[java-oidc-common] branch main updated: JCOMOIDC-161 - Facilitate extending the credential resolvers for RP/OP metadata

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/f27ff0b33458859b279a8242e90ec72c4e5acc1a

The following commit(s) were added to refs/heads/main by this push:
     new f27ff0b3 JCOMOIDC-161 - Facilitate extending the credential resolvers for RP/OP metadata
f27ff0b3 is described below

commit f27ff0b33458859b279a8242e90ec72c4e5acc1a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Nov 2 10:26:50 2026 +0000

    JCOMOIDC-161 - Facilitate extending the credential resolvers for RP/OP
    metadata
    
     - Make additional criteria optional via a strategy.
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-161
---
 .../impl/BaseJWTSignatureSecurityHandler.java      | 51 ++++++++++++++++++++--
 1 file changed, 48 insertions(+), 3 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
index 3462de54..06845054 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
@@ -53,6 +53,7 @@ import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.FunctionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
+import net.shibboleth.shared.resolver.Criterion;
 
 /**
  * Base class for security message handlers which evaluate a JWT signature with a signature trust engine.
@@ -106,6 +107,9 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
 
     /** The client information found from the lookup strategy. */
     @Nullable private OIDCClientInformation clientInformation;
+    
+    /** Strategy used to supply additional criteria for the trust engine criteria set. */ 
+    @Nonnull private Function<MessageContext, CriteriaSet> additionalCriteriaLookupStrategy;
 
     /** Constructor.*/
     protected BaseJWTSignatureSecurityHandler() {
@@ -113,6 +117,7 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
         clientInformationLookupStrategy = FunctionSupport.constant(null);
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
         securityParametersContextLookupStrategy = new ChildContextLookup<>(SecurityParametersContext.class, true);
+        additionalCriteriaLookupStrategy = FunctionSupport.constant(null);
     }
     
     /**
@@ -168,6 +173,22 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
                 Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
     }
     
+    /**
+     * Set a lookup strategy to provide additional {@link Criterion} as a {@link CriteriaSet} for inclusion in
+     * the final, built, criteriaSet for the trust engine to use.
+     * 
+     * @param strategy the strategy
+     * 
+     * @since 3.4.0
+     */
+    public void setAdditionalCriteriaLookupStrategy(
+    		@Nonnull final Function<MessageContext, CriteriaSet> strategy) {
+    	checkSetterPreconditions();
+    	
+		additionalCriteriaLookupStrategy = Constraint.isNotNull(strategy, "Additional criteria lookup strategy cannot "
+				+ "be null");
+	}
+    
     /**
      * Get the {@link OIDCPeerEntityContext} associated with the message.
      * 
@@ -231,6 +252,7 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
             criteriaSet.add(new ClientInformationCriterion(clientInformation));
         }
 
+        // TODO: deprecate this when things move over to the new credential resolver service for the SP
         if (profileConfiguration != null) {
             final ClientSecretCredential credential =
                     profileConfiguration.getClientCredential(PRC_LOOKUP.apply(messageContext));
@@ -253,9 +275,10 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
             criteriaSet.add(new SignatureValidationParametersCriterion(valParams));
         }
 
-        final ProfileRequestContext profileRequestContext = PRC_LOOKUP.apply(messageContext);
-        if (profileRequestContext != null) {
-            criteriaSet.add(new ProfileRequestContextCriterion(profileRequestContext));
+        final CriteriaSet additionalCriteria = additionalCriteriaLookupStrategy.apply(messageContext);
+        if (additionalCriteria != null) {
+        	// Note the strategy can not produce duplicate criteria, otherwise this will fail.
+        	criteriaSet.addAll(additionalCriteria);
         }
 
         return criteriaSet;
@@ -275,5 +298,27 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
             @Nonnull final Function<ProfileRequestContext, T> function) {
         return function.compose(PRC_LOOKUP);
     }
+    
+    /**
+     * A criteria set builder that looks up the {@link ProfileRequestContext} and includes it as a 
+     * {@link ProfileRequestContextCriterion}.
+     */
+    public static final class ProfileRequestContextCriteriaSetBuilder 
+    	implements Function<MessageContext, CriteriaSet> {
+
+		@Override
+		public CriteriaSet apply(final MessageContext messageContext) {
+			final CriteriaSet criteriaSet = new CriteriaSet();
+	        
+
+	        final ProfileRequestContext profileRequestContext = PRC_LOOKUP.apply(messageContext);
+	        if (profileRequestContext != null) {
+	            criteriaSet.add(new ProfileRequestContextCriterion(profileRequestContext));
+	        }
+
+	        return criteriaSet;
+		}
+    	
+    }
 
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.