[java-oidc-common] branch main updated: JCOMOIDC-188 - Add CriteriaSet Passthrough To LocalJOSEObjectCredentialResolver

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/26a84795f546a9be3a2278ef715fed6ccaab926a

The following commit(s) were added to refs/heads/main by this push:
     new 26a84795 JCOMOIDC-188 - Add CriteriaSet Passthrough To LocalJOSEObjectCredentialResolver
26a84795 is described below

commit 26a84795f546a9be3a2278ef715fed6ccaab926a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Oct 21 13:48:38 2026 +0100

    JCOMOIDC-188 - Add CriteriaSet Passthrough To LocalJOSEObjectCredentialResolver
    
     - Add backward compatible flag for passing through crterion from the
      caller.
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-188
---
 .../impl/LocalJOSEObjectCredentialResolver.java    | 42 ++++++++++++++++++++--
 1 file changed, 39 insertions(+), 3 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
index df7b436d..4c660fc4 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
@@ -73,7 +73,9 @@ import net.shibboleth.shared.resolver.ResolverException;
  *       added to the set to be returned providing they do not share the same private and public key
  *       pair as one already resolved - avoiding key duplication in the result.</li>
  * </ol>
- * Adds either 'kid' or 'public key' to the criteria set sent to the local credential resolver for resolution.
+ * <p>Adds either 'kid' or 'public key' to the criteria set sent to the local credential resolver for resolution.
+ * Optionally, criteria passthrough may be enabled to allow criteria provided by the caller to be merged into the 
+ * new {@link CriteriaSet} before credential resolution.</p>
  * 
  * @since 2.2.0
  * 
@@ -86,6 +88,13 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
     /** The resolver which is used to resolve local credentials. */
     @Nonnull private final JOSEObjectCredentialResolver localCredResolver;
     
+    /** 
+     * If the {@link CriteriaSet} from the caller should be copied into the {@link CriteriaSet} passed into the 
+     * local credential resolver. Defaults to false if not set, where only class constructed criteria are passed 
+     * through.
+     */
+    private final boolean criteriaPassthrough;
+    
     /**
      * Constructor.
      * 
@@ -93,8 +102,25 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
      */
     public LocalJOSEObjectCredentialResolver(@Nonnull  
             @ParameterName(name="localCredentialResolver") 
-            final JOSEObjectCredentialResolver localCredentialResolver) {        
+            final JOSEObjectCredentialResolver localCredentialResolver) {      
+    	this(localCredentialResolver, false);
+    }
+    
+    /**
+     * Constructor.
+     * 
+     * @param localCredentialResolver resolver of local credentials
+     * @param passthrough If the {@link CriteriaSet} from the caller should be copied into the 
+     * 								{@link CriteriaSet} passed into the local credential resolver
+     * 
+     * @since 3.4.0
+     */
+    public LocalJOSEObjectCredentialResolver(@Nonnull  
+            @ParameterName(name="localCredentialResolver") 
+            final JOSEObjectCredentialResolver localCredentialResolver,
+            @ParameterName(name="criteriaPassthrough") final boolean passthrough) {        
         localCredResolver = Constraint.isNotNull(localCredentialResolver, "Local credential resolver cannot be null");
+        criteriaPassthrough = passthrough;
     }
     
     /**
@@ -139,6 +165,11 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
                         log.trace("Adding 'kid' value '{}' to credential resolver", kid);
                         criteria.add(new EvaluableKeyIDCredentialCriterion(kid)); 
                     }
+                    if (criteriaPassthrough && criteriaSet != null) {
+                    	criteriaSet.stream()
+                    		.filter(criterion -> !criteria.contains(criterion))
+                    		.forEach(criteria::add);
+                    }
                     final List<Credential> localCredentials = resolveLocalCredentialsByCriteria(criteria);
                     log.trace("Matched {} local credential(s) from {} input credential(s) on 'public key' and optionally "
                             + "'kid' criterion", localCredentials.size(), credentials.size());
@@ -156,7 +187,12 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
             if (kid != null) {    
                 log.trace("Adding 'kid' value '{}' to credential resolver", kid);
                 criteria.add(new EvaluableKeyIDCredentialCriterion(kid));                
-            } 
+            }
+            if (criteriaPassthrough && criteriaSet != null) {
+            	criteriaSet.stream()
+            		.filter(criterion -> !criteria.contains(criterion))
+            		.forEach(criteria::add);
+            }
             final List<Credential> localCredentials = resolveLocalCredentialsByCriteria(criteria);
             log.trace("Found {} local credential(s)", localCredentials.size());
             results.addAll(localCredentials);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.