shibboleth.oidfed.profile.config.OIDFederationExplicitRegistrationProfileConfiguration).PROFILE_ID}" />
<bean id="InitializeRegistrationMetadataPolicyContext"
class="net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeRegistrationMetadataPolicyContext"
@@ -308,7 +308,7 @@
p:metadataPolicyEnforcer-ref="#{'%{idp.oidfed.register.MetadataPolicyEnforcer:DefaultMetadataPolicyEnforcer}'.trim()}"/>
</property>
<property name="mandatoryTrustMarksLookupStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.MandatoryTrustMarksLookupFunction"
+ <bean class="net.shibboleth.oidfed.profile.config.navigate.MandatoryTrustMarksLookupFunction"
p:relyingPartyContextLookupStrategy-ref="ExplicitRegistrationRelyingPartyCreationStrategy"/>
</property>
</bean>
@@ -347,7 +347,7 @@
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultSelectedTrustChainMetadataLookupStrategy" />
<bean id="shibboleth.oidc.TokenEndpointAuthMethodsLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.navigate.TokenEndpointAuthMethodLookupFunction" />
+ class="net.shibboleth.oidfed.profile.config.navigate.TokenEndpointAuthMethodLookupFunction" />
<bean id="shibboleth.oidc.DefaultScope"
class="com.nimbusds.oauth2.sdk.Scope" factory-method="parse">
@@ -439,11 +439,11 @@
p:typeHeader="explicit-registration-response+jwt">
<property name="claimsToSignLookupStrategy">
<bean
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.JWTClaimsSetFromEntityStatementLookupFunction" />
+ class="net.shibboleth.oidfed.profile.impl.JWTClaimsSetFromEntityStatementLookupFunction" />
</property>
<property name="jwtUpdateConsumer">
<bean
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.EntityStatementUpdateStrategy" />
+ class="net.shibboleth.oidfed.profile.impl.EntityStatementUpdateStrategy" />
</property>
</bean>
</constructor-arg>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
index 378f293..f6910c5 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/resolve-entity/resolve-entity-beans.xml
@@ -8,14 +8,14 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationResolveEntityProfileConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidfed.profile.config.OIDFederationResolveEntityProfileConfiguration).PROFILE_ID}" />
<bean id="shibboleth.oidc.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidfedresolve:OIDFED.ResolveEntity}" />
<bean id="shibboleth.oidc.browserProfile" class="java.lang.Boolean" c:_0="false" />
<util:constant id="shibboleth.metrics.ProfileCounter"
- static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationResolveEntityProfileConfiguration.PROFILE_COUNTER" />
+ static-field="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationResolveEntityProfileConfiguration.PROFILE_COUNTER" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
@@ -53,20 +53,20 @@
p:maxCacheDuration="%{idp.oidfed.resolve-entity.maxRefreshDelay:PT30S}">
<property name="criteriaToIdentifierStrategy">
<bean parent="shibboleth.Functions.Expression"
- c:expression="#input?.get(T(net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.ResolveEntityRequestCriterion))?.getRequest().toString()"/>
+ c:expression="#input?.get(T(net.shibboleth.oidfed.metadata.cache.local.ResolveEntityRequestCriterion))?.getRequest().toString()"/>
</property>
<property name="identifierExtractionStrategy">
<bean parent="shibboleth.Functions.Expression"
c:expression="#input?.getRequest()?.toString()"/>
</property>
<property name="metadataExpirationTimeStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
+ <bean class="net.shibboleth.oidfed.metadata.cache.local.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
</property>
<property name="metadataFilterStrategy">
<bean parent="shibboleth.BiFunctions.Expression" c:expression="#input1"/>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultResolveEntityResponseFetchingStrategy" />
+ <bean class="net.shibboleth.oidfed.metadata.cache.local.DefaultResolveEntityResponseFetchingStrategy" />
</property>
</bean>
@@ -100,7 +100,7 @@
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultMetadataValidationCondition" />
<bean id="DefaultMetadataPolicyEnforcer"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
+ class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyEnforcer"
p:metadataPolicyOperators-ref="#{'%{idp.oidfed.resolve-entity.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="DefaultTrustChainMetadataPolicyMergingStrategy"
@@ -109,7 +109,7 @@
p:localMetadataPolicyStrategy-ref="#{'%{idp.oidfed.resolve-entity.LocalMetadataPolicyStrategy:DefaultLocalMetadataPolicyStrategy}'.trim()}"/>
<bean id="MetadataPolicMergingyStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
+ class="net.shibboleth.oidfed.metadata.policy.impl.DefaultFederationMetadataPolicyMergingStrategy"
p:metadataPolicyOperators-ref="#{'%{idp.oidfed.resolve-entity.MetadataPolicyOperatorsy:shibboleth.oidfed.StandardMetadataPolicyOperators}'.trim()}"/>
<bean id="DefaultLocalMetadataPolicyStrategy"
@@ -202,11 +202,11 @@
p:typeHeader="resolve-response+jwt">
<property name="claimsToSignLookupStrategy">
<bean
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.JWTClaimsSetFromEntityStatementLookupFunction" />
+ class="net.shibboleth.oidfed.profile.impl.JWTClaimsSetFromEntityStatementLookupFunction" />
</property>
<property name="jwtUpdateConsumer">
<bean
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.EntityStatementUpdateStrategy" />
+ class="net.shibboleth.oidfed.profile.impl.EntityStatementUpdateStrategy" />
</property>
</bean>
</constructor-arg>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/signed-keyset/signed-keyset-beans.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/signed-keyset/signed-keyset-beans.xml
index 65791cc..a2acc10 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/signed-keyset/signed-keyset-beans.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidfed/signed-keyset/signed-keyset-beans.xml
@@ -8,12 +8,12 @@
default-init-method="initialize" default-destroy-method="destroy">
<bean id="shibboleth.oidc.profileId" class="java.lang.String"
- c:_0="#{T(net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.OIDFederationSignedKeysetProfileConfiguration).PROFILE_ID}" />
+ c:_0="#{T(net.shibboleth.oidfed.profile.config.OIDFederationSignedKeysetProfileConfiguration).PROFILE_ID}" />
<bean id="shibboleth.oidc.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.oidfedconfig:OIDFED.SignedKeyset}" />
<util:constant id="shibboleth.metrics.ProfileCounter"
- static-field="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationSignedKeysetProfileConfiguration.PROFILE_COUNTER" />
+ static-field="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationSignedKeysetProfileConfiguration.PROFILE_COUNTER" />
<bean id="shibboleth.oidfed.SignedKeysetResponseMetadataCache" parent="shibboleth.oidc.CacheBuilder">
<constructor-arg>
@@ -33,18 +33,18 @@
<bean parent="shibboleth.Functions.Constant" c:target-ref="shibboleth.oidc.issuer" />
</property>
<property name="metadataExpirationTimeStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
+ <bean class="net.shibboleth.oidfed.metadata.cache.local.DefaultNimbusResponseContainerExpirationTimeStrategy"/>
</property>
<property name="metadataFilterStrategy">
<bean parent="shibboleth.BiFunctions.Expression" c:expression="#input1"/>
</property>
<property name="fetchStrategy">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityConfigurationResponseFetchingStrategy" />
+ <bean class="net.shibboleth.oidfed.metadata.cache.local.DefaultEntityConfigurationResponseFetchingStrategy" />
</property>
</bean>
<bean id="LookupCachedResponse"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.LookupCachedNimbusResponse"
+ class="net.shibboleth.oidfed.profile.impl.LookupCachedNimbusResponse"
scope="prototype"
p:responseCache-ref="shibboleth.oidfed.SignedKeysetResponseMetadataCache" />
@@ -54,7 +54,7 @@
getObject('shibboleth.oidc.keyset.DefaultKeySetCredentialsToPublishLookupStrategy')}"/>
<bean id="DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
+ class="net.shibboleth.oidfed.metadata.cache.local.DefaultEntityConfigurationMetadataSkeletonLookupStrategy"
p:metadataSkeletonCache-ref="shibboleth.oidfed.EntityConfigurationMetadataSkeletonMetadataCache"/>
<bean id="PopulateEntityStatementSignatureSigningParameters"
@@ -111,11 +111,11 @@
p:typeHeader="jwk-set+jwt">
<property name="claimsToSignLookupStrategy">
<bean
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.JWTClaimsSetFromEntityStatementLookupFunction" />
+ class="net.shibboleth.oidfed.profile.impl.JWTClaimsSetFromEntityStatementLookupFunction" />
</property>
<property name="jwtUpdateConsumer">
<bean
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.impl.EntityStatementUpdateStrategy" />
+ class="net.shibboleth.oidfed.profile.impl.EntityStatementUpdateStrategy" />
</property>
</bean>
</constructor-arg>
diff --git a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
index 1a70414..cddbee6 100644
--- a/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
+++ b/idp-oidfed-op-impl/src/main/resources/META-INF/net/shibboleth/idp/service/relying-party/postconfig.xml
@@ -9,17 +9,8 @@
default-init-method="initialize" default-destroy-method="destroy">
- <bean id="AbstractOIDFederationProfile" abstract="true"
- p:securityConfiguration-ref="shibboleth.oidfed.DefaultSecurityConfiguration" />
-
- <bean id="OIDFED.Configuration" parent="AbstractOIDFederationProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationEntityConfigurationProfileConfiguration"
- p:issuer-ref="shibboleth.oidc.issuer"
- p:authorityHints="%{idp.oidfed.entity.authorityHints:https://example.org}"
- p:optionalClaimsLookupStrategies-ref="shibboleth.oidfed.EntityConfigurationClaimsLookupStrategies" />
-
<bean id="OIDFED.Keyset" parent="AbstractOIDFederationProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationSignedKeysetProfileConfiguration"
+ class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationSignedKeysetProfileConfiguration"
p:issuer-ref="shibboleth.oidc.issuer">
<property name="entityStatementLifetime">
<bean class="java.time.Duration" factory-method="parse" c:_0="PT0S" />
@@ -27,7 +18,7 @@
</bean>
<bean id="OIDFED.AutomaticRegistration" parent="AbstractOIDFederationProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationAutomaticRegistrationProfileConfiguration"
+ class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationAutomaticRegistrationProfileConfiguration"
p:mandatoryTrustMarks="%{idp.oidfed.automaticRegistration.mandatoryTrustMarks:}"
p:defaultClaimsSetDecorationType="%{idp.oidfed.automaticRegistration.defaultClaimsSetDecorationType:}"
p:providedChainClaimsSetDecorationType="%{idp.oidfed.automaticRegistration.providedClaimsSetDecorationType:store}">
@@ -48,98 +39,19 @@
</bean>
<bean id="OIDFED.ExplicitRegistration" parent="AbstractOIDFederationProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationExplicitRegistrationProfileConfiguration"
+ class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationExplicitRegistrationProfileConfiguration"
p:issuer-ref="shibboleth.oidc.issuer"
p:mandatoryTrustMarks="%{idp.oidfed.explicitRegistration.mandatoryTrustMarks:}" />
<bean id="OIDFED.ResolveEntity" parent="AbstractOIDFederationProfile" lazy-init="true"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.config.impl.DefaultOIDFederationResolveEntityProfileConfiguration"
+ class="net.shibboleth.oidfed.profile.config.impl.DefaultOIDFederationResolveEntityProfileConfiguration"
p:issuer-ref="shibboleth.oidc.issuer"
p:tokenEndpointAuthMethods="%{idp.oidfed.resolve-entity.endpointAuthMethods:private_key_jwt}"
p:claimsValidator="#{getObject('DefaultJWTClaimsValidator')}"
p:useTargetedEndpointAsJWTAudience="%{idp.oidfed.resolve-entity.targetedEndpointAsJWTAudience:false}"
p:requireSingleJWTAudience="%{idp.oidfed.resolve-entity.requireSingleJWTAudience:true}"/>
- <bean id="shibboleth.oidfed.SigningConfiguration"
- parent="shibboleth.oidc.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.oidfed.SigningCredentialsFactory">
- <property name="signatureAlgorithms">
- <list>
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_RS_512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_ES_512" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_PS_256" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_PS_384" />
- <util:constant
- static-field="net.shibboleth.oidc.jwa.support.SignatureConstants.ALGO_ID_SIGNATURE_PS_512" />
- </list>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.SigningCredentialsFactory"
- class="net.shibboleth.oidc.profile.config.CredentialsListFactory"
- c:_0="#{getObject('shibboleth.oidfed.SigningCredentials') ?: getObject('shibboleth.oidc.SigningCredentials')}" />
-
- <bean id="shibboleth.oidfed.SignatureValidationConfiguration"
- parent="shibboleth.oidc.BasicSignatureValidationConfiguration">
- <property name="signatureTrustEngine">
- <bean class="net.shibboleth.oidc.security.impl.ExplicitKeySignedJWTTrustEngine"
- c:JOSEObjectResolver-ref="defaultSignedJWTJOSEHeaderCredentialResolver">
- <constructor-arg name="resolver">
- <bean id="defaultSignedJWTFedTrustedCredentialResolver"
- class="net.shibboleth.oidc.security.credential.impl.ChainingJOSEObjectCredentialResolver">
- <constructor-arg>
- <list>
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.ClientInformationFederationEntityCredentialResolver"
- c:objectMapper-ref="shibboleth.oidfed.JWTPayloadJSONObjectMapper">
- <constructor-arg name="entityConfigurationCredentialResolver">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.security.credential.DefaultEntityConfigurationCredentialResolver" />
- </constructor-arg>
- </bean>
- </list>
- </constructor-arg>
- </bean>
- </constructor-arg>
- </bean>
- </property>
- </bean>
-
- <bean id="shibboleth.oidfed.DefaultSecurityConfiguration"
- class="net.shibboleth.oidc.profile.config.JSONSecurityConfiguration" c:clockSkew="%{idp.policy.clockSkew:PT1M}">
- <constructor-arg name="idGenerator">
- <bean class="net.shibboleth.shared.security.IdentifierGenerationStrategy" factory-method="getInstance">
- <constructor-arg>
- <util:constant
- static-field="net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType.SECURE" />
- </constructor-arg>
- </bean>
- </constructor-arg>
- <property name="jwtSignatureSigningConfiguration">
- <ref bean="#{'%{idp.oidfed.signing.config:shibboleth.oidfed.SigningConfiguration}'.trim()}" />
- </property>
- <property name="jwtSignatureValidationConfiguration">
- <ref bean="#{'%{idp.oidfed.validation.config:shibboleth.oidfed.SignatureValidationConfiguration}'.trim()}" />
- </property>
- </bean>
-
<bean id="RelyingPartyByTrustAnchor" abstract="true" parent="RelyingParty"
class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.context.RelyingPartyConfigurationSupport" factory-method="byTrustAnchor" />
- <bean id="DefaultTrustAnchorHintsLookupStrategy"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultTrustAnchorHintsLookupStrategy"
- p:trustAnchorsCache-ref="shibboleth.oidfed.LocalTrustAnchorsMetadataCache"/>
-
- <import resource="${idp.home}/conf/oidfed/oidfed-entity-configuration-claims.xml"/>
-
</beans>
diff --git a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-trustchain-resolver.xml b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-trustchain-resolver.xml
index 11a1387..948897c 100644
--- a/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-trustchain-resolver.xml
+++ b/idp-oidfed-op-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/oidfed/conf/oidfed/oidfed-trustchain-resolver.xml
@@ -20,7 +20,7 @@
-->
<bean id="shibboleth.oidfed.DefaultTrustedRemoteResolverEntitiesLookupStrategy" parent="shibboleth.Functions.Constant">
<constructor-arg name="target">
- <util:list value-type="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteResolverEntity">
+ <util:list value-type="net.shibboleth.oidfed.profile.TrustedRemoteResolverEntity">
<!--
Example entry for a trusted entity 'https://trust-anchor.federation.local'
its 'federation_resolve_endpoint' is exploited with the configured trust_anchor parameters:
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java
index 518529b..f19ccdf 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/TrustChainTestUtil.java
@@ -41,15 +41,15 @@ import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.EntityConfigurationImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.SubordinateStatementImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.InstantDeserializer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.jackson.JWKSetDeserializer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.Metadata;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.claim.impl.MetadataImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.policy.FederationMetadataPolicyDeserializer;
import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.impl.EntityConfigurationImpl;
+import net.shibboleth.oidfed.metadata.impl.SubordinateStatementImpl;
+import net.shibboleth.oidfed.metadata.jackson.InstantDeserializer;
+import net.shibboleth.oidfed.metadata.jackson.JWKSetDeserializer;
+import net.shibboleth.oidfed.metadata.payload.claim.Metadata;
+import net.shibboleth.oidfed.metadata.payload.claim.impl.MetadataImpl;
+import net.shibboleth.oidfed.metadata.policy.FederationMetadataPolicyDeserializer;
/**
* Various utility methods for testing trust chains.
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainFetchingStrategyTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainFetchingStrategyTest.java
index 71a0b8f..9e9caec 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainFetchingStrategyTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oidfed/metadata/cache/trustchain/DefaultTrustChainFetchingStrategyTest.java
@@ -28,19 +28,19 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.PreSelectedTrustChainCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.local.LocalKeyContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate.SubordinateStatementCacheIdentifier;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate.SubordinateStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.DefaultTrustChainFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.TrustChainsContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityConfigurationPayload;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.util.EntityStatementHelper;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.SubordinateStatement;
+import net.shibboleth.oidfed.metadata.cache.PreSelectedTrustChainCriterion;
+import net.shibboleth.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
+import net.shibboleth.oidfed.metadata.cache.local.LocalKeyContainer;
+import net.shibboleth.oidfed.metadata.cache.subordinate.SubordinateStatementCacheIdentifier;
+import net.shibboleth.oidfed.metadata.cache.subordinate.SubordinateStatementContainer;
+import net.shibboleth.oidfed.metadata.cache.trustchain.DefaultTrustChainFetchingStrategy;
+import net.shibboleth.oidfed.metadata.cache.trustchain.TrustChainsContainer;
+import net.shibboleth.oidfed.metadata.payload.EntityConfigurationPayload;
+import net.shibboleth.oidfed.metadata.util.EntityStatementHelper;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.resolver.CriteriaSet;
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/AbstractFederationFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/AbstractFederationFlowTest.java
index c002e5f..a893d72 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/AbstractFederationFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/AbstractFederationFlowTest.java
@@ -75,11 +75,11 @@ import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.minidev.json.JSONObject;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityResponse;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.test.TrustChainTestUtil;
import net.shibboleth.shared.logic.Constraint;
/**
@@ -93,8 +93,8 @@ public class AbstractFederationFlowTest extends AbstractOidcFlowTest {
final static AtomicInteger clientIndex = new AtomicInteger();
final static AtomicInteger intermediateIndex = new AtomicInteger();
protected final String redirectUri = "https://rp.federation.local/cb";
- protected final String clientIdPattern = "https://testrp%s.federation.local";
- protected final String intermediateIdPattern = "https://intermediate-authority%s.federation.local";
+ protected final String clientIdPattern = "https://testrp4op%s.federation.local";
+ protected final String intermediateIdPattern = "https://intermediate-authority4op%s.federation.local";
protected final String trustedIntermediateId = "https://local-trusted-intermediate-authority.federation.local";
protected final String anchorId = "https://trust-anchor.federation.local";
protected final String anchorFetchEndpoint = anchorId + "/fetch";
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
index 2ba6ed9..fcb2f54 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/EntityConfigurationFlowTest.java
@@ -45,10 +45,10 @@ import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.minidev.json.JSONObject;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustmark.DefaultTrustMarkFetchingStrategy;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.EntityConfigurationImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.EntityConfigurationPayload;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.cache.trustmark.DefaultTrustMarkFetchingStrategy;
+import net.shibboleth.oidfed.metadata.impl.EntityConfigurationImpl;
+import net.shibboleth.oidfed.metadata.payload.EntityConfigurationPayload;
import net.shibboleth.shared.collection.CollectionSupport;
/**
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/RegistrationFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/RegistrationFlowTest.java
index d25233d..1a2a3d1 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/RegistrationFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/RegistrationFlowTest.java
@@ -53,9 +53,9 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.minidev.json.JSONObject;
import net.minidev.json.parser.JSONParser;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ExplicitClientRegistrationResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.oidc.metadata.impl.BaseStorageServiceClientInformationComponent;
+import net.shibboleth.oidfed.messaging.impl.ExplicitClientRegistrationResponse;
+import net.shibboleth.oidfed.metadata.EntityStatement;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.Pair;
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/ResolveEntityFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/ResolveEntityFlowTest.java
index cfd7a18..a0a36f4 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/ResolveEntityFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/ResolveEntityFlowTest.java
@@ -40,9 +40,9 @@ import com.nimbusds.oauth2.sdk.Scope;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.messaging.impl.ResolveEntityResponse;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
import net.shibboleth.oidc.profile.messaging.JSONErrorResponse;
+import net.shibboleth.oidfed.messaging.impl.ResolveEntityResponse;
+import net.shibboleth.oidfed.metadata.EntityStatement;
import net.shibboleth.shared.collection.CollectionSupport;
import net.minidev.json.JSONObject;
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/SignedKeysetFlowTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/SignedKeysetFlowTest.java
index 3a14788..062fd42 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/SignedKeysetFlowTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/SignedKeysetFlowTest.java
@@ -34,9 +34,9 @@ import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.oauth2.sdk.Response;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignedKeyset;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.SignedKeysetImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.SignedKeysetPayload;
+import net.shibboleth.oidfed.metadata.SignedKeyset;
+import net.shibboleth.oidfed.metadata.impl.SignedKeysetImpl;
+import net.shibboleth.oidfed.metadata.payload.SignedKeysetPayload;
/**
* Unit test for the signed keyset flow.
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java
index 7973b18..2902952 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/EntityConfigurationMetadataCacheTest.java
@@ -48,15 +48,15 @@ import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.AbstractFederationFlowTest;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.EntityConfigurationFlowTest;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.support.CustomEntityConfigurationFilterStrategy;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.flow.AbstractFederationFlowTest;
+import net.shibboleth.oidfed.flow.EntityConfigurationFlowTest;
+import net.shibboleth.oidfed.flow.support.CustomEntityConfigurationFilterStrategy;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SignedKeysetMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SignedKeysetMetadataCacheTest.java
index 97ecb20..a0d7656 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SignedKeysetMetadataCacheTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SignedKeysetMetadataCacheTest.java
@@ -33,17 +33,17 @@ import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SignedKeyset;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityStatementCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.SignedKeysetContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.keyset.SubjectSignedKeysetUriCriterion;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.AbstractFederationFlowTest;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.EntityConfigurationFlowTest;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.flow.AbstractFederationFlowTest;
+import net.shibboleth.oidfed.flow.EntityConfigurationFlowTest;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.SignedKeyset;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityStatementCriterion;
+import net.shibboleth.oidfed.metadata.cache.keyset.SignedKeysetContainer;
+import net.shibboleth.oidfed.metadata.cache.keyset.SubjectSignedKeysetUriCriterion;
+import net.shibboleth.oidfed.test.TrustChainTestUtil;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
index 16376f1..fa0a1e8 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/SubordinateStatementMetadataCacheTest.java
@@ -47,18 +47,18 @@ import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.PlainJWT;
import com.nimbusds.jwt.SignedJWT;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate.SubordinateStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.AbstractFederationFlowTest;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.EntityConfigurationFlowTest;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.support.CustomSubordinateStatementFilterStrategy;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.flow.AbstractFederationFlowTest;
+import net.shibboleth.oidfed.flow.EntityConfigurationFlowTest;
+import net.shibboleth.oidfed.flow.support.CustomSubordinateStatementFilterStrategy;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.SubordinateStatement;
+import net.shibboleth.oidfed.metadata.cache.IssuerEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.subordinate.SubordinateStatementContainer;
+import net.shibboleth.oidfed.test.TrustChainTestUtil;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java
index 6d040ca..0bf7878 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/cache/TrustChainMetadataCacheTest.java
@@ -32,14 +32,14 @@ import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.idp.plugin.oidc.op.oidfed.TrustChainTestUtil;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.IssuerEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.SubjectEntityIDCriterion;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.TrustChainsContainer;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.AbstractFederationFlowTest;
-import net.shibboleth.idp.plugin.oidc.op.profile.flow.oidfed.EntityConfigurationFlowTest;
import net.shibboleth.oidc.metadata.cache.MetadataCache;
import net.shibboleth.oidc.metadata.cache.MetadataCacheException;
+import net.shibboleth.oidfed.flow.AbstractFederationFlowTest;
+import net.shibboleth.oidfed.flow.EntityConfigurationFlowTest;
+import net.shibboleth.oidfed.metadata.cache.IssuerEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.ResponseContainerExpirationCriterion;
+import net.shibboleth.oidfed.metadata.cache.SubjectEntityIDCriterion;
+import net.shibboleth.oidfed.metadata.cache.trustchain.TrustChainsContainer;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomEntityConfigurationFilterStrategy.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomEntityConfigurationFilterStrategy.java
index 5d7d64f..040a963 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomEntityConfigurationFilterStrategy.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomEntityConfigurationFilterStrategy.java
@@ -18,11 +18,11 @@ import java.time.Instant;
import java.util.Optional;
import java.util.function.BiFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityConfiguration;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.EntityConfigurationImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.EntityConfigurationPayloadImpl;
import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
+import net.shibboleth.oidfed.metadata.EntityConfiguration;
+import net.shibboleth.oidfed.metadata.cache.configuration.EntityConfigurationContainer;
+import net.shibboleth.oidfed.metadata.impl.EntityConfigurationImpl;
+import net.shibboleth.oidfed.metadata.payload.impl.EntityConfigurationPayloadImpl;
/**
* Custom filter strategy for entity configuration container.
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomSubordinateStatementFilterStrategy.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomSubordinateStatementFilterStrategy.java
index 696a9b0..a5396cf 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomSubordinateStatementFilterStrategy.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomSubordinateStatementFilterStrategy.java
@@ -18,11 +18,11 @@ import java.time.Instant;
import java.util.Optional;
import java.util.function.BiFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.SubordinateStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.subordinate.SubordinateStatementContainer;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.impl.SubordinateStatementImpl;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.payload.impl.SubordinateStatementPayloadImpl;
import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
+import net.shibboleth.oidfed.metadata.SubordinateStatement;
+import net.shibboleth.oidfed.metadata.cache.subordinate.SubordinateStatementContainer;
+import net.shibboleth.oidfed.metadata.impl.SubordinateStatementImpl;
+import net.shibboleth.oidfed.metadata.payload.impl.SubordinateStatementPayloadImpl;
/**
* Custom filter strategy for subordinate statement container.
diff --git a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomTrustChainFilterStrategy.java b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomTrustChainFilterStrategy.java
index a37064f..d4bbe65 100644
--- a/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomTrustChainFilterStrategy.java
+++ b/idp-oidfed-op-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/oidfed/support/CustomTrustChainFilterStrategy.java
@@ -18,9 +18,9 @@ import java.util.List;
import java.util.Optional;
import java.util.function.BiFunction;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.EntityStatement;
-import net.shibboleth.idp.plugin.oidc.op.oidfed.metadata.cache.trustchain.TrustChainsContainer;
import net.shibboleth.oidc.metadata.filter.MetadataFilterContext;
+import net.shibboleth.oidfed.metadata.EntityStatement;
+import net.shibboleth.oidfed.metadata.cache.trustchain.TrustChainsContainer;
import net.shibboleth.shared.collection.CollectionSupport;
/**
diff --git a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml b/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml
deleted file mode 100644
index 0a6dea6..0000000
--- a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-entity-configuration-claims.xml
+++ /dev/null
@@ -1,44 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize" default-destroy-method="destroy">
-
- <bean id="ExampleTrustedTrustMarkIssuer"
- class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteEntity"
- c:entity="https://dyn-trust-mark-issuer.federation.local"/>
-
- <util:map id="shibboleth.oidfed.EntityConfigurationClaimsLookupStrategies"
- value-type="java.util.function.Function">
- <entry key="trust_anchor_hints" value-ref="#{'%{idp.oidfed.entity-configuration.trustAnchoHintsLookup:DefaultTrustAnchorHintsLookupStrategy}'.trim()}"/>
- <entry key="trust_marks">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.navigate.DefaultEntityConfigurationTrustMarksLookupStrategy">
- <property name="trustMarkLookupStrategies">
- <util:list value-type="java.util.function.Function">
- <bean parent="shibboleth.oidfed.RemoteTrustMark"
- p:trustMarkType="https://dyn-trust-mark-issuer.federation.local/example"
- p:trustedEntity-ref="ExampleTrustedTrustMarkIssuer" />
- <bean parent="shibboleth.Functions.Constant">
- <constructor-arg name="target">
- <util:map key-type="java.lang.String" value-type="java.lang.String">
- <entry
- key="trust_mark_type"
- value="https://example.org/a-trust-mark" />
- <entry
- key="trust_mark"
- value="eyJraWQiOiJtb2NrVHJ1c3RNYXJrSXNzdWVyS2V5IiwidHlwIjoidHJ1c3QtbWFyaytqd3QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RydXN0LW1hcmstaXNzdWVyLmZlZGVyYXRpb24ubG9jYWwiLCJzdWIiOiJodHRwczovL29wLmV4YW1wbGUub3JnIiwidHJ1c3RfbWFya190eXBlIjoiaHR0cHM6Ly9leGFtcGxlLm9yZy9hLXRydXN0LW1hcmsiLCJleHAiOjQ5MTgzNjczMzYsImlhdCI6MTc2NDc2NzMzNn0.smmtxeU_vCh2XFHLCxGHtwr_ZQ9A0-T7V9Poq5tNqwuU7_QlMAUJG1CJcprqQ9hH2oNSSQPIfUk7fOB1VUEY66U_bGBQ-KNQiIj-j25IQs7JalOCT1qjzcsMkq6i [...]
- </util:map>
- </constructor-arg>
- </bean>
- </util:list>
- </property>
- </bean>
- </entry>
- </util:map>
-
-</beans>
\ No newline at end of file
diff --git a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-trustchain-resolver.xml b/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-trustchain-resolver.xml
index 82f7d6b..7840bec 100644
--- a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-trustchain-resolver.xml
+++ b/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed-trustchain-resolver.xml
@@ -11,11 +11,11 @@
<bean id="shibboleth.oidfed.DefaultTrustedRemoteResolverEntitiesLookupStrategy" parent="shibboleth.Functions.Constant">
<constructor-arg name="target">
- <util:list value-type="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteResolverEntity">
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteResolverEntity"
+ <util:list value-type="net.shibboleth.oidfed.profile.TrustedRemoteResolverEntity">
+ <bean class="net.shibboleth.oidfed.profile.TrustedRemoteResolverEntity"
c:entity="https://trust-anchor.federation.local"
c:anchors="https://notworking.local,https://neither.another.local" />
- <bean class="net.shibboleth.idp.plugin.oidc.op.oidfed.profile.TrustedRemoteResolverEntity"
+ <bean class="net.shibboleth.oidfed.profile.TrustedRemoteResolverEntity"
c:entity="https://trust-anchor.federation.local"
c:anchors="https://trust-anchor.federation.local" />
</util:list>
diff --git a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed.properties b/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed.properties
index 6d166bf..9eb3c72 100644
--- a/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed.properties
+++ b/idp-oidfed-op-impl/src/test/resources/net/shibboleth/idp/module/conf/oidfed/oidfed.properties
@@ -1,3 +1,4 @@
+idp.oidfed.entityID = https://op.example.org
idp.oidfed.entity.authorityHints = https://anchor1.example.org, https://anchor2.example.org
idp.oidfed.cache.entityConfiguration.invalidContainerLifetime = PT0S
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list